@Gargron @selea

On each attempt to connect to a federated instance:

1) check presence of TLSA record in DNS for _xxx._tcp.host.example.com where _xxx is the target port number used by Mastodon/Matrix
2) get the hash from the TLSA record
3) when TLS connection is established, verify the TLSA hash against the certificate actually received

Details https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

@Gargron @selea

Oh and 0) check if DNS response is DNSSEC-authenticated

For Synapse I can actually come up with a PR as it's Python, not sure about Mastodon.

@kravietz

For me, it sounds really strange that you got that reaction. It sounds like the next logical step to take for synapse!

Also, I would love if the @nextcloud client would support it aswell!

@kravietz did explain it very well, so I do feel that I do not need to explain it further :)

@Gargron