Dear Posteo users,

We have just released a new feature for you: Our webmail interface now shows you which of your contacts you can send to with the optimal security of DANE technology. This can be recognised by a small, green DANE symbol above an email address.

For us, the new DANE display is something very special. When we introduced this new piece of security technology in May 2014, Posteo was according to heise.de the first provider worldwide to support DANE. Many IT experts were unsure at that time whether the new technology would become established. In the meantime, this has changed – it is now worthwhile displaying whether another server supports DANE: We now transfer emails to many email servers worldwide using DANE as standard, including large email providers such as 1&1 (as well as mail.com, GMX and web.de) and Comcast.

The technology is becoming widespread for good reason: DANE eliminates various weaknesses in the widely used transport route encryption between servers – STARTTLS, and increases security of the encrypted transport of emails. Without DANE, encryption would not be “forced”, for example, but instead newly-negotiated for each connection between the email servers involved. With DANE, email servers communicating with one another must encrypt every connection. If the encryption is disrupted or the communication is subject to an attack, the email will not be sent. Servers that are capable of DANE also undertake a check of their security certificates prior to sending – in a process similar to an ID check. This ensures that the other server is in fact the “actual target” of the communication and not a so-called man-in-the-middle placed in between. With DANE, encrypted sending can be ensured in advance, which is why we are providing a DANE status display in the webmail interface. In summary, for you the new display means that if you see the symbol displayed, your email is guaranteed to be transferred to that recipient with DANE. Firstly, it will be sent over an encrypted transport route, and secondly, it will be sent to the actual, legitimate recipient.

Tip: The TLS-sending guarantee also protects you for servers without DANE

If the DANE symbol is not displayed for an address, then the receiving server does not yet support DANE. Examples of large providers that do not yet support DANE include Gmail and Yahoo.

These do support encrypted connections between email servers. Without DANE, however, in case of interruptions or attacks as described above, unencrypted connections can occur. This the case anew for every single email. Without DANE, therefore, no serious assertion can be made about the security of a connection between two email servers.

Here is an important tip for you: With Posteo, you can categorically prevent sending without TLS.

Activate your personal TLS-sending guarantee in your account settings

This ensures that the transport route for your emails is guaranteed to be encrypted with TLS, even to servers that do not support DANE. If you activate the TLS-sending guarantee, we will only send your email when the message can be sent with encryption. If secure sending over an encrypted connection is not possible, sending of the email will not occur – and you receive a notification from us. Therefore, if an unauthorised third party attacks a secure connection wanting to force an unencrypted connection, sending will be prevented.

Best regards,

The Posteo team

Related reading: Why does Posteo display the DANE status but not the TLS status?