DANE comes with its own complications: it means you need DNSSEC, and that&#x27;s a bit of a pain to set up at the best of times, especially with there being no way to currently automating DS&#x2F;DNSKEY record updates to maintain the trust chain.<p>There have been some mutterings in the IETF ProvReg WG on ways of allowing registrants some ability to automate the process, but it&#x27;s still early days.