January 2015 - dane-users

ANN: tlsa.info and dane.sys4.de merge
by Patrick Ben Koetter 17 Jan '15

17 Jan '15

Greetings! Yesterday night we merged tlsa.info and dane.sys4.de. Since then visitors to https://www.tlsa.info will be redirected to https://dane.sys4.de permanently. When Jan Münnich from dotplex <https://www.dotplex.de> set up tlsa.info there was no working DANE test site at all. And although the test suite at tlsa.info did only DNS based checks it became the most important DANE test site within short. From Viktor's surveys tlsa.info accounts for the largest number of DANE validated domains. Viktor and Jan had been in private conversation for a while. When Viktor told him we were planning to create a validator that fully checks DANE functionality Jan offered to merge the sites. Our DANE validator benefits from tlsa.info's popularity. Visitors to tlsa.info get to benefit from our validators functionality. One checker less to visit when you take out to create a working DANE policy. Thank you for this exceptional donation, Jan! p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

1 0

What would you like to read about DANE on the test site?
by Patrick Ben Koetter 16 Jan '15

16 Jan '15

Greetings, one of the tasks until v1 is a page/are some pages, that lets visitors of the test site read more about DANE. What would you want to read about DANE? Things that come to my mind are: - What is DANE? - Which problems does it solve? - How does it work? - Which SMTP software supports DANE? Please feel free to comment. I'd like to come up with something useful for those who want to read into DANE. p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

4 9

Hallo
by Frank Fiene 16 Jan '15

16 Jan '15

Moin Moin! Ich bin gerade dabei, zum Testen meine eigene Domain fiene.io mit DNSsec und DANE auszurüsten um das später mit unserer produktiven Domain auch durchführen zu lassen. Ich versuche mit dem DANE SMTP Validator https://dane.sys4.de <https://dane.sys4.de/> (Danke, sys4!) das Ganze zu testen und weiß, dass da noch nicht alles fertig ist. Es kann ja jeder mal versuchen: https://dane.sys4.de/smtp/fiene.io <https://dane.sys4.de/smtp/fiene.io> und da fängt schon meine erste Frage an: Warum ist DNSSEC oben gelb und unten rot? http://dnssec-debugger.verisignlabs.com/fiene.io <http://dnssec-debugger.verisignlabs.com/fiene.io> zeigt wenigstens, dass DNSsec richtig konfiguriert ist. Wenn ich auf Show Details klicke, kommt auch keine Erläuterung Viele Grüße! Frank -- Frank Fiene IT-Security Manager VEKA Group Fon: +49 2526 29-6200 Fax: +49 2526 29-16-6200 mailto: ffiene(a)veka.com http://www.veka.com PGP-ID: 62112A51 PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51 Threema: VZK5NDWW VEKA AG Dieselstr. 8 48324 Sendenhorst Deutschland/Germany Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler, Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer HRB 8282 AG Münster/District Court of Münster

6 8

Validator strange behaviour/bug?
by Leon Weber 14 Jan '15

14 Jan '15

Hi, First of all, thanks for the DANE validator, it’s a very useful too! One thing I’ve noticed: I have a domain with two MX records, one of which is missing a TLSA record. That’s obviously a misconfiguration, and the validator points that out correctly, however, it seems to ignore the second MX record: <https://dane.sys4.de/smtp/lists.zombofant.net> % dig mx lists.zombofant.net +short 23 io.sotecware.net. 42 mail.sotecware.net. Is that expected behaviour (stop at earliest error)? I think it’s confusing and there should at least be some hint that there may be further MX records. Ideally it would just print both MX records and test both of them. -- Leon.

3 2

Test message - please ignore
by John 14 Jan '15

14 Jan '15

I changed my email address and just want to check my sieve filter is working. -- John Allen KLaM ------------------------------------------ we should be careful not to ascribe to malice what could equally be explained by incompetence

1 0

DANE/DNSSEC nagios plugin checks
by Markus Benning 13 Jan '15

13 Jan '15

Hello, the DANE SMTP validator is great! Thank you for providing it. I wish it had been around at the time I enabled DANE ;-) I'm using delv and posttls-finger to monitor DANE/DNSSEC in the icinga2 monitoring system. I just uploaded the nagios plugin scripts to github and wrote 2 blog posts about configuring it. Github: https://github.com/benningm/nagios-plugins Blog: https://markusbenning.de/blog/ Markus -- Markus Benning, https://markusbenning.de/

1 0