Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

HOWTO: Using DANE with MailMarshal

Expand / Collapse

This article applies to:

  • MailMarshal 10.1.0 and above
  • DNS-based Authentication of Named Entities (DANE)


  • What configuration is required to implement DANE with MailMarshal?


DANE is a standard that allows senders to validate the recipient endpoint for TLS delivery. Validation is based on information about the TLS certificate provided in TLSA DNS records, served securely with DNSSEC.

DANE support is available in MailMarshal 10.1.0 and above.

DANE evaluation is disabled by default in MailMarshal 10.1.0.

For DANE compliance:

  • Ensure that environmental prerequisites are configured.
  • Enable DANE for sending in MailMarshal
  • Optionally exclude specific domains from DANE evaluation in MailMarshal


Configuration of DNS infrastructure including DNSSEC and TLSA records is outside the scope of this article.

Before making any DANE related changes to MailMarshal configuration, install Marshal 10.1 or above.

Inbound DANE support requires:

  • DNSSEC compliant DNS infrastructure for the local domain
  • TLS certificate provided in MailMarshal and inbound TLS enabled
  • TLSA record in DNS for the local domain, matching the provided certificate
This information will be used by the sending server to validate DANE when sending messages.

Note that MailMarshal does not validate DANE for messages delivered to local domain servers. Security of the local domain connection is assumed to be under the full control of the domain owner.

Outbound DANE support requires:

  • Outbound TLS enabled

MailMarshal Configuration:

To enable DANE evaluation for mail sending:
  1. In the Management Console navigate to Configuration > Advanced Settings
  2. Add a setting: Sender.EnableDANE (boolean) True

MailMarshal will evaluate DANE based on RFC compliance of the recipient domain.

  • If all DNS lookups are secure and valid (MX, A, and TLSA) and the remote domain certificate is successfully verified, DANE validation succeeds.
  • If all DNS lookups are secure and valid but the certificate of the remote server does not validate, delivery fails permanently and a Non-Delivery Report is generated. 
  • If the DNSSEC evaluation returns "bogus" at any level (broken DNSSEC trust chain, invalid TLSA records or expired keys), delivery fails permanently and a Non-Delivery Report is generated. 
  • If any of the DNS lookups is insecure or the TLSA lookup returns NXDOMAIN, DANE evaluation is terminated and standard opportunistic TLS delivery is attempted.
You can use third party web-based tools to check the DNSSEC compatibility of any domain. Some links to third party tools are provided in the Related Links below.

Excluding Domains from DANE:

To exclude recipient domains from DANE evaluation:
  • Add domain wildcard entries like * to the User Group  DANE Excluded Domains
  • Enable the Content Analysis rule Policy Management Outbound > Ignore Dane Validation
This group and rule are created on a new install or upgrade to MailMarshal 10.1.0.
  • On upgrade if the Policy Management Outbound policy group does not exist, the rule will be created in a new upgrade policy group __Upgrade__DANE Rule.
  • NOTE: You must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.


In release 10.1.0, MailMarshal only supports DANE for MX based delivery. DANE is not validated for rule-based delivery to specific hosts, such as the rule action "set message routing to host" or "send a copy of the message to host"

To contact Trustwave about this article or to request support:

Rate this Article:

Related Links

Add Your Comments

Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster