JA EN
shiichan

Cloudflare Email Security now speaks DANE: verified encryption for MX delivery!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#infrastructure

Hey there, Shiichan here! Today's update makes your email transport a little tougher, so a receiving server can actually confirm it is talking to the right certificate. It is a quiet change, but a happy one.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On Cloudflare's Changelog, Email Security announced DANE (DNS-based Authentication of Named Entities) support for MX deployments. It brings DNSSEC-backed certificate verification to Cloudflare's regional MX records.

The story so far

Until now, email transport encryption was "opportunistic." If the other side supported TLS, the connection got encrypted, but nobody strongly checked whether that certificate really belonged to the right server. That left room for an attacker to strip the encryption or slip in a spoofed certificate.

What changes

DANE-capable SMTP senders can now cryptographically validate certificate identities before establishing a TLS connection. That moves email delivery from opportunistic encryption to verified encrypted delivery.

moving beyond opportunistic encryption to verified encrypted delivery.

The nice part: it turns on automatically for every customer using regional MX deployments. No extra configuration is needed, and DANE-capable mail infrastructure will validate MX certificates using the published records on its own.

Dive Deep

Here is how it works. Regional MX hostnames publish DNSSEC-backed TLSA records in DNS. A sender first confirms the DNS answer has not been tampered with (thanks to DNSSEC), then matches those TLSA records against the server's certificate. If they line up, the sender trusts the destination and delivers over TLS.

This applies to every Email Security package:

  • Advantage
  • Enterprise
  • Enterprise + PhishGuard

Wrap-up

  • Cloudflare Email Security now supports DANE for MX deployments
  • Regional MX hostnames publish DNSSEC-backed TLSA records so certificates can be cryptographically verified
  • Opportunistic encryption to verified encrypted delivery
  • It turns on automatically for regional MX users, with no extra config
  • Advantage, Enterprise, and Enterprise + PhishGuard are all covered

If you run security-conscious mail and worry about eavesdropping or spoofing, this is a welcome step.

Related posts