Implement DANE for added security and privacy

DANE (DNSSEC) would be hugely beneficial to the security and privacy of ProtonMail. DANE makes Man-in-the-Middle attacks practically impossible.

This is a necessary addition and should certainly be prioritized over-all, as it is at the core of what ProtonMail represents: privacy and security.

It's currently a feature available over at Tutanota (https://tutanota.com) and definitely sets it apart as an arguably more secure option, here's a great read on the topic: https://tutanota.com/blog/posts/dane-everywhere

193 votes

Nathan Lecompte shared this idea · May 24, 2018 · Report… · Admin →

An error occurred while saving the comment

John Connett commented · April 30, 2022 7:32 AM · Report

A publicly visible DNS service with encrypted access, DNSSEC and DANE would be very useful. Using ProtonMail name servers rather than the default ones provided by my domain provider would close a potential security hole.

Submitting...
Nathan Lecompte commented · September 9, 2019 4:48 AM · Report

Awesome! Seems like DANE is already up and running: https://www.hardenize.com/report/protonmail.ch/1567954560#email_dane

Can't wait for version 4.0 - props to the ProtonMail team for valuing community input!

Submitting...
Anonymous commented · April 4, 2019 7:33 AM · Report

Yes! This is exactly what is needed next.

Submitting...
AdminProton (Admin, Proton) commented · February 19, 2019 6:52 AM · Report

HI! Thanks for the suggestion. It will happen after our domain/DNS code refactor.

Submitting...
Nathan Lecompte commented · February 18, 2019 5:27 PM · Report

@Wil they do have DNSSEC setup but they do NOT seem to be using DANE. This tool gives a neat overview of the supported security standards by their mail server(s) at the present time: https://www.hardenize.com/report/protonmail.ch/1550539314#email_dane

Submitting...
Wil commented · February 9, 2019 5:45 PM · Report

Someone should update the status of this, looks to me like they're running DNSSEC currently.

Submitting...
[Deleted User] commented · January 21, 2019 11:23 PM · Report

Small update: Mailbox.org seems to have added **** support as well.

Submitting...
Jeremy commented · May 31, 2018 6:35 PM · Report

Yeah, it's long overdue that Protonmail implements DANE. As you said Tutanota offer's it and so does Posteo. Both have had it for about 4 years now. More email providers need to get to work and add this, especially if your one that care's anything about secure email.

Submitting...
[Deleted User] commented · May 24, 2018 6:13 AM · Report

I absolutely agree, it'd definitely add to the security aspect of ProtonMail. It's not too big of an ask either compare to some of the other feature requests on here :P

Submitting...
amilopowers commented · October 10, 2016 2:56 PM · Report

I've seen that posteo.de and kolabnow.com use DANE (DNSSEC) to secure their e-mail Services.

I think protonmail could be even more secure with DANE. You can read about it here: https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

Submitting...