November 2023 - dane-users

Best to not outright refuse non-TLS incoming mail...
by Viktor Dukhovni 12 Oct '24

12 Oct '24

The DANE survey (https://stat.dnssec-tools.org) turns up a few domains a day that botch their cert rollovers or fail to offer STARTTLS despite publishing DANE TLSA records. I try to send notices to the relevant contacts, but sometimes they shoot themselves in the foot: - Private WHOIS - No contact data at the website - Published contacts don't work (no such user, ...). - Reject earnest notices of technical problems as spam Yesterday, for the first time, I ran into someone whose MTA stopped offering STARTTLS, despite the TLSA records still being in place, but attempts to deliver a notice are rejected: posttls-finger: < 220-mail.<censored>.dk ESMTP Postcow ... brief pause... posttls-finger: < 220 mail.<censored>.dk ESMTP Postcow posttls-finger: > EHLO <...> posttls-finger: < 250-mail.<censored>.dk posttls-finger: < 250-PIPELINING posttls-finger: < 250-SIZE 104857600 posttls-finger: < 250-ETRN posttls-finger: < 250-AUTH PLAIN LOGIN CRAM-MD5 posttls-finger: < 250-AUTH=PLAIN LOGIN CRAM-MD5 posttls-finger: < 250-ENHANCEDSTATUSCODES posttls-finger: < 250-8BITMIME posttls-finger: < 250-DSN posttls-finger: < 250 CHUNKING posttls-finger: > QUIT posttls-finger: < 221 2.0.0 Bye The notice bounced with: 550 5.7.1 Session encryption is required (in reply to RCPT TO command) As commendable as it may be to encourage use of TLS, it is not a good practice to outright refuse cleartext mail. -- Viktor.

4 3

DANE monitoring building block: "danesmtp" shell function
by Viktor Dukhovni 05 Sep '24

05 Sep '24

As you're may be aware, I actively promote adoption of DANE SMTP, many thanks to everyone who's moved forward with DANE SMTP deployment! That said, I also always stress that, when deploying DANE SMTP, *monitoring* must come first, and publishing of DANE TLSA records second. If your DANE TLSA deployment is unmonitored, it will some day fail, with you being the last to know that something is wrong when some email fails to arrive on time or at all. Unmonitored security is a ticking time-bomb. Please implement monitoring of your DANE TLSA records vs. the live certificate chain through regular probing of your MX hosts (I'd suggest hourly if not more often for more critical servers). Of course you also need to have good automation of the certificate rollover process so that normally TLSA records aren't out sync with the certificates even during a rollover. If you don't yet have monitoring in place, the below could be a useful building block for your monitoring scripts. The "danesmtp" shell (bash) function can take an optional explicit IP address to connect to, so you can test each of the IP addresses of a host in turn: danesmtp () { local OPTIND=1 opt local -a rrs sslopts local rr i=0 host addr while getopts a: opt; do case $opt in a) addr=$OPTARG case $addr in *:*) addr="[$addr]";; esac;; *) printf 'usage: danesmtp [-a addr] host [ssloption ...]\n' return 1;; esac done shift $((OPTIND - 1)) host=$1 shift if [[ -z "$addr" ]]; then addr="$host" fi sslopts=(-starttls smtp -connect "$addr:25" -verify 9 -verify_return_error -dane_ee_no_namechecks -dane_tlsa_domain "$host") rrs=( $(dig +short +nosplit -t tlsa "_25._tcp.$host" | grep -Ei '^[23] [01] [012] [0-9a-f]+$') ) while (( i < ${#rrs[@]} - 3 )); do rr=${rrs[@]:$i:4} i=$((i+4)) sslopts=("${sslopts[@]}" "-dane_tlsa_rrdata" "$rr") done ( sleep 1; printf "QUIT\r\n" ) | openssl s_client -brief "${sslopts[@]}" "$@" } -- Viktor.

4 7

TAKE NOTE: "2 1 1" TLSA records vs. apparent change of Let's Encrypt default certificate chain
by Viktor Dukhovni 10 Jun '24

10 Jun '24

The DANE/DNSSEC survey (<https://stats.dnssec-tools.org>) has seen a recent spike in the number of MX hosts whose "2 1 1" TLSA records no longer match their certificate chain. The records in question all shar the same digest value, for various TLSA base domains: _25._tcp.mx1.example. IN TLSA 2 1 1 0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3 I was initially puzzled as to why this might be happening, but then it occurred to me that the reason why is clear. The above hash is the hash of the ISRG X1 root CA key, but it is also of course the key hash of its outdated **cross-certificate** issued by DST. That DST cross cert was needed for compatability with some old Android systems that did not get root CA updates (or updates of any kind). It must be that Let's Encrypt finally stopped by default including that cross certificate in their chains. So instead of a chain that looks like: - depth 0: EE (server) certificate - depth 1: Let's Encrypt R3/E1 issuer CA - depth 2: ISRG X1 cross cert issued by DT with the certificate at depth 2 matching the TLSA record, they now generate just: - depth 0: EE (server) certificate - depth 1: Let's Encrypt R3/E1 issuer CA with the ISRG (now standalone) root CA not included in the chain! Leaving out the root CA works fine for WebPKI, where clients need to have a locally trusted copy of the root, but not for certificate usage DANE-TA(2), which does not rely on any local CA store: https://dane.sys4.de/common_mistakes#4 https://datatracker.ietf.org/doc/html/rfc7672#section-3.1.2 Bottom line, if you're relying on that "2 1 1" record matching the ISRG root to match your Let's Encrypt chain, you're about to be disappointed, if you aren't already. See: http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html for better alternatives, or switch to "3 1 1", perhaps with the aid of "danebot" (still hoping some early adopters will pitch in to further improve it, to support some additional workflows): <https://github.com/tlsaware/danebot> -- Viktor.

2 6

Update on stats 2023-10
by Viktor Dukhovni 01 Nov '23

01 Nov '23

Summary: The DANE domain count is now 3,949,527 (3,923,543 last month). The number of domains that return DNSSEC-validated replies in response to MX queries is 23,173,417 (up slightly from 23,180,180 last month). Thus DANE TLSA is deployed on ~17.04% of domains with DNSSEC. For more stats, see <https://stats.dnssec-tools.org/>. [ See the Credits[0] list below my signature. ] As of today, I count ~3.95 million domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. This month Last Month ---------- ---------- 1314953 one.com 1322240 one.com 303663 hostpoint.ch 302353 hostpoint.ch 212629 infomaniak.ch 209052 infomaniak.ch 172311 transip.nl 171630 transip.nl 169592 mijndomein.nl 168815 mijndomein.nl 161972 jouwweb.nl 156229 jouwweb.nl 139685 argewebhosting.nl 141433 argewebhosting.nl 131004 simply.com 129838 simply.com 111235 hostnet.nl 111275 hostnet.nl 109839 domeneshop.no 109926 domeneshop.no 106090 loopia.se 105948 loopia.se 90348 webhostingserver.nl 91048 webhostingserver.nl 83074 forpsi.com 83031 forpsi.com 81323 zxcs.nl 81293 zxcs.nl 44928 protonmail.ch 44103 protonmail.ch 40974 antagonist.nl 40754 antagonist.nl 39102 active24.com 39341 active24.com 36892 webreus.nl 37235 webreus.nl 29674 pcextreme.nl 30037 pcextreme.nl 28404 xel.nl 28501 xel.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl, .de and .uk. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). This month Last month ----------- ---------- 11663 TOTAL 11403 TOTAL 3687 DE, Germany 3586 DE, Germany 1932 NL, Netherlands 1887 NL, Netherlands 1888 US, United States 1885 US, United States 883 FR, France 864 FR, France 458 CZ, Czechia 452 CZ, Czechia 364 GB, United Kingdom 360 GB, United Kingdom 267 FI, Finland 264 FI, Finland 213 CA, Canada 203 CA, Canada 176 AT, Austria 179 AT, Austria 171 CH, Switzerland 165 SE, Sweden 161 SE, Sweden 148 CH, Switzerland 147 DK, Denmark 146 DK, Denmark 141 AU, Australia 144 AU, Australia 123 SG, Singapore 125 SG, Singapore 107 RU, Russia 90 PL, Poland 88 PL, Poland 85 RU, Russia 64 JP, Japan 65 JP, Japan 60 NO, Norway 55 BR, Brazil 51 BR, Brazil 52 NO, Norway 47 IT, Italy 42 IT, Italy IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: This month Last month ---------- ---------- 9445 TOTAL 9295 TOTAL 4224 NL, Netherlands 4201 NL, Netherlands 2659 DE, Germany 2602 DE, Germany 881 US, United States 866 US, United States 389 FR, France 375 FR, France 189 CZ, Czechia 178 GB, United Kingdom 177 GB, United Kingdom 178 CZ, Czechia 110 FI, Finland 110 FI, Finland 87 CA, Canada 82 CA, Canada 81 SE, Sweden 80 SE, Sweden 72 AU, Australia 72 AU, Australia 68 CH, Switzerland 65 CH, Switzerland 49 SG, Singapore 50 SG, Singapore 47 AT, Austria 49 AT, Austria 43 RU, Russia 41 JP, Japan 39 JP, Japan 30 RU, Russia 30 BR, Brazil 28 RO, Romania 28 RO, Romania 27 NO, Norway 26 NO, Norway 26 BR, Brazil 23 DK, Denmark 24 DK, Denmark 18 LT, Lithuania 18 IE, Ireland There are 9,773 unique zones (9,391 last month) in which the underlying MX hosts are found. This counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 20,781 (20,808 last month). These cover 21,077 distinct MX hosts (21,102 last month, some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 1,090 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 569 are in recent (last 90 days of) reports (see [2] below my signature). Of the ~3.95 million DANE domains, 14,236 (14,262 last month) have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to offer STARTTLS (even though TLSA records are published) stands today at 1,873 (2,180 last month). Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. The affected domain counts for the top 10 problem MX hosts are: 177 mx2.tkservers.com 132 mx2.dotxs.net 44 mx.neutraldomains.net 41 svr3.it-df.net 35 mx1.mdbraber.com 23 smtp2.kruik-it.nl 22 mail.mxx.dk 20 fsn1-c04.xemo-net.de 19 web2.sys.ccs-baumann.de 15 mx1.zeromeaning.com To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources https://datatracker.ietf.org/doc/html/rfc7671#section-8.1 https://datatracker.ietf.org/doc/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 901 (1,057 last month). The top 10 name server operators with problem domains are: This Month Last month ---------- ---------- 665 neostrada.nl 715 neostrada.nl 62 worldnic.com 70 worldnic.com 24 openprovider.nl 60 ebola.cz 14 sectigoweb.com 32 openprovider.nl 13 register.com 14 sectigoweb.com 9 dnssrv.nl 13 register.com 8 ispapi.net 10 dnssrv.nl 7 vultr.com 8 ispapi.net 6 resolver.domains 7 vultr.com 6 forpsi.net 7 cloudns.net If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Just one of the domains whose nameservers have broken denial of existence appears in the last 120 days of Google transparency reports: mailazy.net -- Viktor. [0] Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FI, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security. [2] DANE domains appearing in last 90 days of Google Email transparency reports: univie.ac.at tum.de hostingpeople.nl gmx.at tutanota.de hostnet.nl vbv.at uni-augsburg.de hr.nl boozyshop.be uni-bielefeld.de hro.nl eos-contentia.be uni-erlangen.de huurexpert.nl triodos.be uni-muenchen.de ikdeburger.nl vanbreda.be vicinityclo.de inspirerendleven.nl nra.bg web.de interconnect.nl cetelemnegocie.com.br westlotto.de interim-netwerk.nl dwvmail.com.br aeldresagen.dk ithodaalderop.nl e-negociacao.com.br allbuy.dk josephinajewelry.nl e-renegocie.com.br anna-hjorth.dk kiesrijk.nl zaaztelecom.com.br annebrauner.dk liveatamsterdamsebos.nl nic.br australian-bodycare.dk mailmore.nl registro.br avabeauty.dk mailon.nl activfitness-news.ch bambustoej.dk mailplus.nl blackout-bonusclub.ch barons.dk managementboek.nl gmx.ch bigsaver.dk markteffectmail.nl handy-abovergleich.ch bog.dk mcmta.nl hostpoint.ch camillakroeyer.dk mijndomein.nl infomaniak.ch casanova.dk minbzk.nl msochrono.ch champagneklubben.dk mindef.nl open.ch computerworld.dk mm1.nl protonmail.ch damask.dk nieuwsservice-rvo.nl sherlockhomes.ch danielspengetips.dk notbranded.nl sms-gagnant.ch danskebank.dk ns.nl switch.ch denmentalekriger.dk nuudcare.nl wog.ch densidsteflaske.dk nuwegexclusief.nl simplelogin.co dfi.dk opnaarwonderland.nl albourne.com dressforsuccess.dk ouderenfonds.nl anonaddy.com ens.dk ouderportaal.nl ansigtsyogaonline.com fibianet.dk overheid.nl canva-facile.com foraeldresparring.dk oxilionhosted.nl cm.com gastrotools.dk partijvoordedieren.nl collarofsweden.com globestudios.dk partnermail.nl connectsb.com hook-up.dk podiumcadeaukaart.nl danskebank.com hostedsepo.dk pp-prd.nl datev.com idelig.dk previder.nl denhaag.com iphoneopladere.dk prorun-mail.nl exegy.com kagegrisen.dk protislank.nl farmergracy.com kk.dk quicknet.nl fastware-hosting.com kodbilen.dk rdw.nl flaneurhomme.com konkurspriser.dk rijksoverheid.nl fromanteel-watches.com kystfisken.dk rvig.nl gmx.com labelking.dk rvo.nl goodforme.com lacabra.dk sans-mail.nl habr.com lederstof.dk schuurman-schoenen.nl headachecalendar.com mobilcovers.dk shampoobars.nl highcharts.com musclehouse.dk shapeit.nl infomaniak.com netic.dk shoesme.nl ingthink.com nfinitybeauty.dk sietskescholten.nl intakt.com nimara.dk sizzthebrand.nl itskaos.com nordd.dk smartwatchbanden.nl johnbeerens.com nota.dk sportrusten.nl joomlapolis.com opdagverden.dk ssonet.nl jula.com pengeogfrihed.dk stater.nl kabayarefashion.com perfectjeans.dk svb.nl kae-cosmetici.com sengefabrikken.dk technicus.nl kantarresearch.com seniornews.dk telefoonglaasje.nl kheaa.com shapeit.dk teslin.nl leszexpertsfle.com skjold-burne.dk thealphamen.nl librti.com smoon.dk toms.nl mail.com sneakerzone.dk transip.nl mailzerver.com stil.dk triodos.nl mixx.com stpt.dk truetickets.nl mplbeauty.com strongcurves.dk tudelft.nl nanolearning.com sygeforsikring.dk uitgeverijpica.nl nine-pine.com thenap.dk upcmail.nl novashops.com thesneakerstore.dk uvt.nl one.com trueliving.dk uwv.nl orsys.com venderbys.dk vacaturesonline.nl ottobredesign.com vin-huset.dk vandale.nl pieter-pot.com vind.dk vimexx.nl polyas.com yuaiahaircare.dk vluchtelingenwerk.nl pompomlondon.com tilburguniversity.edu vogeldagboek.nl protonmail.com maarahvapood.ee voor14.nl run-motion.com minuvalik.ee vunzigedeuntjes.nl sankakucomplex.com surveyturtle.ee watchbandjes-shop.nl scorecloud.com turunduslabor.ee waternet.nl serverclienti.com zone.ee wehkampfinance.nl sneakerjeans.com myownconference.email werkzoeken.nl solvinity.com spam-filter.email wonenmetlef.nl speciale-offre.com spotler.email ziggo.nl sportnotch.com nuudcare.es zorgmail.nl stasdock.com triodos.es zoweg-mail.nl stater.com egu.eu annabellstefanussen.no stellarequipment.com iaccept.eu babybanden.no tcs.com litebit.eu bergengokart.no the-vfl.com outletdelcalcio.eu bull-ski-kajakk.no theintercept.com zerolime.eu chillout.no thepcw.com zone.eu domeneshop.no thepcwholesale.com zonevs.eu dressmykid.no thesmmacademy.com danskebank.fi godvar.no thingsilikethingsilove.com handelsbanken.fi guttelus.no triodos.com metaburn.fi hyttefeber.no tutanota.com rockdenim.fi idrettenonline.no up2staff.com ac-strasbourg.fr lagerpriser.no veganallsorts.com braceletsmartwatch.fr marikrogshus.no vivaldi.com compagnie-des-sens.fr modostore.no webcruiter.com edtm-actu.fr mystuff.no win-rar.com nuudcare.fr nordicprint.no xfinity.com oo2.fr norskgrammatikk.no xfinityhomesecurity.com passefranceallemagne.fr raskebriller.no xfinitymobile.com privea.fr rushtrampoline.no bncr.fi.cr tid.gov.hk sillysanta.no airbank.cz fidesz.hu smaaungene.no akce-incomputer.cz italiamail.hu spillfabrikken.no amenit.cz bluebiz.info strikkia.no balikovna.cz eurocontrol.int suksessmednetthandel.no bewooden.cz infinex.io analysedanmark.nu cokoladovnajanek.cz nuudcare.it atelkamera.nu cpost.cz neolink.link goget.nu creammy.cz nic.lv hallbarhalsa.nu cro.cz anonaddy.me lenhud.nu csob.cz pm.me agirpourlenvironnement.org cuni.cz proton.me checkmyads.org dashofer.cz army.mil debian.org dedra.cz dla.mil freebsd.org e-kondomy.cz dma.mil fridaysforfuture.org ecps.cz health.mil gentoo.org fio.cz jten.mil ietf.org hobynaradi.cz mail.mil mailbox.org hypotecnibanka.cz navy.mil mailop.org innogy.cz nga.mil netbsd.org itesco.cz osd.mil openssl.org kb.cz socom.mil ozlabs.org klenotyaurum.cz uscg.mil postfix.org klubpevnehozdravi.cz usmc.mil samba.org ksporting.cz apnic.net torproject.org manymail.cz comcast.net biotechnologia.com.pl maxmax.cz ewetel.net mobily.com.sa mbank.cz ficbook.net arbetsformedlingen.se mfcr.cz fivem.net australian-bodycare.se mkluzkoviny.cz gmx.net bearplay.se mojedatovaschranka.cz habramail.net bearplayshop.se mrakyhracek.cz hr-manager.net bidflow.se muni.cz inexio.net bilprovningen.se nic.cz intares.net crtzoo.se nilia.cz mailanyone.net ecster.se nku.cz masterinter.net egensajt.se o2.cz mijngezondheid.net ellevio.se opravdovezlociny.cz mpssec.net epochtimes-mejl.se optimail.cz octopoos.net fashion-copenhagen.se outlet-alpine.cz procurios.net handelsbanken.se p-info.cz riseup.net hellomantle.se pivoteka.cz s-qrc.net jaramba.se poptavej.cz soverin.net klasspengar.se pre.cz speedkom.net koreanbeauty.se rozhlas.cz t-2.net kulturaktiebolaget.se scrptd.cz amsterdam.nl livlyclothing.se smtp.cz amsterdamwinefestival.nl lnu.se sparkys.cz aquastorexl.nl lomervarde.se stoklasa.cz bankhoesdiscounter.nl loopia.se thinline.cz belastingdienst.nl malarfabriken.se tiscali.cz beterinbeleggen.nl merchsweden.se vas-server.cz beterspellen.nl minmyndighetspost.se virusfree.cz bewustpuur.nl nordicprint.se vitalpoint.cz bhosted.nl nordicsheep.se vshosting.cz blushfashionstore.nl performcollection.se zafido.cz bobo.nl polisen.se zlocinozrouti.cz body-supplies.nl refitness.se zonky.cz bolerolimonadewinkel.nl sillysanta.se bayern.de boozyshop.nl silverdotter.se brandenburg.de box.nl skatteverket.se bund.de bruut.nl skolverket.se bundesregierung.de caracamilla.nl snbostader.se datev.de carre.nl soleplus.se datronic.de casema.nl teeshoppen.se dfn.de cbr.nl teknikdelar.se elster.de chello.nl theletter.se ewetel.de clubplanner.nl websupport.se fau.de csvjongholland.nl agatinsvet.sk freenet.de degros.nl fio.sk gmx.de derooijfotografie.nl lenivakucharka.sk hi7.de desan.nl mklozkoviny.sk huellen-shop.de dictu.nl nakupujzdravo.sk jpberlin.de digibtw.nl penzionmara.sk lmu.de digid.nl rondogo.sk lrz.de dimehouse.nl toptop.sk mail.de domain-registry.nl zapardrobnych.sk mensa.de dorcas.nl zeit-des-wandels.tv mindline-analytics.de duo.nl clientnews3.co.uk mpg.de eabstest.nl millieandblake.co.uk posteo.de efactuurdirect.nl nuudcare.co.uk ruhr-uni-bochum.de esuals.nl thewordman.co.uk smartwatcharmbaender.de extinctionrebellion.nl triodos.co.uk stwm.de ezorg.nl nuudcare.us sys4.de frfc1908.nl quantum-services.us taures.de hobbygigant.nl ru.ac.za tu-darmstadt.de home.nl

1 0