In simple terms, DANE binds the SSL key information to a domain name and then protects that binding with DNSSEC. Because of this, it makes man in the middle attacks almost impossible, and it promises to help maintain data privacy and security on a global scale, especially with regard to email.   

​

DANE does not only challenge the certificate authority system but has the potential to revolutionize email security by making encrypted email delivery the norm in a world where email is largely transmitted unencrypted. It therefore plays an important role in email security and email deliverability. In fact, there are arguments that DANE should replace CA altogether and that it is a more effective way to improve email security compared to CA.   

​

It in effect eliminates several weaknesses of SSL and, in the process, increases the security of SSL protected emails. It does this by storing the digital fingerprints of an SSL certificates in the DNS. Mail servers and browsers can then automatically verify the authenticity of the certificate before establishing a secure connection or sending an email via SSL transport encryption. In this way, it eliminates the situation where criminals pretend to be a particular web or mail server to gain access to login data or other personal information with the use of fake certificates.

​

In addition, DANE entries in the DNS are secured with the help of DNSSEC. This prevents others from changing entries in the DNS system and substituting any of the digital fingerprints of SSL certificates.