-#ifdef EXPERIMENTAL_DANE
-if (dane)
- {
- dns_record * rr;
- dns_scan dnss;
- uschar * hostnames[2] = { host->name, NULL };
-
- if (DANESSL_init(client_ssl, NULL, hostnames) != 1)
- return tls_error(US"hostnames load", host, NULL);
-
- for (rr = dns_next_rr(&tlsa_dnsa, &dnss, RESET_ANSWERS);
- rr;
- rr = dns_next_rr(&tlsa_dnsa, &dnss, RESET_NEXT)
- ) if (rr->type == T_TLSA)
- {
- uschar * p = rr->data;
- int usage, selector, mtype;
- const char * mdname;
-
- GETSHORT(usage, p);
- GETSHORT(selector, p);
- GETSHORT(mtype, p);
-
- switch (mtype)
- {
- default: /* log bad */ return FAIL;
- case 0: mdname = NULL; break;
- case 1: mdname = "sha256"; break;
- case 2: mdname = "sha512"; break;
- }
-
- switch (DANESSL_add_tlsa(client_ssl,
- (uint8_t) usage, (uint8_t) selector,
- mdname, p, rr->size - (p - rr->data)))
- {
- default:
- case 0: /* action not taken */
- return tls_error(US"tlsa load", host, NULL);
- case 1: break;
- }
- }
- }