Web­sites Supp­or­ting DANE

DANE is a method to establish a trusted world wide web where sites can no more be easily spoofed by secret services. The certificate of a website is matched against a hash in the DNNSEC signed TLSA DNS resource record which should assure that the site you are visiting does in deed belong to the domain owner and not another party. Certification authorities are said to issue rogue certificates for secret services thus easily enabling the spoofing of a website.

valuable resources supporting DANE:

• a̅tea secure DANE https downloader
• visualizing DNSSEC (DANE = DNSSEC + TLSA record)
• checking a site for DANE
• implement DANE for your own site: add a TLSA DNS-resource record
• DANE on the command line
• sys4.de: check for SMTP/DANE
• sidnlabs.nl: check for dane (only yes/no)

Websites that allow to verify their certificate via DANE

• https://www.freebsd.org
• https://torproject.org
• https://debian.org, unfortunately not: cdimage.debian.org
• https://www.elstel.org
• https://www.afnic.fr/
• https://www.bortzmeyer.org/ (browser may warn if CAcert is not configured)
• https://www.huque.com/
• https://jhcloos.com/

Websites that use DANE to pin a certification authority (not so secure)

• https://fedoraproject.org

Get your own site listed: