This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

DNSSEC, DANE and the server certificate

All topics · 03 · Encryption & protection · Deutsch

Where to find it

Preferences → Accounts → your account → Connection Security

DinoX must find the correct server and check its identity. DNSSEC validates protected information about server addresses. DANE can additionally specify which server certificate is accepted. These settings are per account and do not change message encryption.

What to do

Choose the mode and, if needed, a resolver URL.
Choose Apply. This saves both settings only for this account and reconnects it when enabled.
Read the result. Another account’s green status does not prove this account is working.

What do the choices mean?

Off

Uses normal TLS certificate checks. This does not automatically make the connection unencrypted.

Check automatically

Uses available validated DNS and DANE information. Missing signatures differ from failed validation: errors or failed lookups are not silently ignored.

Require DNSSEC and DANE

Connects only when the required evidence is present and valid. Without it, this account remains disconnected.

HTTPS DNS resolver URL

An additional service returning DNS answers over HTTPS. Enter a suitable resolver URL. Without one, direct connections use system DNS. Tor or SOCKS5 requires an HTTPS resolver through the proxy.

Server certificate

Shows details such as issuer, validity and fingerprint. This is the server certificate, not the contact’s OMEMO key. Check certificate errors with the provider.