- dane-users - list.sys4.de

Proofpoint announces DANE support
by Knubben, B.S.J. (Bart) - Forum Standaardisatie 25 Jun '19

25 Jun '19

Hi, See: https://twitter.com/ProofpointJ/status/1143536219126677504 and also https://mobile.twitter.com/internet_nl/status/1143548855075651584 -- Best regards, Bart Knubben Dutch Standardisation Forum https://www.forumstandaardisatie.nl/content/english Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

1 0

DANE plus wildcard record
by Rob McGee 16 Jun '19

16 Jun '19

Hi all, first post here. Hi Viktor and the sys4.de gang. I host a mailing list for a free software project with DANE enabled both ways. No need for secrecy there, it's Slackbuilds.org. One of my subscribers recently signed his or her zone, and sadly, has a wildcard A in that zone. Unfortunately at this point I do have to keep that zone name private, although offlist I'd tell it to someone I know and consider trustworthy to maintain the user's confidence. Oh, if you consult your dane.sys4.de logs for a bit ago, I suppose I already DID tell you the zone name. :) Starts with "a" and is in com. TLD. The checker reports "DNS lookup error for TLSA records: SERVFAIL", which is what I get on the named recursive resolver that Postfix is using, querying "_25._tcp.smtp.example.com./IN/TLSA". So Postfix is refusing to deliver, believing that there should be a TLSA. But AFAIK this user never published TLSA. The SOA MNAME host has disabled version.bind./CH/TXT lookups so I am not sure what software is in use, but having A for an invalid hostname (underscores not allowed in hostnames) would be a problem for BIND named, which by default would not allow that. But I don't know how that feature interacts with wildcard records. Testing on a dnsmasq from home I don't get SERVFAIL, just NOERROR. -- http://rob0.nodns4.us/

2 5

Update on stats 2019-05
by Viktor Dukhovni 02 Jun '19

02 Jun '19

Summary: The DANE domain count is now 1,149,012 The number of domains that return DNSSEC-validated replies in response to MX queries is 9,874,472. Thus DANE TLSA is deployed on 11.63% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. Appeal: The handful of providers with long-term broken DNSSEC denial of existence are sadly making little progress to update their buggy DNS implementations. It would be really great if (at least): mijnhostingpartner.nl (Many broken NSEC3 RRSIGs) epik.com (Wildcards missing from NSEC chain) metaregistrar.nl (Wrong empty non-terminal handling) tiscomhosting.nl (Missing wildcard NSEC for NODATA response) dotserv.com (invalid NSEC chain order) movenext.nl (NSEC replies don't cover wildcard) nrdns.nl (Malformed NSEC3 or ServFail) binero.se (NSEC3 chain names returned as NSEC!) fixed their nameserver and/or zone provisioning code. While the O(10^3) affected domains are a small fraction of the O(10^7) signed domains, they are a much larger fraction of the signed domains for those particular providers. Appeal: The number of domains with neglected outdated TLSA records, has grown to ~500. PLEASE *monitor* your deployment, and implement a cert/key rollover process that does not (even temporarily) disrupt the validity of your certificate chain as compared to the published (cached) TLSA records: https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources If you're willing and able to help reach out to the operators of MX hosts with misconfigured TLSA RRsets, please get in touch. As of today I count 1,149,012 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 705488 one.com 125798 transip.nl 97267 domeneshop.no 36238 active24.com 32475 vevida.com 24131 udmedia.de 15856 flexfilter.nl 12993 onebit.cz 12327 zxcs.nl 10961 bhosted.nl 5999 netzone.ch 5644 previder.nl 3795 ips.nl 3401 interconnect.nl 2481 provalue.nl 2287 nederhost.nl 1628 nmugroup.com 1574 yourdomainprovider.net 1320 hi7.de 1293 prolocation.net The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 5221 TOTAL 1758 DE, Germany 1065 US, United States 718 NL, Netherlands 383 FR, France 216 GB, United Kingdom 175 CZ, Czechia 116 CA, Canada 88 SG, Singapore 75 CH, Switzerland 71 SE, Sweden 54 DK, Denmark 43 IE, Ireland 43 AT, Austria 41 FI, Finland 36 AU, Australia 34 PL, Poland 34 BR, Brazil 26 RU, Russia 26 JP, Japan 23 IN, India IPv6 is still comparatively rare for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 1914 TOTAL 732 DE, Germany 304 NL, Netherlands 238 FR, France 155 US, United States 114 CZ, Czechia 74 GB, United Kingdom 39 SE, Sweden 33 CH, Switzerland 28 RU, Russia 28 CA, Canada 22 AT, Austria 18 IE, Ireland 14 NO, Norway 13 DK, Denmark 12 FI, Finland 10 AU, Australia 9 SI, Slovenia 9 IN, India 7 IT, Italy 6 SK, Slovakia There are 4392 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 6639. These cover 7077 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 245 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 129 are in recent (last 90 days of) reports: univie.ac.at ruhr-uni-bochum.de mailplus.nl gmx.at tu-darmstadt.de markteffectmail.nl transip.be tum.de minbzk.nl nic.br uni-erlangen.de ouderportaal.nl registro.br uni-muenchen.de overheid.nl gmx.ch unitybox.de pathe.nl open.ch unitymedia.de photofacts.nl anubisnetworks.com web.de photofactsacademy.nl fmc-na.com egmontpublishing.dk politie.nl gmx.com netic.dk previder.nl habr.com sitnet.dk rijksoverheid.nl hotelsinduitsland.com tilburguniversity.edu rotterdam.nl kpn.com zone.eu rvo.nl mail.com dovecot.fi ssonet.nl one.com ac-strasbourg.fr transip.nl solvinity.com insee.fr truetickets.nl t-2.com octopuce.fr utwente.nl telfort.com web200.hu uvt.nl trashmail.com comcast.net xs4all.nl xfinity.com dd24.net domeneshop.no xfinityhomesecurity.com dns-oarc.net handelsbanken.no xfinitymobile.com gmx.net uib.no active24.cz habramail.net webcruitermail.no atlas.cz hr-manager.net atelkamera.nu centrum.cz inexio.net aegee.org cuni.cz mpssec.net debian.org klubpevnehozdravi.cz procurios.net freebsd.org onebit.cz riseup.net gentoo.org smtp.cz t-2.net ietf.org virusfree.cz transip.net isc.org volny.cz transversal.net netbsd.org allsecur.de vevida.net openssl.org bayern.de xs4all.net ozlabs.org bund.de bhosted.nl samba.org elster.de bluerail.nl torproject.org fau.de boekwinkeltjes.nl asf.com.pt freenet.de corpoflow.nl deborla.pt gmx.de denhaag.nl moikrug.ru jpberlin.de dictu.nl handelsbanken.se lrz.de digid.nl minmyndighetspost.se mail.de hierinloggen.nl personligalmanacka.se mensa.de hr.nl skatteverket.se posteo.de intermax.nl govtrack.us Of the ~1.15 million domains, 2514 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 560. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1318. The top 10 name server operators with problem domains are: 537 mijnhostingpartner.nl 109 epik.com 40 metaregistrar.nl 34 tiscomhosting.nl 34 dotserv.com 33 movenext.nl 31 nrdns.nl 30 binero.se 29 domaincontrol.com 27 sylconia.net [ Sadly epik.com is back, after resolving all issues last month, it seems while the reported domains were resolved, the underlying systemic issue was not. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eleven of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br key.com keybank.com bluehosting.host rackeo.host sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-04
by Viktor Dukhovni 01 May '19

01 May '19

Summary: The DANE domain count is now 1,122,806 The number of domains that return DNSSEC-validated replies in response to MX queries is 9,596,909. Thus DANE TLSA is deployed on 11.69% of domains with DNSSEC. Appeal: The number of domains with neglected outdated TLSA records, has grown to ~500. PLEASE *monitor* your deployment, and implement a cert/key rollover process that does not (even temporarily) disrupt the validity of your certificate chain as compared to the published (cached) TLSA records: https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources If you're willing and able to help reach out to the operators of MX hosts with misconfigured TLSA RRsets, please get in touch. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,122,806 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 684247 one.com 124234 transip.nl 96829 domeneshop.no 36048 active24.com 32637 vevida.com 24093 udmedia.de 15998 flexfilter.nl 13011 onebit.cz 11310 zxcs.nl 10924 bhosted.nl 5995 netzone.ch 5642 previder.nl 3876 ips.nl 3434 interconnect.nl 2487 provalue.nl 2331 nederhost.nl 1630 nmugroup.com 1431 yourdomainprovider.net 1323 hi7.de 1311 xcellerate.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 5123 TOTAL 1710 DE, Germany 1055 US, United States 689 NL, Netherlands 393 FR, France 218 GB, United Kingdom 177 CZ, Czechia 111 CA, Canada 84 SG, Singapore 71 CH, Switzerland 70 SE, Sweden 55 DK, Denmark 46 IE, Ireland 39 AU, Australia 39 AT, Austria 37 FI, Finland 37 BR, Brazil 30 PL, Poland 26 RU, Russia 24 JP, Japan 20 NO, Norway IPv6 is still comparatively rare for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 1897 TOTAL 721 DE, Germany 315 NL, Netherlands 226 FR, France 140 US, United States 115 CZ, Czechia 81 GB, United Kingdom 44 SE, Sweden 30 CH, Switzerland 27 CA, Canada 24 RU, Russia 20 AT, Austria 16 IE, Ireland 14 NO, Norway 12 SI, Slovenia 11 AU, Australia 10 FI, Finland 9 UA, Ukraine 9 DK, Denmark 7 PL, Poland 7 BE, Belgium There are 4334 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 6402. These cover 6840 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 234 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 122 are in recent (last 90 days of) reports: univie.ac.at tu-darmstadt.de markteffectmail.nl gmx.at tum.de minbzk.nl nic.br uni-erlangen.de ouderportaal.nl registro.br uni-muenchen.de overheid.nl gmx.ch unitybox.de pathe.nl open.ch unitymedia.de photofacts.nl anubisnetworks.com web.de photofactsacademy.nl fmc-na.com egmontpublishing.dk politie.nl gmx.com netic.dk previder.nl habr.com sitnet.dk rijksoverheid.nl hotelsinduitsland.com tilburguniversity.edu rvo.nl mail.com zone.eu ssonet.nl one.com dovecot.fi transip.nl solvinity.com ac-strasbourg.fr truetickets.nl t-2.com insee.fr uvt.nl trashmail.com octopuce.fr xs4all.nl xfinity.com web200.hu domeneshop.no xfinityhomesecurity.com comcast.net handelsbanken.no xfinitymobile.com dns-oarc.net uib.no active24.cz gmx.net webcruitermail.no atlas.cz habramail.net atelkamera.nu centrum.cz hr-manager.net aegee.org cuni.cz inexio.net debian.org itesco.cz mpssec.net freebsd.org klubpevnehozdravi.cz procurios.net gentoo.org onebit.cz riseup.net ietf.org smtp.cz t-2.net isc.org virusfree.cz transip.net netbsd.org volny.cz vevida.net openssl.org bayern.de xs4all.net ozlabs.org bund.de atletiekunie.nl samba.org elster.de bhosted.nl torproject.org fau.de boekwinkeltjes.nl asf.com.pt freenet.de corpoflow.nl moikrug.ru gmx.de denhaag.nl handelsbanken.se jpberlin.de dictu.nl iis.se lrz.de digid.nl minmyndighetspost.se mail.de hierinloggen.nl personligalmanacka.se mensa.de interconnect.nl skatteverket.se posteo.de intermax.nl govtrack.us ruhr-uni-bochum.de mailplus.nl Of the ~1.12 million domains, 2494 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 567. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 729. The top 10 name server operators with problem domains are: 194 mijnhostingpartner.nl 38 metaregistrar.nl 34 tiscomhosting.nl 33 dotserv.com 32 binero.se 31 nrdns.nl 29 movenext.nl 26 sylconia.net 26 active24.cz 16 nazwa.pl [ All issues at last month's #2 epik.com are now resolved. Their prompt attention and action is appreciated. Around half of the mijnhostingpartner.nl domains err only in having an extraneous 512-bit RSA ZSK for algorithm 7 which is not used to sign the zone, but leaves the door open to attacks. It also violates a requirement for each algorithm in the DNSKEY RRset to have at least one active key. Violation of the algorithm agility requirement is unlikely to cause interoperability problems in this particular case, but given the needlessly weak keys, I've decided to continue to track these until all the extraneos keys are gone. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Seven of the domains all whose nameservers have broken denial of existence appear in historical Google reports: trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br accenturealumni.com rackeo.host sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Upcoming Let's Encrypt intermediate issuer certificate change...
by Viktor Dukhovni 17 Apr '19

17 Apr '19

If you're relying on DANE TLSA "2 0 1" or "2 0 2" records that the match the current Let's Encrypt Intermediate certificate, you need to make appropriate plans for the switchover to a new intermediate CA cert on 2010-07-08: https://scotthelme.co.uk/lets-encrypt-to-transition-to-isrg-root/ this will result in a change in the content (and digest) of the intermediate issuer cert. But the underlying public key is *not* changing. Therefore, the sensible solution is before then to switch to "2 1 1" records that will continue to work across the cutover. The "2 1 1" record will of course have a different digest from the "2 0 1" record (and likewise for "2 1 2" vs. "2 0 2"). The stable key digests are: 2 1 1 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 2 1 2 774fad8c9a6afc2bdb44faba8390d213ae592fb0d56c5dfab152284e334d7cd6abd05799236e7aa6266edf81907c60404c57ee54c10a3a82fcc2a9146629b140 See also: https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources https://github.com/danefail/list/issues/47#issuecomment-456623996 -- Viktor.

1 0

Update on stats 2019-03
by Viktor Dukhovni 01 Apr '19

01 Apr '19

Summary: The DANE domain count is now 1,107,851 The number of domains that return DNSSEC-validated replies in response to MX queries is 9,525,120. Thus DANE TLSA is deployed on 11.63% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,107,851 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 682345 one.com 122842 transip.nl 97106 domeneshop.no 35828 active24.com 32803 vevida.com 24093 udmedia.de 16091 flexfilter.nl 12932 onebit.cz 11039 bhosted.nl 5992 netzone.ch 5657 previder.nl 3901 ips.nl 3535 interconnect.nl 2490 provalue.nl 2343 nederhost.nl 1646 nmugroup.com 1445 yourdomainprovider.net 1328 hi7.de 1308 xcellerate.nl 1307 prolocation.net The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 4977 TOTAL 1680 DE, Germany 1026 US, United States 674 NL, Netherlands 382 FR, France 204 GB, United Kingdom 170 CZ, Czechia 104 CA, Canada 80 SG, Singapore 71 CH, Switzerland 69 SE, Sweden 48 DK, Denmark 45 IE, Ireland 40 AU, Australia 39 AT, Austria 38 BR, Brazil 33 FI, Finland 29 PL, Poland 25 RU, Russia 21 JP, Japan 18 IT, Italy IPv6 is still comparatively rare for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 1834 TOTAL 677 DE, Germany 309 NL, Netherlands 221 FR, France 170 US, United States 111 CZ, Czechia 51 GB, United Kingdom 40 SE, Sweden 27 RU, Russia 27 CH, Switzerland 26 CA, Canada 20 AT, Austria 13 DK, Denmark 12 IE, Ireland 12 AU, Australia 11 NO, Norway 10 FI, Finland 10 BR, Brazil 9 SI, Slovenia 7 UA, Ukraine 7 PL, Poland There are 4176 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 6156. These cover 6594 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 229 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 114 are in recent (last 90 days of) reports: univie.ac.at ruhr-uni-bochum.de minbzk.nl gmx.at tu-darmstadt.de mycom.nl nic.br tum.de ouderportaal.nl registro.br uni-erlangen.de overheid.nl gmx.ch unitybox.de pathe.nl open.ch unitymedia.de photofacts.nl anubisnetworks.com web.de photofactsacademy.nl fmc-na.com dk-hostmaster.dk politie.nl gmx.com egmontpublishing.dk previder.nl habr.com netic.dk rijksoverheid.nl hotelsinduitsland.com tilburguniversity.edu ssonet.nl kpn.com dovecot.fi transip.nl mail.com ac-strasbourg.fr truetickets.nl one.com insee.fr utwente.nl solvinity.com octopuce.fr uvt.nl t-2.com web200.hu xs4all.nl telfort.com comcast.net domeneshop.no trashmail.com gmx.net handelsbanken.no xfinity.com habramail.net webcruitermail.no xfinityhomesecurity.com hr-manager.net atelkamera.nu xfinitymobile.com inexio.net aegee.org active24.cz mpssec.net debian.org cuni.cz procurios.net freebsd.org itesco.cz riseup.net gentoo.org klubpevnehozdravi.cz t-2.net ietf.org onebit.cz transip.net isc.org smtp.cz vevida.net netbsd.org virusfree.cz xs4all.net openssl.org bayern.de atletiekunie.nl ozlabs.org bund.de bhosted.nl samba.org elster.de bluerail.nl torproject.org fau.de boozyshop.nl asf.com.pt freenet.de corpoflow.nl handelsbanken.se gmx.de hierinloggen.nl iis.se jpberlin.de interconnect.nl minmyndighetspost.se lrz.de intermax.nl personligalmanacka.se mail.de mailplus.nl skatteverket.se posteo.de markteffectmail.nl govtrack.us Of the DANE email domains, 2044 are listed in the Alexa top 1 million (web site) list. Of the ~1.11 million domains, 2403 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 376. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1160. The top 10 name server operators with problem domains are: 544 mijnhostingpartner.nl 95 epik.com 42 metaregistrar.nl 35 dotserv.com 35 binero.se 34 tiscomhosting.nl 31 nrdns.nl 29 sylconia.net 26 active24.cz 20 movenext.nl [ Some of these also have denial of existence problems at many more domains that don't receive mail, so the problem is not operationally significant in those cases, but could become larger, if more email-enabled signed domains start using these servers. For the top two, these additional domains number well over one thousand each. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Seven of the domains all whose nameservers have broken denial of existence appear in historical Google reports: trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br accenturealumni.com rackeo.host sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-02
by Viktor Dukhovni 01 Mar '19

01 Mar '19

Summary: The DANE domain count is now 1,076,237 The number of domains that return DNSSEC-validated replies in response to MX queries is 9,397,166. Thus DANE TLSA is deployed on 11.45% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,076,237 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 679515 one.com 121564 transip.nl 96967 domeneshop.no 35708 active24.com 32613 vevida.com 24067 udmedia.de 12902 onebit.cz 10954 bhosted.nl 5628 previder.nl 3591 interconnect.nl 2499 provalue.nl 2361 nederhost.nl 1653 nmugroup.com 1460 yourdomainprovider.net 1330 hi7.de 1316 prolocation.net 1285 xcellerate.nl 1261 surfmailfilter.nl 1101 soverin.net 827 mailbox.org The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 4801 TOTAL 1629 DE, Germany 1001 US, United States 658 NL, Netherlands 356 FR, France 188 GB, United Kingdom 161 CZ, Czechia 97 CA, Canada 78 SG, Singapore 68 CH, Switzerland 64 SE, Sweden 47 DK, Denmark 43 IE, Ireland 42 BR, Brazil 38 AT, Austria 36 AU, Australia 30 FI, Finland 26 PL, Poland 26 JP, Japan 24 RU, Russia 18 NO, Norway IPv6 is still comparatively rare for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 1834 TOTAL 664 DE, Germany 320 NL, Netherlands 207 FR, France 162 US, United States 117 CZ, Czechia 82 GB, United Kingdom 35 SE, Sweden 32 RU, Russia 30 CH, Switzerland 23 CA, Canada 20 AT, Austria 13 IE, Ireland 12 DK, Denmark 11 NO, Norway 11 AU, Australia 9 SI, Slovenia 9 FI, Finland 8 UA, Ukraine 6 IT, Italy 5 SK, Slovakia There are 4032 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 5941. These cover 6373 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 225 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 113 are in recent (last 90 days of) reports: univie.ac.at posteo.de ouderportaal.nl gmx.at ruhr-uni-bochum.de overheid.nl nic.br tu-darmstadt.de pathe.nl registro.br tum.de photofacts.nl gmx.ch uni-erlangen.de photofactsacademy.nl open.ch unitybox.de politie.nl anubisnetworks.com unitymedia.de rijksoverheid.nl fmc-na.com web.de ssonet.nl gmx.com dk-hostmaster.dk transip.nl habr.com egmontpublishing.dk truetickets.nl hotelsinduitsland.com netic.dk utwente.nl kpn.com tilburguniversity.edu uvt.nl mail.com dovecot.fi xs4all.nl one.com insee.fr domeneshop.no solvinity.com octopuce.fr handelsbanken.no t-2.com web200.hu webcruitermail.no telfort.com comcast.net atelkamera.nu trashmail.com dd24.net aegee.org xfinity.com gmx.net debian.org xfinityhomesecurity.com habramail.net freebsd.org xfinitymobile.com hr-manager.net gentoo.org active24.cz inexio.net ietf.org cuni.cz mpssec.net isc.org itesco.cz procurios.net mailbox.org klubpevnehozdravi.cz riseup.net netbsd.org onebit.cz t-2.net openssl.org smtp.cz transip.net ozlabs.org virusfree.cz vevida.net samba.org allsecur.de xs4all.net torproject.org bayern.de ardanta.nl asf.com.pt bund.de atletiekunie.nl handelsbanken.se elster.de bhosted.nl iis.se fau.de boozyshop.nl minmyndighetspost.se freenet.de hierinloggen.nl personligalmanacka.se gmx.de interconnect.nl skatteverket.se jpberlin.de intermax.nl t-2.si lrz.de mailplus.nl govtrack.us mail.de minbzk.nl Of the DANE email domains, 2014 are listed in the Alexa top 1 million (web site) list. Of the ~1.08 million domains, 2324 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 259. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 525. The top 10 name server operators with problem domains are: 35 dotserv.com 34 tiscomhosting.nl 31 schefczyk.net 31 nrdns.nl 30 sylconia.net 25 metaregistrar.nl 24 active24.cz (customer zones with broken wildcard cnames) 21 nazwa.pl (customer zones with broken wildcard NS RRs) 19 movenext.nl 12 is.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Seven of the domains all whose nameservers have broken denial of existence appear in historical Google reports: trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br accenturealumni.com rackeo.host sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-01
by Viktor Dukhovni 01 Feb '19

01 Feb '19

Summary: The DANE domain count is now 1,067,099 Much of this month's adoption bump can be credited to one.com, thank you one.com. Another significant addition, is onebit.cz in 7th place, with ~13k domains. The number of domains with DNSSEC MX records is 9,458,550. Thus DANE TLSA is deployed on 11.2% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,067,099 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 673032 one.com 120167 transip.nl 96963 domeneshop.no 35412 active24.com 32677 vevida.com 23990 udmedia.de 12791 onebit.cz 10880 bhosted.nl 5621 previder.nl 3604 interconnect.nl 2519 provalue.nl 2381 nederhost.nl 1611 nmugroup.com 1459 yourdomainprovider.net 1325 prolocation.net 1307 hi7.de 1250 surfmailfilter.nl 1131 xcellerate.nl 1048 soverin.net 798 omc-mail.com The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented): 4706 TOTAL 1597 DE, Germany 1003 US, United States 637 NL, Netherlands 351 FR, France 191 GB, United Kingdom 151 CZ, Czechia 88 CA, Canada 72 SG, Singapore 67 CH, Switzerland 64 SE, Sweden 42 DK, Denmark 40 IE, Ireland 40 BR, Brazil 36 AT, Austria 32 FI, Finland 32 AU, Australia 28 PL, Poland 26 RU, Russia 20 JP, Japan 17 NO, Norway IPv6 is still comparatively rare for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are (same top 6). 2389 TOTAL 935 DE, Germany 384 US, United States 335 NL, Netherlands 208 FR, France 110 CZ, Czechia 88 GB, United Kingdom 37 RU, Russia 34 SE, Sweden 33 SG, Singapore 28 CH, Switzerland 21 AT, Austria 19 CA, Canada 15 IE, Ireland 13 JP, Japan 12 SI, Slovenia 12 FI, Finland 11 NO, Norway 11 DK, Denmark 11 BR, Brazil 10 AU, Australia There are 3958 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 5760. These cover 6193 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 218 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 109 are in recent (last 90 days of) reports: univie.ac.at mail.de overheid.nl gmx.at posteo.de pathe.nl nic.br ruhr-uni-bochum.de photofacts.nl registro.br tum.de photofactsacademy.nl gmx.ch uni-erlangen.de politie.nl open.ch unitybox.de rijksoverheid.nl anubisnetworks.com unitymedia.de saxion.nl fmc-na.com web.de ssonet.nl gmx.com dk-hostmaster.dk transip.nl habr.com egmontpublishing.dk truetickets.nl hotelsinduitsland.com netic.dk utwente.nl kpn.com tilburguniversity.edu uvt.nl mail.com insee.fr xs4all.nl one.com octopuce.fr domeneshop.no solvinity.com web200.hu handelsbanken.no t-2.com comcast.net webcruitermail.no telfort.com dd24.net atelkamera.nu trashmail.com dns-oarc.net aegee.org xfinity.com gmx.net debian.org xfinityhomesecurity.com habramail.net freebsd.org xfinitymobile.com hr-manager.net gentoo.org active24.cz inexio.net ietf.org cuni.cz mpssec.net isc.org itesco.cz r4p3.net mailbox.org klubpevnehozdravi.cz riseup.net netbsd.org nic.cz t-2.net openssl.org smtp.cz transip.net samba.org virusfree.cz xs4all.net torproject.org allsecur.de ardanta.nl asf.com.pt bayern.de bhosted.nl handelsbanken.se bund.de boekwinkeltjes.nl minmyndighetspost.se elster.de boozyshop.nl personligalmanacka.se fau.de hierinloggen.nl skatteverket.se freenet.de intermax.nl t-2.si gmx.de mailplus.nl govtrack.us jpberlin.de minbzk.nl lrz.de ouderportaal.nl Of the ~1.07 million domains, 2328 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 402. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes http://imrryr.org/~viktor/ICANN61-viktor.pdf http://imrryr.org/~viktor/icann61-viktor.mp3 http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 519. The top 10 name server operators with problem domains are: 36 tiscomhosting.nl 35 dotserv.com 31 nrdns.nl 30 sylconia.net 27 metaregistrar.nl 23 active24.cz (customer zones with broken wildcard cnames) 21 nazwa.pl (customer zones with broken wildcard NS RRs) 18 movenext.nl 13 host-redirect.com 13 binero.se (remediation in progress) If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Four of the domains all whose nameservers have broken denial of existence appear in historical Google reports: accenturealumni.com trtrio.gov.br trtrj.jus.br trt01.gov.br -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Re: Wildcard certificate and DANE/TLSA records
by Viktor Dukhovni 02 Jan '19

02 Jan '19

> On Jan 2, 2019, at 1:32 PM, zorion <zorion(a)autistici.org> wrote: > > What are the implications of not having the private key in this file? I > currently do not have it there, and I see no problems (postfix 3.1.8), > but its possible I'm not seeing something. When the key and certs are in separate files you lose the ability to atomically replace both, and introduce brief races when a Postfix process is loading the key and certs while key rotation is happening. In Postfix 3.4, when the cert and key are in the same file, the race is eliminated. The condition is temporary, and infrequent, but best avoided entirely. As for the key first, that's a longer story, but you won't go wrong doing it that way. -- Viktor.

1 0

Re: Wildcard certificate and DANE/TLSA records
by Viktor Dukhovni 02 Jan '19

02 Jan '19

On Tue, Jan 01, 2019 at 12:08:35PM -0500, zorion wrote: > > No, you just put all the requisite certificates along with the > > private key in a mode 0600, root-owned smtpd_tls_cert_file. The > > server certificate first, then its issuer CA, then any parent issuer > > CA, ... up to possibly the root CA, if that's the DANE trust-anchor > > matching the TLSA record. If the "2 1 1" TLSA record is for an > > intermediate CA, then the root CA can be left out, but still list > > any intermediates above that, for non-DANE clients. > > When I put the private key in that file, how is the file structured? The order of the certificates is subject first then issuer. The key can appear anywhere, but for compatibility with upcoming features in Postfix 3.4, put it first. 1. private key 2. corresponding end-entity certificate 3. issuer of 2 if any 4. issuer of 3 if any ... N. root-CA issued certificate (required for regular PKI) N+1. optional root-CA if published as DANE trust-anchor -- Viktor.

1 0