October 2018 - dane-users

Overview of outbound DANE for SMTP support
by Knubben, B.S.J. (Bart) - Forum Standaardisatie 26 May '21

26 May '21

Hi, We made the following overview of products/services with outbound DANE support (i.e. DANE verification). Any remarks/additions are welcome. I. Supported: - Postfix (since version 2.11.0, January 2014): http://www.postfix.org/TLS_README.html#client_tls_dane - Halon (since version 3.4-r2, November 2015): https://halon.io/dane and https://wiki.halon.io/DANE - OpenSSL (since version 1.1.0, August 2016): https://www.openssl.org/docs/manmaster/man3/SSL_CTX_dane_enable.html and https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html - Cloudmark (since version 5.2, March 2017): https://blog.cloudmark.com/2017/03/27/dane-and-email-security/ - Exim (since version 4.91, April 2018): https://www.exim.org/exim-html-current/doc/html/spec_html/ch-encrypted_smtp… - Mail-in-a-Box (uses Postfix): https://github.com/mail-in-a-box/mailinabox/blob/master/security.md - ldns (uses OpenSSL): https://www.nlnetlabs.nl/documentation/ldns/dane_8h.html II. Requested: - Cisco: Bug ID: CSCuo87918 - [ Feature Request] TLS DANE Support for Email Security Appliance, https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuo87918/ - MS O365: https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/… and https://office365.uservoice.com/forums/289138-office-365-security-complianc… - Fortinet: https://fortinet.uservoice.com/forums/23797-fortipartner-feature-requests/s… - Protonmail: https://protonmail.uservoice.com/forums/284483-feedback/suggestions/3433882… and https://protonmail.uservoice.com/forums/284483-feedback/suggestions/1659360… BTW a simple outbound DANE test can be found on https://havedane.net. -- Best regards, Bart Knubben Dutch Standardisation Forum https://www.forumstandaardisatie.nl/content/english Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

5 6

Update on stats 2018-10
by Viktor Dukhovni 31 Oct '18

31 Oct '18

Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .LI, .NAME, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. Summary: The DANE domain count is now 336,682 The number of domains with DNSSEC MX records is 9,015,211. Thus DANE TLSA is deployed on 3.73% of domains with DNSSEC. As of today I count 336,682 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 115370 transip.nl 96024 domeneshop.no 34882 active24.com 23683 udmedia.de 10797 bhosted.nl 10599 wido.info 5664 previder.nl 3665 interconnect.nl 2531 provalue.nl 2443 nederhost.nl 1505 yourdomainprovider.net 1290 xcellerate.nl 1210 hi7.de 1075 surfmailfilter.nl 998 soverin.net 765 omc-mail.com 688 sciver.net 647 core-networks.de 612 mailbox.org 537 secure-gw.de The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 12 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented): 5323 TOTAL 1789 DE, Germany 984 NL, Netherlands 957 US, United States 382 FR, France 172 GB, United Kingdom 172 CZ, Czech Republic 107 CA, Canada 86 CH, Switzerland 65 SE, Sweden 56 SG, Singapore 54 BR, Brazil 47 NO, Norway IPv6 is still comparatively rare for MX hosts, and the top 10 countries by DANE MX host IPv6 GeoIP are (same top 6). 2633 TOTAL 1042 DE, Germany 441 US, United States 441 NL, Netherlands 218 FR, France 103 CZ, Czech Republic 80 GB, United Kingdom 44 NO, Norway 42 SE, Sweden 31 SG, Singapore 28 CH, Switzerland 21 AT, Austria 19 FI, Finland There are 3669 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 5242. These cover 5628 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 176 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 95 are in recent (last 90 days of) reports: gmx.at lrz.de intermax.nl transip.be mail.de markteffectmail.nl nic.br posteo.de ouderportaal.nl registro.br ruhr-uni-bochum.de overheid.nl gmx.ch tum.de pathe.nl open.ch uni-erlangen.de politie.nl anubisnetworks.com unitybox.de rotterdam.nl gmx.com unitymedia.de transip.nl habr.com web.de truetickets.nl mail.com egmontpublishing.dk uvt.nl mylocalbuddy.com netic.dk xs4all.nl societe.com tilburguniversity.edu domeneshop.no solvinity.com octopuce.fr handelsbanken.no t-2.com comcast.net webcruitermail.no trashmail.com dd24.net aegee.org xfinity.com gmx.net debian.org xfinityhomesecurity.com habramail.net freebsd.org xfinitymobile.com hr-manager.net gentoo.org active24.cz inexio.net ietf.org cuni.cz mpssec.net isc.org destroystores.cz mylobu.net lazarus-ide.org klubpevnehozdravi.cz t-2.net netbsd.org optimail.cz transip.net openssl.org smtp.cz xs4all.net samba.org bayern.de xworks.net torproject.org bund.de ardanta.nl asf.com.pt elster.de bhosted.nl handelsbanken.se fau.de boozyshop.nl minmyndighetspost.se freenet.de hierinloggen.nl skatteverket.se gmx.de hr.nl t-2.si jpberlin.de hro.nl govtrack.us kabelmail.de interconnect.nl Of the ~336000 domains, 1954 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 222. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes http://imrryr.org/~viktor/ICANN61-viktor.pdf http://imrryr.org/~viktor/icann61-viktor.mp3 http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 509. The top 10 name server operators with problem domains are: 50 dotserv.com 38 tiscomhosting.nl 38 metaregistrar.nl 34 sylconia.net 31 nrdns.nl 25 active24.cz (customer zones with broken wildcard cnames) 20 nazwa.pl (customer zones with broken wildcard NS RRs) 19 host-redirect.com 10 blauwblaatje.nl 10 army.mil If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. None of the domains all whose nameservers have broken denial of existence appear in historical Google reports. So it is likely that the DNSSEC denial of existence problems are not felt by most email senders. -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Reminder DNSSEC Root KSK roll today
by Viktor Dukhovni 11 Oct '18

11 Oct '18

In case you've not seen this many other places, just a friendly reminder that ICANN is rolling the DNSSEC root KSK today. Make sure your resolver (if it is validating) is ready. If you're forwarding queries to an upstream resolver, you might also check that the upstream is ready. -- Viktor.

1 1