shaping.toml: disable dane for office365-dane

We cannot default it to enabled because a fully working
dane setup requires additional configuration in the resolver
and we cannot guarantee that that has happened here.

assets/policy-extras/shaping.toml

@@ -134,7 +134,10 @@ provider_connection_limit = 5
 
 [provider."office365-dane"]
 match=[{MXSuffix=".mx.microsoft"}]
-enable_dane = true
+# Ideally we'd enable dane here, but most sites are not
+# configured to work correctly with DNSSEC or DANE out
+# of the box, so we leave it disabled.
+# enable_dane = true
 max_deliveries_per_connection = 50
 provider_connection_limit = 5
 

docs/changelog/main.md

@@ -62,6 +62,10 @@
   (to move to the top/bottom). Pressing `f` edits a fuzzy matching filter.
   Pressing Tab moves through tabs and allows viewing heatmap vizualizations.
   #372
+* Disabled DANE in the default `shaping.toml` for the `office365-dane` provider.
+  We cannot default DANE to on without a guarantee that the DNS/resolver
+  situation is correctly deployed with DNSSEC and without also knowing that
+  we're configure to use openssl.
 
 ## Fixes