February 2016 - dane-users

education.lu
by Wolfgang Breyha 08 Apr '16

08 Apr '16

Hi! I'm testing the new exim 4.85 DANE support and it took only some days to get in trouble... One of our users tried to send mail to the domain education.lu. Their domain and MX hosts are DNSSEC enabled and have TLSA RRs. The DANE validator https://dane.sys4.de/smtp/education.lu says: "Unusable TLSA Records". Most likely because it is type 1 not allowed for DANE-SMTP? I've set hosts_try_dane = * in my SMTP transport. Exim refuses to talk to those hosts at all with "failure while setting up TLS session". Is this expected behavior in terms of DANE-SMTP? What's postfix doing in this case? Greetings, Wolfgang -- Wolfgang Breyha <wbreyha(a)gmx.net> | http://www.blafasel.at/ Vienna University Computer Center | Austria

8 29

Re: Small uptick in domains with long-term incorrect TLSA records
by Viktor Dukhovni 29 Feb '16

29 Feb '16

I am presently tracking 28 domains with wrong TLSA records that show no sign that they are likely to be fixed soon. Of these 19 are the same as last time: 1post.de 3nw.de allispdv.com.br auxio.org bebidaliberada.com.br bels.cz castleturing.net comseo.com.br f2h.at lastsip.com linlab.net nevodnet.com planissimo.fr prodnsbr.com.br simplesestudio.com.br solucoesglobais.com.br twsolutions.net.br www.co.tt zx.com the good news is that 5 of the previus 25 have been addressed, but on the other hand 9 new ones have been added: 101host.de barbarassecret.com conjur.com.br lojabrum.com.br netlig.com.br nonoserver.info reich-trade.ch stric.se ticketmt.com.br Don't let your own domains linger with incorrect TLSA RRs. The stats at present: ~11500 passed 29 failed On the DNS front, still waiting for isphuset.no to upgrade PowerDNS, and the mail.mil nameservers are still blocking TLSA record lookups. -- Viktor.

1 0

New tools in Postfix 3.1-20160207
by Viktor Dukhovni 17 Feb '16

17 Feb '16

It will soon (when 3.1 is released this month) be much easier to manage your certificates and TLSA records with Postfix: http://www.postfix.org/TLS_README.html#built-in http://www.postfix.org/postfix-tls.1.html This only supports DANE-EE(3) "3 1 1" TLSA records at present, but should simplify interaction with Let's Encrypt by generating the CSR for you, and separates creation of keys/certs from deployment, giving you the opportunity to update the TLSA records first, let the old records expire from secondary nameservers and caches and then deploy... -- Viktor.

2 1

postbank.de / dslbank.de
by Andreas Schulze 03 Feb '16

03 Feb '16

Hallo, postbank.de is known (to me) as broken somehow. Today I noticed delivery problems to dslbank.de That focused my attention again to that unsolved issue. $ posttls-finger dslbank.de posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.mailrelay1.bonn.postbank.de type=TLSA: Host not found, try again posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.mailrelay1.bonn.postbank.de type=TLSA: Host not found, try again posttls-finger: Failed to establish session to dslbank.de via mailrelay1.bonn.postbank.de: TLSA lookup error for mailrelay1.bonn.postbank.de:25 posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.mailrelay2.bonn.postbank.de type=TLSA: Host not found, try again posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.mailrelay2.bonn.postbank.de type=TLSA: Host not found, try again posttls-finger: Failed to establish session to dslbank.de via mailrelay2.bonn.postbank.de: TLSA lookup error for mailrelay2.bonn.postbank.de:25 $ postconf mail_version mail_version = 3.0.3 $ postconf smtp_tls_security_level smtp_tls_security_level = dane $ dig _25._tcp.mailrelay1.bonn.postbank.de tlsa ... ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20811 ;_25._tcp.mailrelay1.bonn.postbank.de. IN TLSA ... -> SERVFAIL is the problem here. $ which_resolver_do_i_use unbound-1.5.x @ localhost But I wonder why dane.sys4.de tell me "No TLSA records." In fact there is some magic @sys4 that understand, postbank.de do not publish TLSA records. postfix do not know this magic and leave messages undelivered in my queue :-/ OK, I will now add the next whitelist entry to smtp_tls_policy_maps but that's no generic solution. Any hints are appreciated. Thanks, Andreas -- A. Schulze DATEV eG

7 10

Small uptick in domains with long-term incorrect TLSA records
by Viktor Dukhovni 03 Feb '16

03 Feb '16

Quick numbers update: * Top 3 DANE domain MX host providers (in my survey, real numbers much higher). A significant jump in the transip numbers recently: 5077 udmedia.de 1281 mx.transip.email 921 mx.nederhost.net * Total DANE SMTP domains: 10780 * Total primary MX hosts: 1568 * Top 10 DANE TLDs: 3856 com 2162 de 1333 net 1100 nl 541 org 426 eu 175 info 139 be 126 at 114 ch I've also noticed a growing presence of MX hosts of the form "box.example.com" with Let's Encrypt certificates and correctly rotated "3 1 1" TLSA records. These seem to be "mail in a box" deployments, that seem to just work. Kudos to the "mail in a box" folks. And now to the subject of this message. Until quite recently, the number of domains with long-term erroneous incorrect records has been in the 10-15 range at any given time, out of a total of ~11,000 domains served by ~1600 MX hosts. In the last few weeks I see an uptick of domains whose TLSA records become wrong and stay that way after sloppy key rotation. A noticeable fraction (though not the majority) of the problem domains have recently deployed "Let's Encrypt" certificates, without taking their TLSA records into account. Please take care to handle key rotation correctly. In Postfix 3.1, which should be released soon (likely this month), there will with any luck be a new tool to help administrators manage keys, certificates, CSRs and TLSA records. I'll post pointers to documentation once this is available. In the mean time, please don't forget: https://dane.sys4.de/common_mistakes#3 https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 http://tools.ietf.org/html/rfc7671#section-5.2 I am now tracking 25 broken domains that show no sign that they are likely to be fixed soon: f2h.at allispdv.com.br bebidaliberada.com.br comseo.com.br imagemdigital.com.br mypst.com.br prodnsbr.com.br simplesestudio.com.br solucoesglobais.com.br twsolutions.net.br 4nettech.com lastsip.com nevodnet.com zx.com bels.cz 1post.de 3nw.de neuhaus-city.de tsimnet.eu planissimo.fr castleturing.net linlab.net auxio.org konundrum.org www.co.tt If anyone on this list either operates one of these, or knows the administrators, please help to get these resolved. There are 11 more broken domains that are less than a week old, I am hoping some of those will be repaired in the near term, but a few may join the chronically-ill list. If anyone on this list is in Brazil, perhaps there's a language barrier that's making it more difficult for .br sites to know what to do, or respond to notices of problems. It would be great if there a were a .br version of dane.sys4.de with "common_mistakes" in Portuguese. -- Viktor.

1 1