CertaDNS

Advanced Email Trust

What sits on top of authentication: MTA-STS and DANE for transport, TLS-RPT for evidence, BIMI for the inbox, and the deliverability signals no DNS record can buy.

lessons
20
total
4 h
level
Advanced

Assumes DMARC Practitioner.

Start

You will be able to

  • Explain what an attacker can do to opportunistic TLS, and what stops it
  • Deploy and change an MTA-STS policy without losing mail
  • Read a TLS report and name the failure it describes
  • Read a TLSA record, and say when DANE is available to a domain at all
  • Choose between DANE and MTA-STS, or justify running both
  • State what BIMI requires, what it costs, and what it does not prove
  • Separate the deliverability problems authentication solves from the ones it cannot

Syllabus

  1. 1. The Transport Problem

    What an attacker does to opportunistic TLS, and the two answers the industry built.

    1. What opportunistic TLS leaves open11 min
    2. Two answers to the same problem10 min

  2. 2. MTA-STS

    The three pieces, reading a live policy, and changing one without losing mail.

    1. Three pieces, three failure points11 min
    2. Reading a policy file11 min
    3. Changing one safely12 min

  3. 3. TLS Reporting

    What the reports contain, and naming a failure from the type it carries.

    1. What TLS-RPT reports10 min
    2. Reading one11 min

  4. 4. DANE

    TLSA records, the DNSSEC dependency that decides availability, and choosing between the two.

    1. TLSA records12 min
    2. The dependency that decides availability11 min
    3. Choosing, or running both11 min

  5. 5. BIMI

    What it requires, what the certificate costs, and what a logo does and does not prove.

    1. What BIMI requires11 min
    2. VMC, CMC, and the trademark11 min
    3. Reading live records10 min

  6. 6. Beyond Authentication

    Forward-confirmed reverse DNS, complaint rates, and the bulk-sender requirements.

    1. What authentication does not buy10 min
    2. Forward-confirmed reverse DNS11 min
    3. Complaints and list hygiene10 min
    4. The bulk-sender requirements11 min

  7. 7. Adoption and Operation

    The order to deploy in, what breaks, and what to watch once it is live.

    1. The order to adopt in10 min
    2. What breaks11 min
    3. Monitoring the set10 min

  8. 8. Final assessment

    15 scenario questions · 80% to pass · unlimited retakes

    What the assessment covers

Advanced Email Trust

  • Complete every lesson in Advanced Email Trust
  • Pass the Advanced Email Trust assessment with at least 80%
About the certificates

CertaDNS Engineering · last reviewed