From 5eb57e63d59e3622dca9365a21cd91561753680f Mon Sep 17 00:00:00 2001 From: Wez Furlong Date: Sun, 6 Apr 2025 07:44:43 -0700 Subject: [PATCH] shaping.toml: disable dane for office365-dane We cannot default it to enabled because a fully working dane setup requires additional configuration in the resolver and we cannot guarantee that that has happened here. --- assets/policy-extras/shaping.toml | 5 ++++- docs/changelog/main.md | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/assets/policy-extras/shaping.toml b/assets/policy-extras/shaping.toml index 4ba8509b..8e3fa9e9 100644 --- a/assets/policy-extras/shaping.toml +++ b/assets/policy-extras/shaping.toml @@ -134,7 +134,10 @@ provider_connection_limit = 5 [provider."office365-dane"] match=[{MXSuffix=".mx.microsoft"}] -enable_dane = true +# Ideally we'd enable dane here, but most sites are not +# configured to work correctly with DNSSEC or DANE out +# of the box, so we leave it disabled. +# enable_dane = true max_deliveries_per_connection = 50 provider_connection_limit = 5 diff --git a/docs/changelog/main.md b/docs/changelog/main.md index 670d7474..cec2d73d 100644 --- a/docs/changelog/main.md +++ b/docs/changelog/main.md @@ -62,6 +62,10 @@ (to move to the top/bottom). Pressing `f` edits a fuzzy matching filter. Pressing Tab moves through tabs and allows viewing heatmap vizualizations. #372 +* Disabled DANE in the default `shaping.toml` for the `office365-dane` provider. + We cannot default DANE to on without a guarantee that the DNS/resolver + situation is correctly deployed with DNSSEC and without also knowing that + we're configure to use openssl. ## Fixes