DANE for SMTP lets a receiving domain publish TLSA records that sending MTAs can authenticate through DNSSEC. Those records describe acceptable TLS credentials or keys for the MX service.

The trust path is different from MTA-STS. DANE depends on correctly deployed DNSSEC and TLSA data; MTA-STS discovers policy through DNS but retrieves its enforceable policy over HTTPS.

DANE can provide strong downgrade resistance, but DNSSEC, certificate/key rotation and TLSA lifecycle all become production dependencies.

Reference material