September 2017 - dane-users

Update on stats
by Viktor Dukhovni 13 Nov '17

13 Nov '17

As of today I count 137620 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are: 60764 domeneshop.no 43961 transip.nl 15734 udmedia.de 3040 bhosted.nl 1493 nederhost.net 904 ec-elements.com 431 core-networks.de 307 uvt.nl 301 bit.nl 287 omc-mail.com The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, in particular .de, .nl and .no. There are 2449 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2613) of distinct MX host server certificates that support the same ~137000 domains. A related number is 4172 TLSA RRsets found for MX host TCP port 25. This includes secondary MX hosts and domains none of whose primary MX hosts have TLSA records. The number of domains that at some point were listed in Gmail's email transparency report is now 105 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 56 are in recent reports (March 2017): gmx.at jpberlin.de overheid.nl nic.br lrz.de pathe.nl registro.br mail.de wooniezie.nl gmx.ch posteo.de xs4all.nl open.ch ruhr-uni-bochum.de domeneshop.no anubisnetworks.com tum.de webcruitermail.no gmx.com uni-erlangen.de debian.org mail.com unitymedia.de domainmail.org piratenexus.com web.de freebsd.org pirateperfection.com enron.email gentoo.org pre-sustainability.com octopuce.fr ietf.org t-2.com comcast.net netbsd.org trashmail.com dd24.net netcoolusers.org xfinity.com gmx.net openssl.org bayern.de hr-manager.net samba.org bund.de t-2.net torproject.org elster.de xs4all.net minmyndighetspost.se fau.de asp4all.nl skatteverket.se gmx.de ouderportaal.nl A different metric is how many of the DANE-enabled domains received email from at least 10 Gmail senders in a recent 8 day interval. Back in Dec/2016 I reported that ~2200 out of ~105k domains met that criterion. This month, the number was ~3900 out of ~137k domains. So it seems that a non-negligible fraction of the increase is from real domains that receive email, and not just parked domains. Of the ~137000 domains, 655 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 96 (~30 are recent additions that may be resolved soon, the remaining ~60 are the for now stable population of broken domains). This month I'm posting the list of the 44 underlying MX hosts that serve these domains and whose TLSA records don't match reality. Hall of Shame: mail.dipietro.id.au www.mtg.de mail.inu.nl clubeararaquarense.org.br mx1.spamsponge.de mail.jekuiken.nl mail.antiphishing.ch mail.nonoserver.info mail.myzt.nl mail.digitalwebpros.com mx.datenknoten.me bounder.steelyard.nl mail.dnsmadefree.com mx.giesen.me mx.wm.net.nz demo.liveconfig.com mail.castleturing.net baobrien.org ny-do.pieterpottie.com datawebb.dafcorp.net smtp.copi.org diablo.sgt.com anubis.delphij.net eumembers.datacentrix.org tusk.sgt.com dorothy.goldenhairdafo.net smtp2.amadigi.ovh mx.bels.cz hs.kuzenkov.net webmail.headsite.se johniez.cz oostergo.net protector.rajmax.si mail.pksvice.cz ren.warunek.net arch-server.hlfh.space srv01.101host.de mail.e-rave.nl mail.blackcherry-management.co.uk mail.cdbm.de mail.hhsk.nl email.themcintyres.us mail.manima.de box.inpoint-mailt.nl The number of domains with bad DNSSEC support is 322. The top 10 DNS providers (by broken domain count) are: 52 axc.nl - Slated to be resolved 38 infracom.nl - Slated to be resolved 18 loopia.se 18 active24.cz 14 jsr-it.nl 12 rdw.nl 9 cas-com.net 8 metaregistrar.nl 6 tiscomhosting.nl 6 thednscompany.com Around 60 of the broken domains have at least one working nameserver, and so are email-reachable, given enough retries. -- Viktor.

1 1

New DANE TLSA monitoring/diagnostic utility
by Viktor Dukhovni 17 Sep '17

17 Sep '17

I am pleased to offer to the DANE user community a new monitoring and diagnostic utility. This is a one-shot variant of my survey code specialized for monitoring cron jobs and troubleshooting. Code and instructions at https://github.com/vdukhovni/danecheck While Haskell may be an unfamiliar programming development toolchain for many of you, I hope that it will not be difficult to install it for the purpose of compiling an existing project. See the README.md for build instructions. Enjoy. -- Viktor.

1 0

Ironic interaction of greylistiing, backup MX hosts and DANE
by Viktor Dukhovni 02 Sep '17

02 Sep '17

[ Also sent to the postfix-users(a)postfix.org list. ] I sent a "please fix your TLSA records" notice to "postmaster" and "info" at a domain whose primary MX host certificate fails to match its TLSA records: postfix/pickup[62805]: 7672C1DD39: ... postfix/cleanup[63835]: 7672C1DD39: message-id=<...> postfix/qmgr[844]: 7672C1DD39: from=<...>, size=8815, nrcpt=2 (queue active) postfix/smtp[63837]: 7672C1DD39: host mail.example.nl[192.0.2.1] said: 450 4.2.0 ... Greylisted, ... postfix/smtp[63837]: 7672C1DD39: to=<postmaster(a)example.nl>, relay=mail.example.nl[192.0.2.1]:25, delay=3.7, delays=0.03/0.01/1.5/2.2, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 119F07F861) postfix/smtp[63837]: 7672C1DD39: to=<info(a)example.nl>, relay=vps.example.nl[192.0.2.2]:25, delay=5.7, delays=0.03/0.01/5/0.61, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 2FBDC2064A) The "postmaster" account copy was accepted by the primary MX, but the "info" address was greylisted: *only* by the primary MX. However, the secondary MX accepts email *without* greylisting! This has the effect of delivering all mail via the secondary, with the primary never seeing any retries that cause greylisting to pass. What happened next was interesting and ironic. I got a "delay" notification from the secondary: Your message could not be delivered for more than 3 hour(s). It will be retried until it is 5 day(s) old. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <info(a)example.nl>: Server certificate not trusted The secondary is configured to verify DANE TLSA when relaying mail to the primary, so the problem report to "info", and indeed pretty much all mail to the system in question is queueing on the secondary MX host, waiting for the primary MX TLSA records to be fixed! Only "postmaster" email gets through to its destination (if the sending system does not validate TLSA records, which is naturally the case for my outbound "please fix your TLSA records" notices). The main lesson here is not implement Greylisting on only a subset of your MX hosts. Don't do that! 1. When greylisting, make sure that all MX hosts with equal or worse (higher) MX preference also greylist. 2. It is harmless (though less effective) to greylist only on (all) backup MX hosts, and skip greylisting on the primary. It is not a good idea to greylist on the primary, and not on the backups. 3. Monitor your DANE TLSA records, in such a way that notices of problems get through even when the TLSA records are stale. 4. Handle certificate rotation correctly. https://dane.sys4.de/common_mistakes#3 http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certifi… With "3 1 1" + "2 1 1" TLSA records, the rollover process can be substantially simplified: https://www.ietf.org/mail-archive/web/uta/current/msg01498.html Happy greylisting and TLSA record publishing to you all... -- Viktor.

1 0