November 2018 - dane-users

Overview of outbound DANE for SMTP support
by Knubben, B.S.J. (Bart) - Forum Standaardisatie 26 May '21

26 May '21

Hi, We made the following overview of products/services with outbound DANE support (i.e. DANE verification). Any remarks/additions are welcome. I. Supported: - Postfix (since version 2.11.0, January 2014): http://www.postfix.org/TLS_README.html#client_tls_dane - Halon (since version 3.4-r2, November 2015): https://halon.io/dane and https://wiki.halon.io/DANE - OpenSSL (since version 1.1.0, August 2016): https://www.openssl.org/docs/manmaster/man3/SSL_CTX_dane_enable.html and https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html - Cloudmark (since version 5.2, March 2017): https://blog.cloudmark.com/2017/03/27/dane-and-email-security/ - Exim (since version 4.91, April 2018): https://www.exim.org/exim-html-current/doc/html/spec_html/ch-encrypted_smtp… - Mail-in-a-Box (uses Postfix): https://github.com/mail-in-a-box/mailinabox/blob/master/security.md - ldns (uses OpenSSL): https://www.nlnetlabs.nl/documentation/ldns/dane_8h.html II. Requested: - Cisco: Bug ID: CSCuo87918 - [ Feature Request] TLS DANE Support for Email Security Appliance, https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuo87918/ - MS O365: https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/… and https://office365.uservoice.com/forums/289138-office-365-security-complianc… - Fortinet: https://fortinet.uservoice.com/forums/23797-fortipartner-feature-requests/s… - Protonmail: https://protonmail.uservoice.com/forums/284483-feedback/suggestions/3433882… and https://protonmail.uservoice.com/forums/284483-feedback/suggestions/1659360… BTW a simple outbound DANE test can be found on https://havedane.net. -- Best regards, Bart Knubben Dutch Standardisation Forum https://www.forumstandaardisatie.nl/content/english Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

5 6

DANE SMTP adoption milestone (one.com enables DANE SMTP for ~400k domains)
by Viktor Dukhovni 25 Nov '18

25 Nov '18

Perhaps old news to some/many of you who got the news earlier via Twitter: https://twitter.com/VDukhovni/status/1066050163356127232 but for anyone who missed it, yesterday saw an ~120% jump in the number/fraction of DNSSEC signed domains that have DANE TLSA records for their MX hosts: http://stats.dnssec-tools.org/#graphs As of today, ~739 thousand or ~8.4% out of the ~8.76 million domains covered in my DANE/DNSSEC survey have DANE TLSA records for all their MX primary hosts. Indeed all but ~1900 have DANE TLSA records for all their MX hosts, primary or otherwise. This is a result of DNSSEC and DANE TLSA deployment at one.com, where ~400k DNSSEC-signed customer domains that are MX-hosted by one.com now have MX hosts with signed TLSA records. Thanks and congratulations to one.com for helping to move DANE adoption to this new level. I hope that more providers will do likewise soon, and that DANE will before too long become the norm for DNSSEC-signed domains. -- Viktor. -- Viktor.

1 0

automatically manage Certificates, TLSA, DKIM
by Stefan Helmert 21 Nov '18

21 Nov '18

Hello, currently I am working on a project enabling interleaved renew of certificates, updating TLSA and DKIM records and reload of services: main project - https://github.com/TheTesla/cryptdomainmgr pypi package - https://github.com/TheTesla/cryptdomainmgrpypi on pypi - https://pypi.org/project/cryptdomainmgr/ test vm - https://github.com/TheTesla/cdm-test-vm There are dependencies: interface to dns - https://github.com/TheTesla/dnsuptools pypi package - https://github.com/TheTesla/dnsuptoolspypi on pypi - https://pypi.org/project/dnsuptools/ dehydrated - https://github.com/lukas2511/dehydrated -> included in cryptdomainmgr logging (package) - https://github.com/TheTesla/simpleloggerplus on pypi - https://pypi.org/project/simpleloggerplus/ I also created a demo application using it: mailserver w. crm - https://github.com/TheTesla/ansible-tine (sorry, exchange autodiscover is not implemented yet) Feel free to clone, fork, test, use, watch, star and contribute on github Best regards Stefan Helmert

2 1