diff --git a/crates/smtp/src/outbound/dane/verify.rs b/crates/smtp/src/outbound/dane/verify.rs index 8e001a05..f119223c 100644 --- a/crates/smtp/src/outbound/dane/verify.rs +++ b/crates/smtp/src/outbound/dane/verify.rs @@ -123,8 +123,13 @@ impl TlsaVerify for Tlsa { } } - if (self.has_end_entities == matched_end_entity) - && (self.has_intermediates == matched_intermediate) + // DANE is valid if: + // - EE matched even if no TA matched + // - Both EE and TA matched + // - EE is not present and TA matched + if (self.has_end_entities && matched_end_entity) + || ((self.has_end_entities == matched_end_entity) + && (self.has_intermediates == matched_intermediate)) { tracing::info!( parent: span,