February 2024 - dane-users

Best to not outright refuse non-TLS incoming mail...
by Viktor Dukhovni 12 Oct '24

12 Oct '24

The DANE survey (https://stat.dnssec-tools.org) turns up a few domains a day that botch their cert rollovers or fail to offer STARTTLS despite publishing DANE TLSA records. I try to send notices to the relevant contacts, but sometimes they shoot themselves in the foot: - Private WHOIS - No contact data at the website - Published contacts don't work (no such user, ...). - Reject earnest notices of technical problems as spam Yesterday, for the first time, I ran into someone whose MTA stopped offering STARTTLS, despite the TLSA records still being in place, but attempts to deliver a notice are rejected: posttls-finger: < 220-mail.<censored>.dk ESMTP Postcow ... brief pause... posttls-finger: < 220 mail.<censored>.dk ESMTP Postcow posttls-finger: > EHLO <...> posttls-finger: < 250-mail.<censored>.dk posttls-finger: < 250-PIPELINING posttls-finger: < 250-SIZE 104857600 posttls-finger: < 250-ETRN posttls-finger: < 250-AUTH PLAIN LOGIN CRAM-MD5 posttls-finger: < 250-AUTH=PLAIN LOGIN CRAM-MD5 posttls-finger: < 250-ENHANCEDSTATUSCODES posttls-finger: < 250-8BITMIME posttls-finger: < 250-DSN posttls-finger: < 250 CHUNKING posttls-finger: > QUIT posttls-finger: < 221 2.0.0 Bye The notice bounced with: 550 5.7.1 Session encryption is required (in reply to RCPT TO command) As commendable as it may be to encourage use of TLS, it is not a good practice to outright refuse cleartext mail. -- Viktor.

4 3

DANE monitoring building block: "danesmtp" shell function
by Viktor Dukhovni 05 Sep '24

05 Sep '24

As you're may be aware, I actively promote adoption of DANE SMTP, many thanks to everyone who's moved forward with DANE SMTP deployment! That said, I also always stress that, when deploying DANE SMTP, *monitoring* must come first, and publishing of DANE TLSA records second. If your DANE TLSA deployment is unmonitored, it will some day fail, with you being the last to know that something is wrong when some email fails to arrive on time or at all. Unmonitored security is a ticking time-bomb. Please implement monitoring of your DANE TLSA records vs. the live certificate chain through regular probing of your MX hosts (I'd suggest hourly if not more often for more critical servers). Of course you also need to have good automation of the certificate rollover process so that normally TLSA records aren't out sync with the certificates even during a rollover. If you don't yet have monitoring in place, the below could be a useful building block for your monitoring scripts. The "danesmtp" shell (bash) function can take an optional explicit IP address to connect to, so you can test each of the IP addresses of a host in turn: danesmtp () { local OPTIND=1 opt local -a rrs sslopts local rr i=0 host addr while getopts a: opt; do case $opt in a) addr=$OPTARG case $addr in *:*) addr="[$addr]";; esac;; *) printf 'usage: danesmtp [-a addr] host [ssloption ...]\n' return 1;; esac done shift $((OPTIND - 1)) host=$1 shift if [[ -z "$addr" ]]; then addr="$host" fi sslopts=(-starttls smtp -connect "$addr:25" -verify 9 -verify_return_error -dane_ee_no_namechecks -dane_tlsa_domain "$host") rrs=( $(dig +short +nosplit -t tlsa "_25._tcp.$host" | grep -Ei '^[23] [01] [012] [0-9a-f]+$') ) while (( i < ${#rrs[@]} - 3 )); do rr=${rrs[@]:$i:4} i=$((i+4)) sslopts=("${sslopts[@]}" "-dane_tlsa_rrdata" "$rr") done ( sleep 1; printf "QUIT\r\n" ) | openssl s_client -brief "${sslopts[@]}" "$@" } -- Viktor.

4 7

TAKE NOTE: "2 1 1" TLSA records vs. apparent change of Let's Encrypt default certificate chain
by Viktor Dukhovni 10 Jun '24

10 Jun '24

The DANE/DNSSEC survey (<https://stats.dnssec-tools.org>) has seen a recent spike in the number of MX hosts whose "2 1 1" TLSA records no longer match their certificate chain. The records in question all shar the same digest value, for various TLSA base domains: _25._tcp.mx1.example. IN TLSA 2 1 1 0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3 I was initially puzzled as to why this might be happening, but then it occurred to me that the reason why is clear. The above hash is the hash of the ISRG X1 root CA key, but it is also of course the key hash of its outdated **cross-certificate** issued by DST. That DST cross cert was needed for compatability with some old Android systems that did not get root CA updates (or updates of any kind). It must be that Let's Encrypt finally stopped by default including that cross certificate in their chains. So instead of a chain that looks like: - depth 0: EE (server) certificate - depth 1: Let's Encrypt R3/E1 issuer CA - depth 2: ISRG X1 cross cert issued by DT with the certificate at depth 2 matching the TLSA record, they now generate just: - depth 0: EE (server) certificate - depth 1: Let's Encrypt R3/E1 issuer CA with the ISRG (now standalone) root CA not included in the chain! Leaving out the root CA works fine for WebPKI, where clients need to have a locally trusted copy of the root, but not for certificate usage DANE-TA(2), which does not rely on any local CA store: https://dane.sys4.de/common_mistakes#4 https://datatracker.ietf.org/doc/html/rfc7672#section-3.1.2 Bottom line, if you're relying on that "2 1 1" record matching the ISRG root to match your Let's Encrypt chain, you're about to be disappointed, if you aren't already. See: http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html for better alternatives, or switch to "3 1 1", perhaps with the aid of "danebot" (still hoping some early adopters will pitch in to further improve it, to support some additional workflows): <https://github.com/tlsaware/danebot> -- Viktor.

2 6

DANE: ATTENTION: Let's Encrypt drops DST X3 from default chain, breaking "depth 2" ISRG "2 1 1" TLSA records...
by Viktor Dukhovni 13 Feb '24

13 Feb '24

As of roughly the start of this month, the DANE survey at <https://stats.dnssec-tools.org> is seeing a steady stream of validation failures for MX hosts that rely only on: _25._tcp.mail.domain.example. IN TLSA 2 1 1 0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3 [ Some also list a no-longer valid "3 1 1" record that broke when the unerlying EE key was rotated, because they failed to ensure that certificate renewals do not automatically rotate the key. ] As promised by Let's Encrypt some months back, Let's Encrypt have dropped the expired DST X3 cross-certificate from the default generated "fullchain.pem" file, which now contains just the leaf (EE) certificate (depth 0) and the intermediate CA (depth 1) issuer (R3, R4, E1 or E2), the parent ISRG root CA is implicit and there's no longer a legacy cross certificate from DST for outdated Android devices. Domains whose MX hosts relied only on the "2 1 1" record for the ISRG root CA (present in the cross certificate, but absent from the new chain) are no longer passing DANE TLSA validity checks. My notices to these domains include the below advice: [ Perhaps consider: <https://github.com/tlsaware/danebot>? Your TLSA record designates a root CA key, but, as is common, the root CA certificate is not included in your certificate chain. It would need to be incuded to work with DANE-TA(2), but simpler to use an intermediate CA hash instead. See: https://github.com/Mailu/Mailu/issues/2138 http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html https://dane.sys4.de/common_mistakes#4 https://datatracker.ietf.org/doc/html/rfc7671#section-5.2.3 Important information about certificate issuance changes at Let's Encrypt discussed at the links below: https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/HESAY6… https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/GLRVY2… https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/X4SS2E… ] The issues can be resolved by removing or updating the associated DNS DANE TLSA records. - "3 0 [12]" vs. Let's Encrypt: https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… - Best practice "3 1 1" rollover methodology: https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html - Monitoring code snippet: https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/thread/NKDBQAB… -- Viktor.

1 0

Update on stats 2024-01 (>4 million DANE SMTP domains!)
by Viktor Dukhovni 01 Feb '24

01 Feb '24

Summary: The DANE domain count is now 4,022,036 (3,988,988 last month) The number of domains that return DNSSEC-validated replies in response to MX queries is 23,122,328 (23,098,096 last month). Thus DANE TLSA is deployed on ~17.39% of domains with DNSSEC. For more stats, see <https://stats.dnssec-tools.org/>. [ The credits[0] list is below my signature. ] Reminder: If you're relying on trust-anchor (usage DANE-TA(2)) TLSA records matching a Let's Encrypt issuing CA, please note important upcoming changes in Let's Encrypt certificate issuance: https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/HESAY6… https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/GLRVY2… https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/X4SS2E… As of today, I count ~4.02 million domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. This month Last Month ---------- ---------- 1305552 one.com 1306568 one.com 308177 hostpoint.ch 306621 hostpoint.ch 223679 infomaniak.ch 219246 infomaniak.ch 181030 jouwweb.nl 172777 transip.nl 173116 transip.nl 172069 jouwweb.nl 170668 mijndomein.nl 170317 mijndomein.nl 135204 argewebhosting.nl 137375 argewebhosting.nl 129324 simply.com 130652 simply.com 111973 hostnet.nl 111485 hostnet.nl 110214 domeneshop.no 109779 domeneshop.no 106668 loopia.se 106544 loopia.se 88592 webhostingserver.nl 89264 webhostingserver.nl 83114 zxcs.nl 82634 forpsi.com 82996 forpsi.com 81475 zxcs.nl 48550 protonmail.ch 47296 protonmail.ch 41346 antagonist.nl 41179 antagonist.nl 37932 active24.com 38161 active24.com 35799 webreus.nl 36259 webreus.nl 28089 pcextreme.nl 28643 pcextreme.nl 27964 xel.nl 28102 xel.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl, .de and .uk. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). This month Last month ----------- ---------- 12241 TOTAL 12019 TOTAL 3906 DE, Germany 3819 DE, Germany 1972 NL, The Netherlands 1948 NL, The Netherlands 1912 US, United States 1929 US, United States 871 FR, France 905 FR, France 486 CZ, Czechia 481 CZ, Czechia 414 GB, United Kingdom 380 GB, United Kingdom 290 FI, Finland 287 FI, Finland 245 CA, Canada 212 CA, Canada 221 CH, Switzerland 199 CH, Switzerland 193 AT, Austria 186 AT, Austria 166 SE, Sweden 176 SE, Sweden 156 DK, Denmark 160 DK, Denmark 152 AU, Australia 148 AU, Australia 121 SG, Singapore 117 SG, Singapore 121 PL, Poland 103 RU, Russia 103 RU, Russia 93 PL, Poland 66 NO, Norway 67 NO, Norway 57 JP, Japan 57 JP, Japan 56 BR, Brazil 49 IT, Italy 53 IT, Italy 49 BR, Brazil IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: This month Last month ---------- ---------- 9761 TOTAL 9592 TOTAL 4263 NL, The Netherlands 4210 NL, The Netherlands 2849 DE, Germany 2791 DE, Germany 905 US, United States 888 US, United States 417 FR, France 390 FR, France 210 CZ, Czechia 202 CZ, Czechia 180 GB, United Kingdom 185 GB, United Kingdom 109 FI, Finland 113 FI, Finland 87 CA, Canada 86 CA, Canada 80 CH, Switzerland 80 SE, Sweden 78 SE, Sweden 75 AU, Australia 75 AU, Australia 72 CH, Switzerland 52 AT, Austria 50 AT, Austria 46 SG, Singapore 44 SG, Singapore 36 JP, Japan 39 JP, Japan 32 RO, Romania 31 RU, Russia 30 BR, Brazil 31 NO, Norway 29 RU, Russia 29 RO, Romania 29 NO, Norway 29 BR, Brazil 28 DK, Denmark 26 DK, Denmark 18 LT, Lithuania 16 IE, Ireland There are 10,719 unique zones (10,449 last month) in which the underlying MX hosts are found. This counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 24,636 (21,169 last month). These cover 24,945 distinct MX hosts (21,466 last month, some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 1,199 (1,173 last month, this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 683 (674 last month) are in recent (last 90 days of) reports (see [2] below my signature). Of the ~4.02 million DANE domains, 14,204 (14,456 last month) have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to offer STARTTLS (even though TLSA records are published) stands today at 2,424 (1,862 last month). Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. The affected domain counts for the top 10 problem MX hosts are: 550 mx2.xcellerate.nl 172 mx2.tkservers.com 123 mx2.dotxs.net 106 mx.xobit.nl 35 mx1.mdbraber.com 26 mail.orionpanel.nl 23 semark.dk 22 smtp2.kruik-it.nl 15 mail.nationaalarchief.nl 15 artemis.strebsjig.net To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources https://datatracker.ietf.org/doc/html/rfc7671#section-8.1 https://datatracker.ietf.org/doc/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 697 (838 last month). The top 10 name server operators with problem domains are: This Month Last month ---------- ---------- 490 neostrada.nl 528 neostrada.nl 58 worldnic.com 60 worldnic.com 21 openprovider.nl 22 openprovider.nl 21 active24.cz 21 active24.cz 14 sectigoweb.com 14 sectigoweb.com 13 register.com 13 register.com 7 dnssrv.nl 7 vultr.com 6 vultr.com 7 dnssrv.nl 6 ispapi.net 6 resolver.domains 6 forpsi.net 6 ispapi.net If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Just one of the domains whose nameservers have broken denial of existence appears in the last 120 days of Google transparency reports: mailazy.net -- Viktor. [0] Credits: Hosting for the DANE/DNSSEC project is donated by isi.edu (Wes Hardaker and team). Wes also hosts and maintains the https://stats.dnssec-tools.org website. Thanks go to ICANN for sponsoring acquisition of the server hardware. Coverage of DNSSEC domains continues to improve with ongoing data support from Chris Mikkelson from domaintools.com. Credits also due to ICANN providing gTLD data via CZDS, and to the ccTLD registries for .CH, .DK, .FI, .FR, .IS, .LI, .NL, .NU and .SE. More data sources of ccTLD signed delegations welcome. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security. [2] DANE domains appearing in last 90 days of Google Email transparency reports: vbv.ag uni-augsburg.de maastrichtuniversity.nl univie.ac.at uni-bielefeld.de mailmore.nl gmx.at uni-erlangen.de mailon.nl boozyshop.be uni-muenchen.de mailplus.nl eos-contentia.be vicinityclo.de managementboek.nl triodos.be web.de markteffectmail.nl nra.bg westlotto.de mcmta.nl register.bg sanchezadv.digital mijndomein.nl dwvmail.com.br aeldresagen.dk mijnmagazines.nl e-negociacao.com.br allbuy.dk minbzk.nl e-renegocie.com.br annebrauner.dk mindef.nl pn1.com.br anodyne.dk minvenj.nl zaaztelecom.com.br avabeauty.dk mm1.nl defesa.gov.br barons.dk mulderretail.nl nic.br bigsaver.dk nefkens.nl registro.br bisgaardshoes.dk netpoint.nl activfitness-news.ch blandselvfroe.dk netpointfactoring.nl blackout-bonusclub.ch boblberg.dk nieuwsservice-rvo.nl creditum.ch bog.dk notbranded.nl escalade.ch borgerforslag.dk noties.nl gmx.ch bymelanie.dk ns.nl handy-abovergleich.ch bystinewinther.dk nuudcare.nl hostpoint.ch camillakroeyer.dk nuwegexclusief.nl infomaniak.ch casanova.dk okki.nl jobsmore.ch champagneklubben.dk oomverzekeringen.nl kalender-win.ch cillouettes.dk opnaarwonderland.nl msochrono.ch computerworld.dk otys.nl open.ch damask.dk ouderenfonds.nl protonmail.ch danskebank.dk ouderportaal.nl sherlockhomes.ch densidsteflaske.dk outlawevents.nl sms-gagnant.ch dfi.dk overheid.nl votreopinion.ch dressforsuccess.dk oxilionhosted.nl bionoble.co ejvinds.dk ozsw.nl simplelogin.co fibianet.dk partijvoordedieren.nl aim-care.com finesmile.dk partnermail.nl albourne.com fletkurven.dk podiumcadeaukaart.nl also.com foraeldresparring.dk politie.nl anonaddy.com frisorenogbaronen.dk pp-prd.nl ansigtsyogaonline.com gasolinegrill.dk previder.nl aotax.com gastrotools.dk proefdiervrij.nl boozyshop.com globestudios.dk prorun-mail.nl buroventures.com hook-up.dk pvv.nl canva-facile.com hostedsepo.dk quicknet.nl cm.com idelig.dk ranzijn.nl collarofsweden.com inkpro.dk rdw.nl connectsb.com iphoneopladere.dk rebirth-festival.nl conscience-et-realites.com ixstudioscph.dk rechtspraak.nl cornerstoneplatform.com kagegrisen.dk restaurant-sparkling.nl danskebank.com kisserpaludan.dk rijksoverheid.nl datev.com kk.dk rivm.nl denhaag.com kodbilen.dk rotterdam.nl detectiveforaday.com konkurspriser.dk rvig.nl eliteincomesociety.com kystfisken.dk rvo.nl explorer-hotels.com lacabra.dk sans-mail.nl fabfilter.com lammeskindet.dk schuurman-schoenen.nl farmergracy.com lederstof.dk scorion.nl fastware-hosting.com legekammeraten.dk shampoobars.nl flaneurhomme.com memery.dk shapeit.nl fromanteel-watches.com mobilcovers.dk shoesme.nl gearboxdigital.com modstroem.dk sizzthebrand.nl getpaidopportunities.com musclehouse.dk smartwatchbanden.nl gmx.com naturhandel.dk snowbass.nl goodforme.com netic.dk spamservice.nl grimfrost.com nexsmart.dk sportrusten.nl habitamat.com nfinitybeauty.dk ssonet.nl habr.com nimara.dk stage-app.nl hannahbarrettyoga.com nordd.dk stater.nl headachecalendar.com nordicsheep.dk steunactie.nl hedon.com nota.dk svr.nl highcharts.com online-mode.dk technicus.nl hwigroup.com perfectjeans.dk telefoonglaasje.nl imcnig.com qookware.dk thealphamen.nl infomaniak.com sengefabrikken.dk thefightcompany.nl ingthink.com seniornews.dk triodos.nl intakt.com shapeit.dk truetickets.nl johnbeerens.com sillysanta.dk tudelft.nl joomlapolis.com skjold-burne.dk u-mailer.nl jula.com smoon.dk uitgeverijpica.nl justpadel.com sneakerzone.dk upcmail.nl kabayarefashion.com stil.dk uvt.nl kae-cosmetici.com sygeforsikring.dk uwv.nl kheaa.com thenap.dk vacaturesonline.nl leszexpertsfle.com thesneakerstore.dk valys.nl librti.com trueliving.dk vandale.nl luvrefranco.com trustfitness.dk vimexx.nl mail.com viggo.dk vluchtelingenwerk.nl maileroo.com vind.dk vpo.nl mailzerver.com yuaiahaircare.dk vunzigedeuntjes.nl marsblade.com tilburguniversity.edu vvv-venlo.nl meriamecouture.com biotheka.ee watchbandjes-shop.nl mplbeauty.com holt.ee waternet.nl nanolearning.com maarahvapood.ee werkzoeken.nl nautisme-pratique.com minuvalik.ee woongarantvolmacht.nl nine-pine.com surveyturtle.ee ziggo.nl novashops.com turunduslabor.ee zorgmail.nl offshorecorptalk.com myownconference.email ankerstjerne.no one.com spam-filter.email annabellstefanussen.no orsys.com spotler.email babybanden.no ottobredesign.com talentech.email bull-ski-kajakk.no pieter-pot.com triodos.es chillout.no polyas.com egu.eu day-et.no pompomlondon.com finesoftware.eu dinholdning.no ppcpcv.com mailplatform.eu domeneshop.no protonmail.com qard.eu dressmykid.no run-motion.com rybarik.eu guttelus.no runbox.com zone.eu handelsbanken.no sankakucomplex.com zonevs.eu hoppin.no scienceshepherd.com danskebank.fi hypopressivtrening.no scorecloud.com f-solutions.fi hyttefeber.no serverclienti.com fsol.fi idrettenonline.no sisuknitwear.com handelsbanken.fi kashmina.no sneakerdistrict.com io-tech.fi lagerpriser.no solvinity.com metaburn.fi lillepr.no stasdock.com raumanteatteri.fi marikrogshus.no stater.com sillysanta.fi metaburn.no stellarequipment.com traficom.fi mystuff.no tcs.com ac-strasbourg.fr nordiskbylien.no theintercept.com boozyshop.fr norisma.no thelabelmachine.com braceletsmartwatch.fr norskgrammatikk.no thepcw.com compagnie-des-sens.fr raskebriller.no thepcwholesale.com edtm-actu.fr rushtrampoline.no thingsilikethingsilove.com oo2.fr smaaungene.no tibush.com passefranceallemagne.fr spillfabrikken.no trainwithlov.com privea.fr stilshoppen.no triodos.com fvap.gov strikkia.no tuftingshop.com fidesz.hu svippr.no tutanota.com italiamail.hu tickettothemoon.no up2staff.com marathonlife.hu veronicalill.no vivaldi.com nyirbatorvaroskartya.hu atelkamera.nu webcruiter.com zsibvasar.hu goget.nu xfinity.com bluebiz.info lenhud.nu xfinityhomesecurity.com j360.info skjutsgruppen.nu xfinitymobile.com eurocontrol.int agirpourlenvironnement.org zangra.com infinex.io calyxinstitute.org bncr.fi.cr simplelogin.io debian.org airbank.cz nuudcare.it freebsd.org akce-incomputer.cz neolink.link fridaysforfuture.org amenit.cz education.lu gentoo.org balikovna.cz etat.lu ietf.org bewooden.cz restena.lu isc.org cd.cz anonaddy.me mailbox.org cinemax.cz pm.me mailop.org cokoladovnajanek.cz proton.me netbsd.org cpost.cz army.mil openssl.org creammy.cz dla.mil ozlabs.org csob.cz dma.mil postfix.org csobstavebni.cz health.mil rfc-editor.org cuni.cz jten.mil samba.org dashofer.cz mail.mil torproject.org e-kondomy.cz navy.mil biotechnologia.com.pl ecps.cz nga.mil asf.com.pt ekokoza.cz osd.mil loopia.rs fio.cz socom.mil pinnbet.rs gov.cz spaceforce.mil mobily.com.sa hobynaradi.cz uscg.mil advisamail.se hypotecnibanka.cz usmc.mil arbetsformedlingen.se innogy.cz aifi.net bearplay.se itesco.cz comcast.net bearplayshop.se jumpfamily.cz ewetel.net bilprovningen.se kb.cz ficbook.net dingolfshop.se klenotyaurum.cz fivem.net ellevio.se klubpevnehozdravi.cz forwardemail.net epochtimes-mejl.se ksporting.cz gmx.net fotproffsen.se manymail.cz graphistepro.net getvibes.se mbank.cz habramail.net handelsbanken.se mfcr.cz hr-manager.net hellomantle.se mindsoft.cz intares.net inkrebel.se mkluzkoviny.cz mailanyone.net innebandy24.se mojedatovaschranka.cz masterinter.net jaramba.se mojemincovna.cz mijngezondheid.net jul-troja.se mrakyhracek.cz mpssec.net koreanbeauty.se muni.cz procurios.net kth.se nic.cz ripe.net kulturaktiebolaget.se o2.cz riseup.net livlyclothing.se opravdovezlociny.cz s-qrc.net lnu.se optimail.cz soverin.net lomervarde.se outlet-alpine.cz space.net loopia.se p-info.cz t-2.net merchsweden.se pivoteka.cz alexstory.nl metaburn.se poptavej.cz allevakantiehuizeninbelgie.nl minmyndighetspost.se scrptd.cz amsterdam.nl naprapatlandslaget.se server4u.cz aquastorexl.nl naturligtsnygg.se shopex.cz bankhoesdiscounter.nl nordd.se smtp.cz belastingdienst.nl nordicsheep.se sparkys.cz beterinbeleggen.nl polisen.se stoklasa.cz beterspellen.nl samblamail.se tefal.cz bewustpuur.nl sillysanta.se thinline.cz bhosted.nl silverdotter.se vas-server.cz blushfashionstore.nl skatteverket.se vitalpoint.cz bobo.nl skolverket.se vshosting.cz body-supplies.nl snbostader.se zafido.cz bolerolimonadewinkel.nl soleplus.se zdravestravovani.cz boozyshop.nl spelfabrik.se zonky.cz box.nl svenskhusman.se bayern.de bruut.nl teeshoppen.se brandenburg.de burgernet.nl teknikdelar.se bund.de carre.nl theletter.se datev.de casema.nl websupport.se dbtg.de cbr.nl agatinsvet.sk denic.de chello.nl bewooden.sk deutsch-franzoesischer-freundschaftspass.de citotoetsgroep4.nl coopka.sk dfn.de clubplanner.nl edirect.sk elster.de degros.nl fio.sk ewetel.de deonlinetandarts.nl gravirovane.sk fau.de derooijfotografie.nl hecht.sk freenet.de desan.nl mamaaja.sk gmx.de dewebmakers.nl mklozkoviny.sk hi7.de dictu.nl mnforce-panel.sk huellen-shop.de digid.nl nakupujzdravo.sk iks-jena.de dimehouse.nl nameserver.sk jpberlin.de dorcas.nl nlp-akademia.sk knauermann.de duo.nl partner.sk lmu.de esuals.nl penzionmara.sk lrz.de extinctionrebellion.nl poziadavka.sk mail.de ezorg.nl rondogo.sk mail2many.de fivecityspa.nl travelmail.sk mensa.de glamouryourhair.nl zapardrobnych.sk mpg.de hobbygigant.nl afinepairofshoes.co.uk posteo.de home.nl clientnews3.co.uk ruhr-uni-bochum.de hostnet.nl handelsbanken.co.uk sifjakobs.de huurexpert.nl millieandblake.co.uk sillysanta.de ikdeburger.nl nuudcare.co.uk smartwatcharmbaender.de inspirerendleven.nl thewordman.co.uk sys4.de interim-netwerk.nl triodos.co.uk taures.de jointherebellion.nl nuudcare.us tu-darmstadt.de josephinajewelry.nl quantum-services.us tum.de kiesrijk.nl ru.ac.za tutanota.de liveatamsterdamsebos.nl

1 0