November 2015 - dane-users

education.lu
by Wolfgang Breyha 08 Apr '16

08 Apr '16

Hi! I'm testing the new exim 4.85 DANE support and it took only some days to get in trouble... One of our users tried to send mail to the domain education.lu. Their domain and MX hosts are DNSSEC enabled and have TLSA RRs. The DANE validator https://dane.sys4.de/smtp/education.lu says: "Unusable TLSA Records". Most likely because it is type 1 not allowed for DANE-SMTP? I've set hosts_try_dane = * in my SMTP transport. Exim refuses to talk to those hosts at all with "failure while setting up TLS session". Is this expected behavior in terms of DANE-SMTP? What's postfix doing in this case? Greetings, Wolfgang -- Wolfgang Breyha <wbreyha(a)gmx.net> | http://www.blafasel.at/ Vienna University Computer Center | Austria

8 29

Deployment news (comcast.net publishes TLSA RRs)
by Viktor Dukhovni 21 Nov '15

21 Nov '15

Today comcast.net published TLSA records for their MX hosts. comcast.net. IN MX 5 mx1.comcast.net. comcast.net. IN MX 5 mx2.comcast.net. _25._tcp.mx1.comcast.net. IN TLSA 3 1 1 90e2f742b459860c0bbf1343b5a36bc5842a3f45056d30bf25dbb475a62eca47 _25._tcp.mx2.comcast.net. IN TLSA 3 1 1 c8cb2faa4c0b92cb3fd37e61eb4671744055f123c14c0dd31e8d92c379f9f8a3 $ posttls-finger -c -Lsummary -o inet_protocols=ipv4 "[mx1.comcast.net]" posttls-finger: Verified TLS connection established to mx1.comcast.net[96.114.157.80]:25: TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits) $ posttls-finger -c -Lsummary -o inet_protocols=ipv4 "[mx2.comcast.net]" posttls-finger: Verified TLS connection established to mx2.comcast.net[68.87.20.5]:25: TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits) Congratulations and thanks to Comcast. They are the first major US email provider to do so. Let's hope their lead will be followed by many others. My ongoing survey has now found 9389 working DANE domains. Most of these are served by a few domain hosting providers: 5230 udmedia.de 955 nederhost.net 354 transip.email 47 mediaweb-it.net 45 mailbox.org 36 gr-webdesign.de 32 core-networks.de 32 wk-serv.net 30 set-hosting.de 30 dotplex.de The actual numbers of DANE-enabled hosted domains is much larger, for example udmedia alone reportedly has over 25 thousand. My lists of candidate domains to test are far from complete. Of these 9389, there are now 28 domains (up from 27 yesterday now that comcast.net is live) that are "large enough" to be listed in Google's email transparency report: conjur.com.br jpberlin.de comcast.net freebsd.org mypst.com.br lrz.de rrpproxy.net ietf.org registro.br posteo.de t-2.net isc.org societe.com ruhr-uni-bochum.de aanbodpagina.nl netbsd.org t-2.com tum.de xs4all.nl openssl.org bayern.de unitymedia.de debian.org samba.org bund.de lepartidegauche.fr eu.org torproject.org On the "problem" front. The following DNS hosters still have some issues with correct DNSSEC "denial of existence": #Domains Provider -------- ---------- 33 binero.se (resolution in progress) 28 isphuset.no (issue acknowledged) 15 axc.nl (notified) 11 papaki.gr (notified) 5 forpsi.net (notified) And 10 "small" domains currently publish incorrect TLSA records: bebidaliberada.com.br solucoesglobais.com.br nevodnet.com zx.com 1post.de geekify.de wx0.de tsimnet.eu konundrum.org www.co.tt If anyone reading this happens to know a usable contact for the above, please let them know their TLSA records need updates. Finally, I have a list of ~97000 domains that have DNSSEC and at least one "primary" MX host has DNSSEC, but no TLSA records are published as yet. These domains are good candidates for DANE deployment, it is just a matter of deciding out of whether to use "3 1 1" end-entity records or "2 0 1" trust-anchor records, and documenting a key/cert rotation procedure: https://tools.ietf.org/html/rfc7671#section-5.1 https://tools.ietf.org/html/rfc7671#section-5.2 As always, don't forget: https://dane.sys4.de/common_mistakes#3 https://dane.sys4.de/common_mistakes#6 https://tools.ietf.org/html/rfc7671#section-8.1 https://tools.ietf.org/html/rfc7671#section-8.4 -- Viktor.

2 8

Please take care when deploying Let's Encrypt certificates...
by Viktor Dukhovni 20 Nov '15

20 Nov '15

If you've published DANE TLSA records for your current certificate chain, and are considering switch to Let's Encrypt issued certificates, please do not forget: https://dane.sys4.de/common_mistakes#3 https://tools.ietf.org/html/rfc7671#section-8.1 I've seen more than one of the early adopters of LE certificates neglect to update their TLSA records (a few TTLs) *before* deploying the new LE certificate chain. -- Viktor.

2 2

Re: Deployment news (comcast.net publishes TLSA RRs)
by Viktor Dukhovni 16 Nov '15

16 Nov '15

On Mon, Nov 16, 2015 at 09:41:57AM -0600, Mark Felder wrote: > > My ongoing survey has now found 9389 working DANE domains. Most > > of these are served by a few domain hosting providers: > > > > 5230 udmedia.de > > 955 nederhost.net > > 354 transip.email > > 47 mediaweb-it.net > > 45 mailbox.org > > 36 gr-webdesign.de > > 32 core-networks.de > > 32 wk-serv.net > > 30 set-hosting.de > > 30 dotplex.de > > > > Your numbers seem much higher than Verisign's. I wonder what Verisign's > secspider is missing? > > http://secspider.verisignlabs.com/stats.html They are counting zones with TLSA records. I'm counting domains whose MX hosts have TLSA records. Those 5230 domains for udmedia.de all resolve to MX hosts in just 1 zone. My dataset has 1265 MX hosts in 1185 zones, but the number of *domains* with SMTP DANE TLS is 9513. -- Viktor.

1 0