DNS-based Authentication of Named Entities

E831086

Internet security protocol

DNS-based Authentication of Named Entities (DANE) is an Internet security protocol that uses DNSSEC to bind X.509 certificates to domain names, enabling secure TLS connections without relying solely on traditional certificate authorities.

Try in SPARQL Jump to: Surface forms Disambiguation Statements Elicitation Referenced by

All labels observed (2)

Label	Occurrences
DNS-Based Authentication of Named Entities	5
DNS-based Authentication of Named Entities canonical	2

How this entity was disambiguated

This entity first appeared as the object of triple T9932162 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.

NED1 Entity disambiguation (via context triple) gpt-5-mini-2025-08-07

Target entity: DNS-based Authentication of Named Entities
Context triple: [DANE, fullName, DNS-based Authentication of Named Entities]

A. DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
DNS Security (DNSSEC) Hashed Authenticated Denial of Existence is a DNSSEC extension that uses cryptographic hashing to provide verifiable, secure proof that a requested DNS name or type does not exist without revealing the full contents of a zone.
B. Automated Updates of DNS Security (DNSSEC) Trust Anchors
"Automated Updates of DNS Security (DNSSEC) Trust Anchors" is an IETF specification that defines a mechanism for DNS resolvers to automatically maintain and update their DNSSEC trust anchors without manual intervention.
C. Protocol Modifications for the DNS Security Extensions
"Protocol Modifications for the DNS Security Extensions" is an IETF standards-track document (RFC 4035) that specifies how DNSSEC is operationally implemented and processed by DNS resolvers and authoritative servers.
D. DNS Root Name Service Protocol and Deployment Requirements
"DNS Root Name Service Protocol and Deployment Requirements" is an IETF specification that defines the technical and operational requirements for the protocols and deployment practices used by the DNS root name service.
E. Clarifications to the DNS Specification
Clarifications to the DNS Specification is an IETF document (RFC 2181) that refines and corrects aspects of the original Domain Name System standards to ensure more consistent and interoperable DNS implementations.
F. None of above. chosen
G. Unsure - the case is ambiguous/there is not enough information to decide.

NED2 Entity disambiguation (via description) gpt-5-mini-2025-08-07

Target entity: DNS-based Authentication of Named Entities
Target entity description: DNS-based Authentication of Named Entities (DANE) is an Internet security protocol that uses DNSSEC to bind X.509 certificates to domain names, enabling secure TLS connections without relying solely on traditional certificate authorities.

A. DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
DNS Security (DNSSEC) Hashed Authenticated Denial of Existence is a DNSSEC extension that uses cryptographic hashing to provide verifiable, secure proof that a requested DNS name or type does not exist without revealing the full contents of a zone.
B. Automated Updates of DNS Security (DNSSEC) Trust Anchors
"Automated Updates of DNS Security (DNSSEC) Trust Anchors" is an IETF specification that defines a mechanism for DNS resolvers to automatically maintain and update their DNSSEC trust anchors without manual intervention.
C. Protocol Modifications for the DNS Security Extensions
"Protocol Modifications for the DNS Security Extensions" is an IETF standards-track document (RFC 4035) that specifies how DNSSEC is operationally implemented and processed by DNS resolvers and authoritative servers.
D. DNS Root Name Service Protocol and Deployment Requirements
"DNS Root Name Service Protocol and Deployment Requirements" is an IETF specification that defines the technical and operational requirements for the protocols and deployment practices used by the DNS root name service.
E. Clarifications to the DNS Specification
Clarifications to the DNS Specification is an IETF document (RFC 2181) that refines and corrects aspects of the original Domain Name System standards to ensure more consistent and interoperable DNS implementations.
F. None of above. chosen

Statements (51)

Predicate	Object
instanceOf	Internet security protocol ⓘ
abbreviation	DANE ⓘ
allows	domain owners to specify acceptable TLS certificates ⓘ use of self-signed certificates with DNSSEC-based trust ⓘ
appliesTo	HTTPS ⓘ IMAP ⓘ POP3 ⓘ SMTP ⓘ XMPP ⓘ
certificateUsageModes	CA constraint ⓘ domain-issued certificate ⓘ service certificate constraint ⓘ trust anchor assertion ⓘ
complements	certificate authority-based validation ⓘ public key infrastructure ⓘ
definedIn	RFC 6698 ⓘ RFC 7671 ⓘ RFC 7672 ⓘ RFC 7673 ⓘ
enables	certificate pinning via DNS ⓘ opportunistic TLS for SMTP ⓘ verification of TLS server certificates via DNSSEC ⓘ
introduced	2012 ⓘ
operatesAtLayer	application layer ⓘ
operatesWith	TCP-based services ⓘ UDP-based services ⓘ
primaryGoal	bind X.509 certificates to domain names ⓘ enable authentication of TLS endpoints via DNSSEC ⓘ reduce reliance on traditional certificate authorities ⓘ
protects	HTTPS connections ⓘ SMTP over TLS ⓘ TLS connections ⓘ
protectsAgainst	compromise of public certificate authorities ⓘ man-in-the-middle attacks on TLS ⓘ
recordType	TLSA ⓘ linked to: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
relatedTo	CAA DNS records ⓘ DNS Certification Authority Authorization ⓘ linked to: Certification Authority Authorization
reliesOn	DNSSEC validation by resolvers ⓘ DNSSEC-signed zones ⓘ TLSA records at service domain names ⓘ
requires	DNSSEC validation on client side or resolver side ⓘ
securityModel	DNSSEC-based trust model ⓘ
standardizedBy	IETF ⓘ linked to: Internet Engineering Task Force Internet Engineering Task Force ⓘ
status	Proposed Standard ⓘ
uses	DNS Security Extensions ⓘ linked to: Domain Name System Security Extensions DNSSEC ⓘ Domain Name System ⓘ TLSA resource records ⓘ linked to: Resource Records for the DNS Security Extensions Transport Layer Security ⓘ linked to: TLS X.509 certificates ⓘ

How these facts were elicited

Referenced by (7)

Full triples — surface form annotated when it differs from this entity's canonical label.

DANE → fullName → DNS-based Authentication of Named Entities ⓘ

RFC 6698 → workingGroup → DNS-based Authentication of Named Entities ⓘ

RFC 6698 → definesProtocol → DNS-Based Authentication of Named Entities ⓘ