dane-required
A sender required DANE and yours was not usable
By Jose Pollman · Published
How it appears in a report
"result-type": "dane-required"What it means
The sending server was configured to insist on DANE for your domain, and could not use it — your TLSA records were missing, unusable, or not backed by valid DNSSEC at the moment they tried.
Could be either end. This can originate at either end, so the failure reason and your own configuration are both worth checking.
Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.
Why it happens
This is the one type where the sender’s own policy is part of the story: they chose to require DANE. But the usual trigger is at your end — TLSA records withdrawn or broken while senders still expect them, often mid-migration or after a certificate change.
How to fix it
- Confirm your MX hosts publish usable TLSA records and that DNSSEC validates, since DANE is unusable without it.
- If you deliberately withdrew DANE, expect these until senders stop expecting it; the records should be removed cleanly rather than left broken.
- If you never intended to run DANE, check whether stale TLSA records exist for your MX hostnames.