Understand DANE and SMTP TLS Warnings

TLS warnings vary in importance. Some are informational. Others show transport expectations that are not consistently met.

What the checks usually mean

  • tls_observed: the message path showed evidence of TLS in Received headers
  • smtp_tls_probe: the MX host answered or failed a STARTTLS probe
  • dane: whether TLSA records are published

When to act immediately

  • STARTTLS fails on mail infrastructure you control
  • MX hosts do not support the transport policy you expect
  • DANE is intentionally part of your security design and records are missing

When not to overcorrect

  • DANE warnings are normal if you are not using DNSSEC-backed TLSA
  • TLS header detail can be incomplete even when transport was acceptable

The right fix depends on your stack. Treat DANE as advanced infrastructure. Treat STARTTLS failures as a more practical day-to-day issue.