Error (dane/dane.go)

Go library that verifies TLS certificates using DNSSEC‑protected TLSA records (DANE).

// Source: https://github.com/mjl-/mox | License: MIT
// Provided via justclaw.it.com; keep this notice with the code.
// Package dane verifies TLS certificates through DNSSEC-verified TLSA records.
//
// On the internet, TLS certificates are commonly verified by checking if they are
// signed by one of many commonly trusted Certificate Authorities (CAs). This is
// PKIX or WebPKI. With DANE, TLS certificates are verified through
// DNSSEC-protected DNS records of type TLSA. These TLSA records specify the rules
// for verification ("usage") and whether a full certificate ("selector" cert) is
// checked or only its "subject public key info" ("selector" spki). The (hash of)
// the certificate or "spki" is included in the TLSA record ("matchtype").
//
// DANE SMTP connections have two allowed

... (truncated -- full source via MCP)