DANE

- [Instructor] DANE, DNS-based authentication…of named entities.…This is the latest attempt…in cutting down the amount of spoofed emails.…Tack that's being taken here…is to make it easier to produce your own…x.509 certificates by stating in your DNS records…using DNSSEC so that certificate authorities…don't have to be involved.…Certificate authorities have served us well,…but we've also seen several security incidents…where people are able to make certificates…that have been spoofed…by getting access to root certificates.…

So, this makes it easier to work with…self-signed certificates,…and then you get all the benefits…that come with a certificate.…Information can be found in RFC 6698.…There really isn't a good…single source of information on this,…so what I've done is provided you…with the information to the email archives…of the working group, which is still active.…It's probably the best source for information on this topic.…What does it look like?…It allows an email server…to generate its own x.509 certificate,…