DANE is a scheme whereby TLS certificates are stored in DNSSEC-signed DNS records.
The conventional nerd wisdom is: this is fantastic, because it's a step towards replacing the totally broken CA system with something that technical people can take direct control over. I like that story too.
Unfortunately, the conventional wisdom is totally wrong. DANE does not eliminate CAs. Even in a world where DANE is universally deployed in all browsers (no browser does it today --- and several tried, and then removed support), we will still have CAs. What DANE will give us is a bunch of new CAs: one for every TLD, and one at the root. Don't take my word for this: Adam Langley, TLS superhero of the Chromium team, wrote an excellent blog post explaining why.
But it gets worse. Those new CAs DANE deployed? They are controlled overwhelmingly by world governments. The most popular DNS TLDs are all legally bound to the governments of the FVEY IC. Here again you don't have to take my word for it: all you have to do is look at what the DOJ did to file sharing sites by asserting its control of the DNS.
Lots of things are happening behind the scenes to make the train wreck of Internet trust a little better:
* CA certificates themselves are hurtling towards "free", especially now that we have Let's Encrypt
* Major browsers are implementing HPKP and static key pinning, so that once you see a certificate for a pinned domain, your browser remembers and screams bloody murder if it changes unexpectedly. Someone who attempts to get a domain-validated certificate to hijack Google Mail will, in the best case, succeed only in getting the CA dumb enough to do that kicked out of the Chrome and Firefox root trust store.
* Google and others are coordinating efforts to monitor certificate issuance, not just using certificate pins but also with initiatives like Certificate Transparency, which involves cooperation from CAs that Google has repeatedly shown willingness to require as a condition of being included in their trust store.
DNSSEC is not one of those things. It's a broken protocol, an attempt to deploy decades-outmoded cryptography across the backbone of the Internet, and, in the very best case, a bit of security theater.
This, to me, is one of the rare cases where I think random end users who aren't in the unofficial cabal of TLS library maintainers, ISP operators, or standards committee members can make a real difference in Internet security.
Don't let people pretend that DNSSEC is a good thing just because the name ends in SEC. When you see people cheerleading DNSSEC deployments, challenge them. DNSSEC deployment is failing, and has been failing for something like 15 years now. Let's try to keep it that way!