April 2015 - dane-users

education.lu
by Wolfgang Breyha 08 Apr '16

08 Apr '16

Hi! I'm testing the new exim 4.85 DANE support and it took only some days to get in trouble... One of our users tried to send mail to the domain education.lu. Their domain and MX hosts are DNSSEC enabled and have TLSA RRs. The DANE validator https://dane.sys4.de/smtp/education.lu says: "Unusable TLSA Records". Most likely because it is type 1 not allowed for DANE-SMTP? I've set hosts_try_dane = * in my SMTP transport. Exim refuses to talk to those hosts at all with "failure while setting up TLS session". Is this expected behavior in terms of DANE-SMTP? What's postfix doing in this case? Greetings, Wolfgang -- Wolfgang Breyha <wbreyha(a)gmx.net> | http://www.blafasel.at/ Vienna University Computer Center | Austria

8 29

the upcoming Windows DNS server will support DANE records ...
by Carsten Strotmann (sys4) 16 Apr '15

16 Apr '15

Hi, the next Windows DNS Server will have support for DANE records, among other good stuff (RRL, Views, Application HA) https://technet.microsoft.com/en-us/library/dn765484.aspx -- Carsten

1 0

Dane testing and posttls-finger ???
by John Allen 11 Apr '15

11 Apr '15

When I try "posttls-finger dane.sys4.de" I get the following. I have emphasized a couple of areas in the following text that cause me some concern. posttls-finger: Connected to dane.sys4.de[194.126.158.134]:25 posttls-finger: < 220 dane.sys4.de ESMTP Postfix posttls-finger: > EHLO smtp.klam.ca posttls-finger: < 250-dane.sys4.de posttls-finger: < 250-PIPELINING posttls-finger: < 250-SIZE 10240000 posttls-finger: < 250-ETRN posttls-finger: < 250-STARTTLS posttls-finger: < 250-ENHANCEDSTATUSCODES posttls-finger: < 250-8BITMIME posttls-finger: < 250 DSN posttls-finger: > STARTTLS posttls-finger: < 220 2.0.0 Ready to start TLS posttls-finger: dane.sys4.de[194.126.158.134]:25: Matched subjectAltName: dane.sys4.de posttls-finger: dane.sys4.de[194.126.158.134]:25: subjectAltName: sys4.de posttls-finger: dane.sys4.de[194.126.158.134]:25 CommonName dane.sys4.de posttls-finger:*certificate verification failed* for dane.sys4.de[194.126.158.134]:25: untrusted issuer /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority posttls-finger: dane.sys4.de[194.126.158.134]:25: subject_CN=dane.sys4.de, issuer_CN=StartCom Class 2 Primary Intermediate Server CA, fingerprint=41:B5:70:D5:35:68:72:B2:64:4C:5E:DE:74:52:23:E1:3B:3A:03:07, pkey_fingerprint=E5:CD:96:DD:35:8C:91:30:75:5B:D0:66:47:1D:CD:83:39:9A:D5:CC posttls-finger:*Untrusted TLS connection *established to dane.sys4.de[194.126.158.134]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) posttls-finger: > EHLO smtp.klam.ca posttls-finger: < 250-dane.sys4.de posttls-finger: < 250-PIPELINING posttls-finger: < 250-SIZE 10240000 posttls-finger: < 250-ETRN posttls-finger: < 250-ENHANCEDSTATUSCODES posttls-finger: < 250-8BITMIME posttls-finger: < 250 DSN posttls-finger: > QUIT posttls-finger: < 221 2.0.0 Bye Certificate verification fails and I wind up with an untrusted connection. Is this something I did or is there a real problem? John A

3 7

ANN: dane.sys4.de 1.0 released
by Patrick Ben Koetter 09 Apr '15

09 Apr '15

We've just released version 1.0 of https://dane.sys4.de. Among some bug fixes are many improvements to provide more meaningful output. We've also removed the table, listing DANE tested domains, from the homepage. Sites that already have been tested will now show up in a live search as soon as you start typing a domain name into the input field. Thank you all for your valuable input! p@rick (on behalf of the dane.sys4.de team) -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 2

ANN: DANE testing (sink@dane.sys4.de)
by Patrick Ben Koetter 09 Apr '15

09 Apr '15

If you need a DNSSEC-enabled destination to test your DANE setup, send a message to sink(a)dane.sys4.de. It will accept your message and discard it. Check your log for a line "to dane.sys4.de". If it reads "Verified TLS connection" (Postfix) your DANE setup works properly. Here's a log example: Apr 8 19:52:31 mail postfix/smtp[28741]: Verified TLS connection established to dane.sys4.de[2001:1578:400:111::3:1]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 3

DANE-enabled SMTP test destination?
by Kevin San Diego 08 Apr '15

08 Apr '15

Hi All, Does anyone know of an SMTP+DANE email reflector address where you can send test email to in order to validate proper SMTP client DANE behavior? No amount of creative Googling or the list archives seemed to surface an answer. Something akin to this, albeit for DANE: http://www.port25.com/support/authentication-center/email-verification/ Sincerely, Kevin San Diego

2 2