September 2020 - dane-users

Overview of outbound DANE for SMTP support
by Knubben, B.S.J. (Bart) - Forum Standaardisatie 26 May '21

26 May '21

Hi, We made the following overview of products/services with outbound DANE support (i.e. DANE verification). Any remarks/additions are welcome. I. Supported: - Postfix (since version 2.11.0, January 2014): http://www.postfix.org/TLS_README.html#client_tls_dane - Halon (since version 3.4-r2, November 2015): https://halon.io/dane and https://wiki.halon.io/DANE - OpenSSL (since version 1.1.0, August 2016): https://www.openssl.org/docs/manmaster/man3/SSL_CTX_dane_enable.html and https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html - Cloudmark (since version 5.2, March 2017): https://blog.cloudmark.com/2017/03/27/dane-and-email-security/ - Exim (since version 4.91, April 2018): https://www.exim.org/exim-html-current/doc/html/spec_html/ch-encrypted_smtp… - Mail-in-a-Box (uses Postfix): https://github.com/mail-in-a-box/mailinabox/blob/master/security.md - ldns (uses OpenSSL): https://www.nlnetlabs.nl/documentation/ldns/dane_8h.html II. Requested: - Cisco: Bug ID: CSCuo87918 - [ Feature Request] TLS DANE Support for Email Security Appliance, https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuo87918/ - MS O365: https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/… and https://office365.uservoice.com/forums/289138-office-365-security-complianc… - Fortinet: https://fortinet.uservoice.com/forums/23797-fortipartner-feature-requests/s… - Protonmail: https://protonmail.uservoice.com/forums/284483-feedback/suggestions/3433882… and https://protonmail.uservoice.com/forums/284483-feedback/suggestions/1659360… BTW a simple outbound DANE test can be found on https://havedane.net. -- Best regards, Bart Knubben Dutch Standardisation Forum https://www.forumstandaardisatie.nl/content/english Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

5 6

PLEASE NOTE: Upcoming changes in Let's Encrypt issuer certificates
by Viktor Dukhovni 06 Dec '20

06 Dec '20

Please note that the Let's Encrypt intermediate CA certificate "X3" will soon be phased out in favour of "R3" and "E1" which have new keys, and so any DANE TLSA "2 1 1" records matching "X3" will not match "R3" or "E1". https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html If you are using Let's Encrypt with DANE-TA(2) [issuer CA] TLSA records, any extant "2 1 1" records need to be augmented soon with additional records matching the new "R3" and "E1", in advance of these reissuing your certificates. Failure to act in time is likely to result in an outage once renewals switch to signing via "R3" or "E1". Links to the actual certificates can be found at: https://letsencrypt.org/certificates/ https://letsencrypt.org/certs/lets-encrypt-r3.pem https://letsencrypt.org/certs/lets-encrypt-e1.pem The "2 1 1" digests of "R3" and "E1" are (but don't take my word for it, re-compute these for yourself): ; $ tlsagen lets-encrypt-r3.pem smtp.example.org 2 1 1 ; _25._tcp.smtp.example.org. IN TLSA 2 1 1 8D02536C887482BC34FF54E41D2BA659BF85B341A0A20AFADB5813DCFBCF286D ; $ tlsagen lets-encrypt-e1.pem smtp.example.org 2 1 1 ; _25._tcp.smtp.example.org. IN TLSA 2 1 1 276FE8A8C4EC7611565BF9FCE6DCACE9BE320C1B5BEA27596B2204071ED04F10 The above were computed with the attached "tlsagen" script, but it is prudent to also check with tools from other sources, this email message could well have been a forgery (I hope your copy matches what I sent). -- Viktor.

1 2

Pilot phase for DNSSEC/DANE for DFN with dfnsec.de in August 2020
by Paul Menzel 25 Sep '20

25 Sep '20

Dear DANE users, I like to inform you, after several years of waiting, the Deutsche Forschungsnetz will finally offer a solution for using their mail support with DNSSEC/DANE [1]. For whatever reason, they do not want to fiddle/test with dfn.de, and, therefore, are going to introduce the new domain dfnsec.de first. The pilot phase is going to be from August 3rd to 31st, and they are introducing faulty entries on Tuesday and Thursday from 10:00 to 14:00. Kind regards, Paul [1]: https://www.mailsupport.dfn.de/dokumentation/komponenten/dns/dnssec/pilotph…

2 3

Re: PLEASE NOTE: Upcoming changes in Let's Encrypt issuer certificates
by Viktor Dukhovni 25 Sep '20

25 Sep '20

On Mon, Sep 21, 2020 at 03:50:32AM -0400, Viktor Dukhovni wrote: > Therefore the full list of DANE-TA(2) digests to publish (when relying > on these rather than "3 1 1" records) is: > > ; (These can be retired soon, but not just yet) > ; > ; letsencryptauthorityx3.pem > ; letsencryptauthorityx4.pem > ; > _25._tcp.smtp.example.org. IN TLSA 2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517616E8A18 > _25._tcp.smtp.example.org. IN TLSA 2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E02CF362B > > ; (May not be needed if your leaf cert is RSA, ECDSA certs > ; will I expect be soon signed with one of these). > ; > ; lets-encrypt-e1.pem > ; lets-encrypt-e2.pem > ; > _25._tcp.smtp.example.org. IN TLSA 2 1 1 276FE8A8C4EC7611565BF9FCE6DCACE9BE320C1B5BEA27596B2204071ED04F10 > _25._tcp.smtp.example.org. IN TLSA 2 1 1 BD936E72B212EF6F773102C6B77D38F94297322EFC25396BC3279422E0C89270 > > ; (May not be needed if your leaf cert is ECDSA, once > ; ECDSA certificate issuance cuts over to e1/e2). > ; > ; lets-encrypt-r3.pem > ; lets-encrypt-r4.pem It seems I failed to paste in the "r3/r4" hashes (which of course you should not take only from my messages, but check against a trusted source). That said, the missing hashes are: _25._tcp.smtp.example.com. IN TLSA 2 1 1 8D02536C887482BC34FF54E41D2BA659BF85B341A0A20AFADB5813DCFBCF286D _25._tcp.smtp.example.com. IN TLSA 2 1 1 E5545E211347241891C554A03934CDE9B749664A59D26D615FE58F77990F2D03 On Thu, Sep 24, 2020 at 11:48:23PM +0200, Björn Jacke wrote: > your follow up mail on this topic is a bit confusing because you quote > the two *upcoming* E1/E2 cert hashes but the 2 *current* X3/X4 and not > the also the *upcoming* R3/R4 hashes here. Thanks for noticing. In case you want all the values, here's the bit of PostgreSQL I use to count usage of these in DANE survey TLSA records, this finds the hashes for all the combinations of selector (Cert(0) and SPKI(1)) and hashed matching type (SHA2-256(1) and SHA2-512(2)): WITH le(n, issuer, s, m, ihash) as ( VALUES ( 1, 'X3', 1, 1, '\x60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517616E8A18' :: bytea), ( 1, 'X3', 1, 2, '\x774FAD8C9A6AFC2BDB44FABA8390D213AE592FB0D56C5DFAB152284E334D7CD6ABD05799236E7AA6266EDF81907C60404C57EE54C10A3A82FCC2A9146629B140' ), ( 1, 'X3', 0, 1, '\x731D3D9CFAA061487A1D71445A42F67DF0AFCA2A6C2D2F98FF7B3CE112B1F568' ), ( 1, 'X3', 0, 2, '\x5EC5B0783C6E667E0965DF772943A06326768DE0F75DC0BD2FE378F02CCCA7D56C987656174CBE158CC29ECD763F8BDA3454332CC7D47FB934691409C5FB8686' ), ( 2, 'X4', 1, 1, '\xB111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E02CF362B' ), ( 2, 'X4', 1, 2, '\xA0F5D1333BC90BCEA0B0B5F401160B6E7F28A1256BC5B5D65F04B06B0BB0C96270AA81D8E2726394D385BF3E9EE46EB4AB7548C782D5688CC16D0CDFFEFB8594' ), ( 2, 'X4', 0, 1, '\x5DE9152BED31FA0515DD1FC746133F1327562EF72A84CF2D2403E748A604D0D4' ), ( 2, 'X4', 0, 2, '\x74DDAD9F8CDFA0FE6F6B70301B557A63A58B87FC2C17FAE0F65E47D141226C062A74FA14861DC47A720BD8699B99091A06BD695CDDE51222F837B9DECFC270C5' ), ( 3, 'R3', 1, 1, '\x8D02536C887482BC34FF54E41D2BA659BF85B341A0A20AFADB5813DCFBCF286D' ), ( 3, 'R3', 1, 2, '\x0F644C9A1DCB8C04BE6B385A60DBE4FDF7E2B81E335C9AD8C7CD0ABE2FF9E7E5BBFBB68B38DD0216F17808F48BDF6AF8C6347659C1F41A9858032C31F436D12C' ), ( 3, 'R3', 0, 1, '\x67ADD1166B020AE61B8F5FC96813C04C2AA589960796865572A3C7E737613DFD' ), ( 3, 'R3', 0, 2, '\x96C5793B2B57D8DF5891C94015720960E0DA4C2CF8CE1FC5707A0B46E5DB8CE3761FB5FDB430F619D1579F13E80FBDD973EF6A024129ED039AA193273158FCAD' ), ( 4, 'R4', 1, 1, '\xE5545E211347241891C554A03934CDE9B749664A59D26D615FE58F77990F2D03' ), ( 4, 'R4', 1, 2, '\x59A91D97D81980951D0EF3C6D849B31606AF9AB2B0F7DCFAC93A53AE3263EB8902C3B7C564F33FF496F2D07C750B1B6924968C243882AF9E3532797EEF596F27' ), ( 4, 'R4', 0, 1, '\x1A07529A8B3F01D231DFAD2ABDF71899200BB65CD7E03C59FA82272533355B74' ), ( 4, 'R4', 0, 2, '\x0F0B4DD77EE99D8ED5724DA618B56017D08B757884796D087BF656E62D2717B5C913CB1E2EDA07AACBFDBFDCB1BA5BA52114D54C000E05B0CB755256A61C0C37' ), ( 5, 'E1', 1, 1, '\x276FE8A8C4EC7611565BF9FCE6DCACE9BE320C1B5BEA27596B2204071ED04F10' ), ( 5, 'E1', 1, 2, '\x3561540FBF182BCE7749ACC131B421E691F083569C053E78F20274714C5E801226FF6EDB60641DDF70E71BD3A90DFE25DDD6464BE78106B77DECE4F6A3BFF13D' ), ( 5, 'E1', 0, 1, '\x46494E30379059DF18BE52124305E606FC59070E5B21076CE113954B60517CDA' ), ( 5, 'E1', 0, 2, '\x0FC8BDB5B93D95BB016BB543BD74B859E4C18930964D59CFC305B93EF3212C0C20F3084BA98FBF7AAC55D0D22C5B35566ED75BEBE6D5A7C53CA1F949C45C3C8E' ), ( 6, 'E2', 1, 1, '\xBD936E72B212EF6F773102C6B77D38F94297322EFC25396BC3279422E0C89270' ), ( 6, 'E2', 1, 2, '\x23A30BD3B617652E97224E1FAF673C4E09F1C197E4994274E676F2490893E9560D99F00A8859E399B2C65219CE2EB9B76784A0EC775AB4973A14FC1437AC7D9F' ), ( 6, 'E2', 0, 1, '\xBACDE0463053CE1D62F8BE74370BBAE79D4FCAF19FC07643AEF195E6A59BD578' ), ( 6, 'E2', 0, 2, '\xE8EC8405AB45605AE6E4A54EFD6D626F663CB7E61A10D9A6A6A08B118E0D35763D0118E263A6DB64516CA9F4E7F64FCD2B5DBF9E7A7BA265870606AF26F4D855' ) ) select count(distinct t.qname) as "#", le.issuer as "CA" from le join tlsa t on t.usage = 2 and t.selector = le.s and t.mtype = le.m and t.data = le.ihash join tlsabase b on b.tbase = t.qname join mx m on m.exch = b.qname group by le.n, le.issuer order by le.n; Updates to add the new hashes are happening more slowly than I'd hoped: # | CA -----+---- 978 | X3 32 | X4 15 | R3 9 | R4 15 | E1 10 | E2 If you're relying on "2 1 1" (or other Let's Encrypt DANE-TA(2)) TLSA records, please make the necessary changes promptly. -- Viktor.

1 0

check_dane and dnspython 2.0.0
by Stephan Seitz 24 Sep '20

24 Sep '20

Hello! I’m using check_dane (https://github.com/debfx/check_dane) together with Debian/testing. Since the upgrade of python3-dnspython to version 2.0.0, I’m getting deprecation warnings: check_dane:105: DeprecationWarning: please use dns.resolver.Resolver.resolve() instead tlsa_records = resolver.query(tlsa_domain, dns.rdatatype.TLSA) I’m afraid I was unable to fix the warning but I don’t realy speak python. So is anyone working on an upgrade? Shade and sweet water! Stephan -- | If your life was a horse, you'd have to shoot it. |

3 3

DANE for Sendmail
by Dennis Baaten 02 Sep '20

02 Sep '20

Initial support for DANE validation has landed in Sendmail: ftp://ftp.sendmail.org/pub/sendmail (or mirror https://ftp.bit.nl/mirror/sendmail/RELEASE_NOTES <https://t.co/fWpwDncaRt?amp=1>). "Only TLSA RR 3-1-x is currently implemented." For other DANE supporting software & services check: https://github.com/baknu/DANE-for-SMTP/wiki/3.-Software-and-service-support Regards, Dennis on behalf of Internet.nl

1 0