diff --git a/assets/policy-extras/shaping.toml b/assets/policy-extras/shaping.toml
index 4ba8509b..8e3fa9e9 100644
--- a/assets/policy-extras/shaping.toml
+++ b/assets/policy-extras/shaping.toml
@@ -134,7 +134,10 @@ provider_connection_limit = 5
 
 [provider."office365-dane"]
 match=[{MXSuffix=".mx.microsoft"}]
-enable_dane = true
+# Ideally we'd enable dane here, but most sites are not
+# configured to work correctly with DNSSEC or DANE out
+# of the box, so we leave it disabled.
+# enable_dane = true
 max_deliveries_per_connection = 50
 provider_connection_limit = 5
 
diff --git a/docs/changelog/main.md b/docs/changelog/main.md
index 670d7474..cec2d73d 100644
--- a/docs/changelog/main.md
+++ b/docs/changelog/main.md
@@ -62,6 +62,10 @@
   (to move to the top/bottom). Pressing `f` edits a fuzzy matching filter.
   Pressing Tab moves through tabs and allows viewing heatmap vizualizations.
   #372
+* Disabled DANE in the default `shaping.toml` for the `office365-dane` provider.
+  We cannot default DANE to on without a guarantee that the DNS/resolver
+  situation is correctly deployed with DNSSEC and without also knowing that
+  we're configure to use openssl.
 
 ## Fixes