DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records

crates/smtp/Cargo.toml

@@ -7,7 +7,7 @@ homepage = "https://stalw.art/smtp"
 keywords = ["smtp", "email", "mail", "server"]
 categories = ["email"]
 license = "AGPL-3.0-only OR LicenseRef-SEL"
-version = "0.16.10"
+version = "0.16.11"
 edition = "2024"
 
 [dependencies]

crates/smtp/src/outbound/delivery.rs

@@ -640,9 +640,12 @@ impl QueuedMessage {
                 );
 
                 // Obtain source and remote IPs
+                let dane_enabled = tls_strategy.try_dane()
+                    && is_smtp
+                    && server.core.smtp.resolvers.dnssec_available;
                 let time = Instant::now();
                 let resolve_result = match server
-                    .resolve_host(remote_host, &envelope, tls_strategy.try_dane() && is_smtp)
+                    .resolve_host(remote_host, &envelope, dane_enabled)
                     .await
                 {
                     Ok(result) => {
@@ -678,7 +681,7 @@ impl QueuedMessage {
                 };
 
                 // Lookup DANE policy
-                let dane_policy = if tls_strategy.try_dane() && is_smtp {
+                let dane_policy = if dane_enabled {
                     let time = Instant::now();
                     let strict = tls_strategy.is_dane_required();