- dane-users - list.sys4.de

DANE-TA TLSA records for LE and Buypass Go
by Kirill Miazine 25 Nov '20

25 Nov '20

Hi, dane-users I'd like to share that a couple of months ago I've set up tlsa.is to host always up-to-date TLSA records for Let's Encrypt and Buypass Go. The records are generated automatically. At the time of writing they look as following: ; Let's Encrypt (https://letsencrypt.org/certificates/) _letsencrypt TLSA 2 1 1 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 TLSA 2 1 1 8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d TLSA 2 1 1 276fe8a8c4ec7611565bf9fce6dcace9be320c1b5bea27596b2204071ed04f10 TLSA 2 1 1 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b TLSA 2 1 1 e5545e211347241891c554a03934cde9b749664a59d26d615fe58f77990f2d03 TLSA 2 1 1 bd936e72b212ef6f773102c6b77d38f94297322efc25396bc3279422e0c89270 *._letsencrypt CNAME _letsencrypt ; Buypass (https://www.buypass.com/security/buypass-root-certificates) _buypass-go TLSA 2 1 1 42519999c31433a6bcf82c4bd9399301fa180a6f9f5c0a2e033cca602c46a2cb *._buypass-go CNAME _buypass-go Using the records is easy: ; Using CNAME for a single service _25._tcp.mail IN CNAME _letsencrypt.tlsa.is. ; Using DNAME for all services _tcp.mail6 IN DNAME _letsencrypt.tlsa.is. More details -- and the code behind this for local deployments -- are all available at https://tlsa.is/. I've set up automatic monitoring of the web pages where signing details are published and intend to keep this running, but any use is on own risk. Please let me know if you have discovered an error, if some TLSA records for the supported authorities should be added, deleted or updated. Best Kirill -- -- Kirill Miazine <km(a)krot.org>

1 0

Update on stats 2020-10
by Viktor Dukhovni 01 Nov '20

01 Nov '20

Summary: The DANE domain count is now 2,312,209 The number of domains that return DNSSEC-validated replies in response to MX queries is 12,951,015. Thus DANE TLSA is deployed on ~17.85% of domains with DNSSEC. Please be mindful of the upcoming Let's Encrypt Issuer CA switch from X3/X4 to R3/R4 and E1/E2. See: http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 2,312,209 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. This month Last Month ---------- ---------- 1,135,322 one.com 1,135,621 one.com 147,497 argewebhosting.nl 148,737 argewebhosting.nl 144,505 transip.nl 143,441 transip.nl 102,517 domeneshop.no 102,226 domeneshop.no 91,246 loopia.se 90,725 loopia.se 90,381 infomaniak.ch 87,624 infomaniak.ch 65,843 forpsi.com 65,609 forpsi.com 41,983 webreus.nl 42,657 webreus.nl 40,816 pcextreme.nl 41,291 pcextreme.nl 40,094 active24.com 39,806 active24.com 34,527 antagonist.nl 33,919 antagonist.nl 30,427 vevida.com 30,527 vevida.com 29,638 zxcs.nl 29,222 zxcs.nl 26,515 web4u.cz 26,601 web4u.cz 25,522 udmedia.de 25,494 udmedia.de 18,409 bhosted.nl 18,283 bhosted.nl 14,660 flexfilter.nl 14,784 flexfilter.nl 14,272 onebit.cz 14,256 onebit.cz 13,133 protonmail.ch 12,646 protonmail.ch 8,151 zonemx.eu 7,678 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). This month Last Month ---------- ---------- 7347 TOTAL 7177 TOTAL 2332 DE, Germany 2307 DE, Germany 1439 US, United States 1435 US, United States 1175 NL, Netherlands 1089 NL, Netherlands 602 FR, France 596 FR, France 289 GB, United Kingdom 292 GB, United Kingdom 233 CZ, Czechia 226 CZ, Czechia 170 CA, Canada 161 CA, Canada 112 FI, Finland 107 SG, Singapore 108 SG, Singapore 97 CH, Switzerland 102 CH, Switzerland 94 FI, Finland 90 SE, Sweden 89 SE, Sweden 76 DK, Denmark 76 DK, Denmark 56 AU, Australia 59 AU, Australia 50 AT, Austria 51 AT, Austria 46 IE, Ireland 45 IE, Ireland 39 IN, India 37 RU, Russia 37 JP, Japan 36 BR, Brazil 36 BR, Brazil 34 PL, Poland 35 RU, Russia 34 JP, Japan 34 PL, Poland 34 IN, India IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: This Month Last month ---------- ---------- 3786 TOTAL 3659 TOTAL 1549 DE, Germany 1520 DE, Germany 628 NL, Netherlands 631 US, United States 595 US, United States 574 NL, Netherlands 280 FR, France 264 FR, France 139 CZ, Czechia 135 CZ, Czechia 113 GB, United Kingdom 111 GB, United Kingdom 49 RU, Russia 46 CH, Switzerland 49 CH, Switzerland 39 SG, Singapore 43 CA, Canada 39 CA, Canada 38 SG, Singapore 37 SE, Sweden 36 SE, Sweden 36 AT, Austria 32 AT, Austria 20 AU, Australia 21 IE, Ireland 19 RU, Russia 20 JP, Japan 19 JP, Japan 16 NO, Norway 16 FI, Finland 16 FI, Finland 15 NO, Norway 16 DK, Denmark 15 DK, Denmark 16 AU, Australia 12 IE, Ireland 14 LV, Latvia 12 BR, Brazil 14 BR, Brazil 10 PL, Poland There are 6457 (6220 last month) unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 9618 (9296 last month). These cover 10622 (10309 last month) distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 389 (395 last month, this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 190 (193 last month) are in recent (last 90 days of) reports: univie.ac.at gmx.de mailplus.nl gmx.at jpberlin.de markteffectmail.nl tjek.be lrz.de minbuza.nl triodos.be mail.de minbzk.nl clubedohardware.com.br mailserver4.de mindef.nl nic.br mensa.de mkbbelangen.nl registro.br mpg.de mm1.nl gmx.ch posteo.de ns.nl hostpoint.ch ruhr-uni-bochum.de ouderportaal.nl infomaniak.ch tum.de overheid.nl open.ch uni-erlangen.de parlement.nl protonmail.ch uni-muenchen.de pathe.nl switch.ch unitybox.de politie.nl altospam.com unitymedia.de previder.nl clubedominante.com web.de rijksoverheid.nl coosto.com westlotto.de ru.nl fmc-na.com dk-hostmaster.dk rvo.nl gmx.com egmontpublishing.dk sans-mail.nl habr.com netic.dk schoudercom.nl hotelsinduitsland.com powerhosting.dk schuurman-schoenen.nl infomaniak.com star.dk sportfondsen.nl ingthink.com tilburguniversity.edu sportrusten.nl kpn.com just.ee ssonet.nl leszexpertsfle.com rediris.es triodos.nl mail.com triodos.es truetickets.nl mammoetmail.com uv.es tweedekamer.nl one.com inetadmin.eu uitgeverijpica.nl orverkiezing.com zone.eu utwente.nl ppcpcv.com zonevs.eu uvt.nl protonmail.com ac-strasbourg.fr vu.nl protonvpn.com compagnie-des-sens.fr wise-guys.nl solvinity.com kangouroukids.fr xs4all.nl t-2.com fidesz.hu zorgmail.nl telfort.com mszp.hu domeneshop.no thalesgroup.com comcast.net handelsbanken.no triodos.com gmx.net uib.no vitstore.com habramail.net atelkamera.nu xfinity.com hr-manager.net goget.nu xfinityhomesecurity.com inexio.net debian.org xfinitymobile.com mpssec.net freebsd.org active24.cz procurios.net gentoo.org akce-incomputer.cz ripe.net ietf.org amenit.cz riseup.net isc.org atlas.cz t-2.net mailbox.org centrum.cz transip.net mailop.org cuni.cz xs4all.net netbsd.org itesco.cz amsterdam.nl openssl.org klenotyaurum.cz awcloud.nl ozlabs.org klubpevnehozdravi.cz belastingdienst.nl samba.org krypton.cz bhosted.nl torproject.org onebit.cz bluerail.nl whatpulse.org optimail.cz boekwinkeltjes.nl asf.com.pt poptavej.cz boozyshop.nl boplatssyd-automail.se reserved.cz burgernet.nl handelsbanken.se smtp.cz corpoflow.nl loopia.se vas-server.cz dictu.nl minmyndighetspost.se virusfree.cz digid.nl personligalmanacka.se volny.cz duo.nl skatteverket.se bayern.de ezorg.nl theletter.se bund.de gerryweber.nl kadernickyservis.sk dfn.de hr.nl triodos.co.uk elster.de hro.nl govtrack.us fau.de interim-netwerk.nl ru.ac.za freenet.de Of the ~2.3 million domains, 13253 (13780 last month) have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 771 (706 last month). Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1431 (1331 last month). The top 15 name server operators with problem domains are: This Month Last month ---------- ---------- 412 registrar-servers.com 372 axc.nl 385 axc.nl 361 registrar-servers.com 107 movenext.nl 100 movenext.nl 85 ebola.cz 85 ebola.cz 25 tiscomhosting.nl 25 tiscomhosting.nl 25 eatserver.nl 25 eatserver.nl 20 epik.com 24 metaregistrar.nl 18 metaregistrar.nl 18 infracom.nl 18 infracom.nl 15 cloudflare.com 14 cloudflare.com 12 nrdns.nl 12 ns01.nl 11 iterik.nu 12 nrdns.nl 11 epik.com 11 sylconia.net 10 sylconia.net 11 iterik.nu 10 mobi-net.ch 10 mobi-net.ch 9 openprovider.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Seven of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt1.jus.br trtrj.jus.br accenturealumni.com bncr.fi.cr ofda.gov mobily.com.sa sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2020-09
by Viktor Dukhovni 01 Oct '20

01 Oct '20

Summary: The DANE domain count is now 2,303,613 Most of the increase from last month can be credited to argewebhosting.nl (~150k domains). Thank you argewebhosting.nl. On a smaller scale, but also notable, dfn.de enabled DANE SMTP for their own domain and a number of affiliated research insitutitions (34 domains in all). Thanks also to dnf.de. The number of domains that return DNSSEC-validated replies in response to MX queries is 12,743,720. Thus DANE TLSA is deployed on ~18.07% of domains with DNSSEC. Speaking of stats, you can now qiery the survey's view of your (DNSSEC-signed) via the "Explore" button at: https://stats.dnssec-tools.org/ The site makes no live queries, it shows the status of a domain during the most recent daily survey run. Please be mindful of the upcoming Let's Encrypt Issuer CA switch from X3/X4 to R3/R4 and E1/E2. See: https://mail.sys4.de/pipermail/dane-users/2020-September/thread.html#578 Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 2,303,613 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. This month Last Month ---------- ---------- 1135621 one.com 1143500 one.com 148737 argewebhosting.nl 141329 transip.nl 143441 transip.nl 102015 domeneshop.no 102226 domeneshop.no 90188 loopia.se 90725 loopia.se 85000 infomaniak.ch 87624 infomaniak.ch 64973 forpsi.com 65609 forpsi.com 41646 pcextreme.nl 42657 webreus.nl 41210 webreus.nl 41291 pcextreme.nl 39560 active24.com 39806 active24.com 32959 antagonist.nl 33919 antagonist.nl 30569 vevida.com 30527 vevida.com 28115 zxcs.nl 29222 zxcs.nl 26638 web4u.cz 26601 web4u.cz 25610 udmedia.de 25494 udmedia.de 18038 bhosted.nl 18283 bhosted.nl 14752 flexfilter.nl 14784 flexfilter.nl 14165 onebit.cz 14256 onebit.cz 12197 protonmail.ch 12646 protonmail.ch 7191 zonemx.eu 7678 zonemx.eu 6077 soverin.net The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). This month Last Month ---------- ---------- 7177 TOTAL 6864 TOTAL 2307 DE, Germany 2191 DE, Germany 1435 US, United States 1377 US, United States 1089 NL, Netherlands 1046 NL, Netherlands 596 FR, France 548 FR, France 292 GB, United Kingdom 287 GB, United Kingdom 226 CZ, Czechia 225 CZ, Czechia 161 CA, Canada 163 CA, Canada 107 SG, Singapore 100 SG, Singapore 97 CH, Switzerland 97 CH, Switzerland 94 FI, Finland 90 FI, Finland 89 SE, Sweden 84 SE, Sweden 76 DK, Denmark 71 DK, Denmark 59 AU, Australia 49 AU, Australia 51 AT, Austria 47 AT, Austria 45 IE, Ireland 43 IE, Ireland 37 RU, Russia 36 BR, Brazil 36 BR, Brazil 33 PL, Poland 34 PL, Poland 32 RU, Russia 34 JP, Japan 31 JP, Japan 34 IN, India 30 IN, India IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: This Month Last month ---------- ---------- 3659 TOTAL 3593 TOTAL 1520 DE, Germany 1472 DE, Germany 631 US, United States 614 US, United States 574 NL, Netherlands 591 NL, Netherlands 264 FR, France 258 FR, France 135 CZ, Czechia 146 CZ, Czechia 111 GB, United Kingdom 105 GB, United Kingdom 46 CH, Switzerland 48 CH, Switzerland 39 SG, Singapore 40 SG, Singapore 39 CA, Canada 37 CA, Canada 37 SE, Sweden 34 SE, Sweden 36 AT, Austria 26 AT, Austria 20 AU, Australia 21 RU, Russia 19 RU, Russia 19 AU, Australia 19 JP, Japan 17 JP, Japan 16 FI, Finland 15 FI, Finland 15 NO, Norway 14 NO, Norway 15 DK, Denmark 14 IE, Ireland 12 IE, Ireland 13 DK, Denmark 12 BR, Brazil 12 ID, Indonesia 10 PL, Poland 11 BR, Brazil There are 6220 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 9296. These cover 10309 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 395 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 193 are in recent (last 90 days of) reports: univie.ac.at gmx.de interconnect.nl gmx.at jpberlin.de interim-netwerk.nl triodos.be kabelmail.de keessmit.nl clubedohardware.com.br lrz.de mailplus.nl nic.br mail.de markteffectmail.nl registro.br mailserver4.de minbzk.nl gmx.ch mensa.de mindef.nl hostpoint.ch mpg.de mkbbelangen.nl infomaniak.ch posteo.de mm1.nl open.ch ruhr-uni-bochum.de ns.nl protonmail.ch tum.de ouderportaal.nl switch.ch uni-erlangen.de overheid.nl altospam.com uni-muenchen.de parlement.nl clubedominante.com unitybox.de pathe.nl coosto.com unitymedia.de politie.nl fmc-na.com web.de positievepsychologiecongres.nl gmx.com westlotto.de previder.nl habr.com dk-hostmaster.dk rijksoverheid.nl hotelsinduitsland.com egmontpublishing.dk ru.nl infomaniak.com netic.dk rvo.nl ingthink.com star.dk sans-mail.nl joomlapolis.com stil.dk schoudercom.nl kpn.com uni-c.dk schuurman-schoenen.nl leszexpertsfle.com tilburguniversity.edu sportfondsen.nl mail.com emta.ee sportrusten.nl mammoetmail.com rmit.ee ssonet.nl mx-relay.com rediris.es triodos.nl one.com triodos.es truetickets.nl ppcpcv.com uv.es tweedekamer.nl pre-sustainability.com zone.eu uitgeverijpica.nl protonmail.com zonevs.eu uvt.nl protonvpn.com ac-strasbourg.fr wise-guys.nl societe.com compagnie-des-sens.fr xs4all.nl solvinity.com fidesz.hu zorgmail.nl t-2.com idrinks.hu domeneshop.no telfort.com mszp.hu handelsbanken.no thalesgroup.com comcast.net uib.no triodos.com gmx.net atelkamera.nu vitstore.com habramail.net goget.nu xfinity.com hr-manager.net debian.org xfinityhomesecurity.com inexio.net freebsd.org xfinitymobile.com mpssec.net gentoo.org active24.cz procurios.net ietf.org akce-incomputer.cz ripe.net isc.org atlas.cz riseup.net mailbox.org centrum.cz t-2.net mailop.org cuni.cz transip.net netbsd.org itesco.cz xs4all.net openssl.org klenotyaurum.cz xworks.net ozlabs.org klubpevnehozdravi.cz amsterdam.nl samba.org krypton.cz awcloud.nl torproject.org onebit.cz belastingdienst.nl whatpulse.org optimail.cz bhosted.nl asf.com.pt poptavej.cz bluerail.nl boplatssyd-automail.se reserved.cz boozyshop.nl handelsbanken.se smtp.cz burgernet.nl loopia.se vas-server.cz corpoflow.nl minmyndighetspost.se virusfree.cz dictu.nl personligalmanacka.se volny.cz duo.nl skatteverket.se bayern.de ezorg.nl theletter.se bund.de gerryweber.nl kadernickyservis.sk dfn.de herinneringenoplinnen.nl triodos.co.uk elster.de hr.nl govtrack.us fau.de hro.nl ru.ac.za freenet.de Of the ~2.3 million domains, 13780 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 706. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1331. The top 15 name server operators with problem domains are: This Month Last month ---------- ---------- 372 axc.nl 374 axc.nl 361 registrar-servers.com 344 registrar-servers.com 100 movenext.nl 86 ebola.cz 85 ebola.cz 66 movenext.nl 25 tiscomhosting.nl 27 tiscomhosting.nl 25 eatserver.nl 22 eatserver.nl 24 metaregistrar.nl 20 metaregistrar.nl 18 infracom.nl 20 infracom.nl 15 cloudflare.com 15 nrdns.nl 12 nrdns.nl 15 cloudflare.com 11 iterik.nu 11 sylconia.net 11 epik.com 11 iterik.nu 10 sylconia.net 11 is.nl 10 mobi-net.ch 10 openprovider.nl 9 openprovider.nl 10 mobi-net.ch If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Seven of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt1.jus.br trtrj.jus.br accenturealumni.com bncr.fi.cr ofda.gov mobily.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Pilot phase for DNSSEC/DANE for DFN with dfnsec.de in August 2020
by Paul Menzel 25 Sep '20

25 Sep '20

Dear DANE users, I like to inform you, after several years of waiting, the Deutsche Forschungsnetz will finally offer a solution for using their mail support with DNSSEC/DANE [1]. For whatever reason, they do not want to fiddle/test with dfn.de, and, therefore, are going to introduce the new domain dfnsec.de first. The pilot phase is going to be from August 3rd to 31st, and they are introducing faulty entries on Tuesday and Thursday from 10:00 to 14:00. Kind regards, Paul [1]: https://www.mailsupport.dfn.de/dokumentation/komponenten/dns/dnssec/pilotph…

2 3

Re: PLEASE NOTE: Upcoming changes in Let's Encrypt issuer certificates
by Viktor Dukhovni 25 Sep '20

25 Sep '20

On Mon, Sep 21, 2020 at 03:50:32AM -0400, Viktor Dukhovni wrote: > Therefore the full list of DANE-TA(2) digests to publish (when relying > on these rather than "3 1 1" records) is: > > ; (These can be retired soon, but not just yet) > ; > ; letsencryptauthorityx3.pem > ; letsencryptauthorityx4.pem > ; > _25._tcp.smtp.example.org. IN TLSA 2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517616E8A18 > _25._tcp.smtp.example.org. IN TLSA 2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E02CF362B > > ; (May not be needed if your leaf cert is RSA, ECDSA certs > ; will I expect be soon signed with one of these). > ; > ; lets-encrypt-e1.pem > ; lets-encrypt-e2.pem > ; > _25._tcp.smtp.example.org. IN TLSA 2 1 1 276FE8A8C4EC7611565BF9FCE6DCACE9BE320C1B5BEA27596B2204071ED04F10 > _25._tcp.smtp.example.org. IN TLSA 2 1 1 BD936E72B212EF6F773102C6B77D38F94297322EFC25396BC3279422E0C89270 > > ; (May not be needed if your leaf cert is ECDSA, once > ; ECDSA certificate issuance cuts over to e1/e2). > ; > ; lets-encrypt-r3.pem > ; lets-encrypt-r4.pem It seems I failed to paste in the "r3/r4" hashes (which of course you should not take only from my messages, but check against a trusted source). That said, the missing hashes are: _25._tcp.smtp.example.com. IN TLSA 2 1 1 8D02536C887482BC34FF54E41D2BA659BF85B341A0A20AFADB5813DCFBCF286D _25._tcp.smtp.example.com. IN TLSA 2 1 1 E5545E211347241891C554A03934CDE9B749664A59D26D615FE58F77990F2D03 On Thu, Sep 24, 2020 at 11:48:23PM +0200, Björn Jacke wrote: > your follow up mail on this topic is a bit confusing because you quote > the two *upcoming* E1/E2 cert hashes but the 2 *current* X3/X4 and not > the also the *upcoming* R3/R4 hashes here. Thanks for noticing. In case you want all the values, here's the bit of PostgreSQL I use to count usage of these in DANE survey TLSA records, this finds the hashes for all the combinations of selector (Cert(0) and SPKI(1)) and hashed matching type (SHA2-256(1) and SHA2-512(2)): WITH le(n, issuer, s, m, ihash) as ( VALUES ( 1, 'X3', 1, 1, '\x60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517616E8A18' :: bytea), ( 1, 'X3', 1, 2, '\x774FAD8C9A6AFC2BDB44FABA8390D213AE592FB0D56C5DFAB152284E334D7CD6ABD05799236E7AA6266EDF81907C60404C57EE54C10A3A82FCC2A9146629B140' ), ( 1, 'X3', 0, 1, '\x731D3D9CFAA061487A1D71445A42F67DF0AFCA2A6C2D2F98FF7B3CE112B1F568' ), ( 1, 'X3', 0, 2, '\x5EC5B0783C6E667E0965DF772943A06326768DE0F75DC0BD2FE378F02CCCA7D56C987656174CBE158CC29ECD763F8BDA3454332CC7D47FB934691409C5FB8686' ), ( 2, 'X4', 1, 1, '\xB111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E02CF362B' ), ( 2, 'X4', 1, 2, '\xA0F5D1333BC90BCEA0B0B5F401160B6E7F28A1256BC5B5D65F04B06B0BB0C96270AA81D8E2726394D385BF3E9EE46EB4AB7548C782D5688CC16D0CDFFEFB8594' ), ( 2, 'X4', 0, 1, '\x5DE9152BED31FA0515DD1FC746133F1327562EF72A84CF2D2403E748A604D0D4' ), ( 2, 'X4', 0, 2, '\x74DDAD9F8CDFA0FE6F6B70301B557A63A58B87FC2C17FAE0F65E47D141226C062A74FA14861DC47A720BD8699B99091A06BD695CDDE51222F837B9DECFC270C5' ), ( 3, 'R3', 1, 1, '\x8D02536C887482BC34FF54E41D2BA659BF85B341A0A20AFADB5813DCFBCF286D' ), ( 3, 'R3', 1, 2, '\x0F644C9A1DCB8C04BE6B385A60DBE4FDF7E2B81E335C9AD8C7CD0ABE2FF9E7E5BBFBB68B38DD0216F17808F48BDF6AF8C6347659C1F41A9858032C31F436D12C' ), ( 3, 'R3', 0, 1, '\x67ADD1166B020AE61B8F5FC96813C04C2AA589960796865572A3C7E737613DFD' ), ( 3, 'R3', 0, 2, '\x96C5793B2B57D8DF5891C94015720960E0DA4C2CF8CE1FC5707A0B46E5DB8CE3761FB5FDB430F619D1579F13E80FBDD973EF6A024129ED039AA193273158FCAD' ), ( 4, 'R4', 1, 1, '\xE5545E211347241891C554A03934CDE9B749664A59D26D615FE58F77990F2D03' ), ( 4, 'R4', 1, 2, '\x59A91D97D81980951D0EF3C6D849B31606AF9AB2B0F7DCFAC93A53AE3263EB8902C3B7C564F33FF496F2D07C750B1B6924968C243882AF9E3532797EEF596F27' ), ( 4, 'R4', 0, 1, '\x1A07529A8B3F01D231DFAD2ABDF71899200BB65CD7E03C59FA82272533355B74' ), ( 4, 'R4', 0, 2, '\x0F0B4DD77EE99D8ED5724DA618B56017D08B757884796D087BF656E62D2717B5C913CB1E2EDA07AACBFDBFDCB1BA5BA52114D54C000E05B0CB755256A61C0C37' ), ( 5, 'E1', 1, 1, '\x276FE8A8C4EC7611565BF9FCE6DCACE9BE320C1B5BEA27596B2204071ED04F10' ), ( 5, 'E1', 1, 2, '\x3561540FBF182BCE7749ACC131B421E691F083569C053E78F20274714C5E801226FF6EDB60641DDF70E71BD3A90DFE25DDD6464BE78106B77DECE4F6A3BFF13D' ), ( 5, 'E1', 0, 1, '\x46494E30379059DF18BE52124305E606FC59070E5B21076CE113954B60517CDA' ), ( 5, 'E1', 0, 2, '\x0FC8BDB5B93D95BB016BB543BD74B859E4C18930964D59CFC305B93EF3212C0C20F3084BA98FBF7AAC55D0D22C5B35566ED75BEBE6D5A7C53CA1F949C45C3C8E' ), ( 6, 'E2', 1, 1, '\xBD936E72B212EF6F773102C6B77D38F94297322EFC25396BC3279422E0C89270' ), ( 6, 'E2', 1, 2, '\x23A30BD3B617652E97224E1FAF673C4E09F1C197E4994274E676F2490893E9560D99F00A8859E399B2C65219CE2EB9B76784A0EC775AB4973A14FC1437AC7D9F' ), ( 6, 'E2', 0, 1, '\xBACDE0463053CE1D62F8BE74370BBAE79D4FCAF19FC07643AEF195E6A59BD578' ), ( 6, 'E2', 0, 2, '\xE8EC8405AB45605AE6E4A54EFD6D626F663CB7E61A10D9A6A6A08B118E0D35763D0118E263A6DB64516CA9F4E7F64FCD2B5DBF9E7A7BA265870606AF26F4D855' ) ) select count(distinct t.qname) as "#", le.issuer as "CA" from le join tlsa t on t.usage = 2 and t.selector = le.s and t.mtype = le.m and t.data = le.ihash join tlsabase b on b.tbase = t.qname join mx m on m.exch = b.qname group by le.n, le.issuer order by le.n; Updates to add the new hashes are happening more slowly than I'd hoped: # | CA -----+---- 978 | X3 32 | X4 15 | R3 9 | R4 15 | E1 10 | E2 If you're relying on "2 1 1" (or other Let's Encrypt DANE-TA(2)) TLSA records, please make the necessary changes promptly. -- Viktor.

1 0

check_dane and dnspython 2.0.0
by Stephan Seitz 24 Sep '20

24 Sep '20

Hello! I’m using check_dane (https://github.com/debfx/check_dane) together with Debian/testing. Since the upgrade of python3-dnspython to version 2.0.0, I’m getting deprecation warnings: check_dane:105: DeprecationWarning: please use dns.resolver.Resolver.resolve() instead tlsa_records = resolver.query(tlsa_domain, dns.rdatatype.TLSA) I’m afraid I was unable to fix the warning but I don’t realy speak python. So is anyone working on an upgrade? Shade and sweet water! Stephan -- | If your life was a horse, you'd have to shoot it. |

3 3

DANE for Sendmail
by Dennis Baaten 02 Sep '20

02 Sep '20

Initial support for DANE validation has landed in Sendmail: ftp://ftp.sendmail.org/pub/sendmail (or mirror https://ftp.bit.nl/mirror/sendmail/RELEASE_NOTES <https://t.co/fWpwDncaRt?amp=1>). "Only TLSA RR 3-1-x is currently implemented." For other DANE supporting software & services check: https://github.com/baknu/DANE-for-SMTP/wiki/3.-Software-and-service-support Regards, Dennis on behalf of Internet.nl

1 0

Update on stats 2020-08
by Viktor Dukhovni 31 Aug '20

31 Aug '20

Summary: The DANE domain count is now 2,151,862 Most of the increase from last month can be credited to forpsi.com (~65k domains) and one.com (~109k new domains) Thank you forpsi.com and one.com. Though it is but one domain, it is nice this month to see ripe.net added to the list of domains with DANE TLSA records for their MX hosts. I'm also happy to report that epik.com have resolved all outstanding DNSSEC denial of existence issues, not only for the O(50) domains that had SMTP servers, but also for over 100k domains that did not yet, but might some day. It would be great to see more of the long-term resident DoE "sinners" make amends. The number of domains that return DNSSEC-validated replies in response to MX queries is 12,443,641. Thus DANE TLSA is deployed on ~17.29% of domains with DNSSEC. It might have been higher than 12.5 million, but for a delay in the .NL data feed this month, that is expected instead in early September. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 2,151,862 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1143500 one.com 141329 transip.nl 102015 domeneshop.no 90188 loopia.se 85000 infomaniak.ch 64973 forpsi.com 41646 pcextreme.nl 41210 webreus.nl 39560 active24.com 32959 antagonist.nl 30569 vevida.com 28115 zxcs.nl 26638 web4u.cz 25610 udmedia.de 18038 bhosted.nl 14752 flexfilter.nl 14165 onebit.cz 12197 protonmail.ch 7191 zonemx.eu 6077 soverin.net The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6864 TOTAL 2191 DE, Germany 1377 US, United States 1046 NL, Netherlands 548 FR, France 287 GB, United Kingdom 225 CZ, Czechia 163 CA, Canada 100 SG, Singapore 97 CH, Switzerland 90 FI, Finland 84 SE, Sweden 71 DK, Denmark 49 AU, Australia 47 AT, Austria 43 IE, Ireland 36 BR, Brazil 33 PL, Poland 32 RU, Russia 31 JP, Japan 30 IN, India IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3593 TOTAL 1472 DE, Germany 614 US, United States 591 NL, Netherlands 258 FR, France 146 CZ, Czechia 105 GB, United Kingdom 48 CH, Switzerland 40 SG, Singapore 37 CA, Canada 34 SE, Sweden 26 AT, Austria 21 RU, Russia 19 AU, Australia 17 JP, Japan 15 FI, Finland 14 NO, Norway 14 IE, Ireland 13 DK, Denmark 12 ID, Indonesia 11 BR, Brazil There are 6056 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 9058. These cover 10054 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 372 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 183 are in recent (last 90 days of) reports: univie.ac.at freenet.de keessmit.nl gmx.at gmx.de mailplus.nl triodos.be jpberlin.de markteffectmail.nl clubedohardware.com.br kabelmail.de minbzk.nl nic.br lrz.de mindef.nl registro.br mail.de mkbbelangen.nl gmx.ch mailserver4.de mm1.nl hostpoint.ch posteo.de ouderportaal.nl infomaniak.ch ruhr-uni-bochum.de overheid.nl open.ch tum.de parlement.nl protonmail.ch uni-erlangen.de pathe.nl switch.ch uni-muenchen.de politie.nl clubedominante.com unitybox.de previder.nl coosto.com unitymedia.de professioneelbegeleiden.nl fmc-na.com web.de rijksoverheid.nl gmx.com westlotto.de rotterdam.nl habr.com egmontpublishing.dk ru.nl hotelsinduitsland.com netic.dk rvo.nl infomaniak.com star.dk schoudercom.nl ingthink.com stil.dk schuurman-schoenen.nl kpn.com uni-c.dk ssonet.nl leszexpertsfle.com tilburguniversity.edu triodos.nl mail.com emta.ee truetickets.nl mailzerver.com rmit.ee tweedekamer.nl mammoetmail.com rediris.es uitgeverijpica.nl mx-relay.com triodos.es utwente.nl one.com uv.es uvt.nl pre-sustainability.com zone.eu wise-guys.nl protonmail.com zonevs.eu xs4all.nl protonvpn.com ac-strasbourg.fr zorgmail.nl societe.com compagnie-des-sens.fr domeneshop.no solvinity.com fidesz.hu handelsbanken.no t-2.com idrinks.hu uib.no telfort.com mszp.hu webcruitermail.no thalesgroup.com comcast.net atelkamera.nu triodos.com gmx.net goget.nu vitstore.com habramail.net aegee.org xfinity.com hr-manager.net debian.org xfinityhomesecurity.com inexio.net freebsd.org xfinitymobile.com mpssec.net gentoo.org active24.cz procurios.net ietf.org akce-incomputer.cz ripe.net isc.org atlas.cz riseup.net mailbox.org centrum.cz t-2.net netbsd.org cuni.cz transip.net openssl.org itesco.cz xs4all.net ozlabs.org klenotyaurum.cz xworks.net samba.org klubpevnehozdravi.cz belastingdienst.nl torproject.org krypton.cz bhosted.nl whatpulse.org nic.cz bluerail.nl asf.com.pt onebit.cz boozyshop.nl boplatssyd-automail.se optimail.cz corpoflow.nl handelsbanken.se poptavej.cz dictu.nl loopia.se reserved.cz digid.nl minmyndighetspost.se smtp.cz duo.nl personligalmanacka.se virusfree.cz ezorg.nl skatteverket.se volny.cz gerryweber.nl theletter.se bayern.de herinneringenoplinnen.nl kadernickyservis.sk bund.de hr.nl triodos.co.uk elster.de interconnect.nl govtrack.us fau.de interim-netwerk.nl ru.ac.za Of the ~2.15 million domains, 13702 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 650. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1093. The top 15 name server operators with problem domains are: 374 axc.nl 344 registrar-servers.com 86 ebola.cz 66 movenext.nl 27 tiscomhosting.nl 22 eatserver.nl 20 metaregistrar.nl 20 infracom.nl 15 nrdns.nl 15 cloudflare.com 11 sylconia.net 11 iterik.nu 11 is.nl 10 openprovider.nl 10 mobi-net.ch If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr ofda.gov amsterdam.nl mobily.com.sa sauditelecom.com.sa [2] -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security. [2] https://dnsviz.net/d/sauditelecom.com.sa/X0yQQA/dnssec/ Today the entire sauditelecom.com.sa zone is down, the DS records don't match any zone apex DNSKEY RRs... https://twitter.com/VDukhovni/status/1300313582945669120

1 0

Update on stats 2020-07
by Viktor Dukhovni 02 Aug '20

02 Aug '20

Summary: The DANE domain count is now 1,974,938 Much of the increase from last month is due to ~42k domains hosted by pcextreme.nl. Thank you PCextreme. The number of domains that return DNSSEC-validated replies in response to MX queries is 12,108,902. Thus DANE TLSA is deployed on ~16.30% of domains with DNSSEC. DANE as a percentage of DNSSEC domains is dropping recently, because growth in DNSSEC adoption has started to outpace growth in DANE adoption. This is a good problem to have, deploy even more DNSSEC, please! At this rate, I am anticipating ~13 million signed domains by the end of 2020, but a surprise large-scale deployment would be even better. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,974,938 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1034619 one.com 141535 transip.nl 101743 domeneshop.no 89837 loopia.se 83032 infomaniak.ch 42021 pcextreme.nl 41648 webreus.nl 39437 active24.com 32936 antagonist.nl 30714 vevida.com 28703 zxcs.nl 26693 web4u.cz 25440 udmedia.de 17613 bhosted.nl 14851 flexfilter.nl 14114 onebit.cz 11688 protonmail.ch 6829 zonemx.eu 6035 soverin.net 5773 netzone.ch The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6864 TOTAL 2191 DE, Germany 1377 US, United States 1046 NL, Netherlands 548 FR, France 287 GB, United Kingdom 225 CZ, Czechia 163 CA, Canada 100 SG, Singapore 97 CH, Switzerland 90 FI, Finland 84 SE, Sweden 71 DK, Denmark 49 AU, Australia 47 AT, Austria 43 IE, Ireland 36 BR, Brazil 33 PL, Poland 32 RU, Russia 31 JP, Japan 30 IN, India IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3555 TOTAL 1459 DE, Germany 580 NL, Netherlands 572 US, United States 263 FR, France 127 CZ, Czechia 111 GB, United Kingdom 49 CH, Switzerland 41 RU, Russia 41 CA, Canada 40 SE, Sweden 37 SG, Singapore 25 AT, Austria 19 AU, Australia 16 JP, Japan 16 IE, Ireland 15 DK, Denmark 14 NO, Norway 14 FI, Finland 13 ID, Indonesia 11 BR, Brazil There are 5893 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 8284. These cover 9276 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 356 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 174 are in recent (last 90 days of) reports: ac-strasbourg.fr interim-netwerk.nl ru.ac.za active24.cz isc.org ru.nl aegee.org itesco.cz ruhr-uni-bochum.de atelkamera.nu jpberlin.de rvo.nl atlas.cz kabelmail.de samba.org bayern.de kadernickyservis.sk schoudercom.nl belastingdienst.nl keessmit.nl schuurman-schoenen.nl bhosted.nl klubpevnehozdravi.cz skatteverket.se bluerail.nl kpn.com smtp.cz boekwinkeltjes.nl krypton.cz societe.com boozyshop.nl leszexpertsfle.com solvinity.com boplatssyd-automail.se loopia.se sportfondsen.nl bund.de lrz.de ssonet.nl centrum.cz lugeja.ee star.dk clubedohardware.com.br mail.com stil.dk clubedominante.com mail.de switch.ch comcast.net mailbox.org t-2.com compagnie-des-sens.fr mailplus.nl t-2.net corpoflow.nl mailserver4.de telfort.com cuni.cz mailzerver.com thalesgroup.com debian.org mammoetmail.com theletter.se dictu.nl markteffectmail.nl tilburguniversity.edu digid.nl maximum.nl torproject.org domeneshop.no minbzk.nl transip.net duo.nl mindef.nl triodos.be egmontpublishing.dk minmyndighetspost.se triodos.co.uk elster.de mkbbelangen.nl triodos.com emta.ee mm1.nl triodos.es ezorg.nl mpssec.net triodos.nl fau.de mx-relay.com truetickets.nl fidesz.hu netbsd.org tum.de fmc-na.com netic.dk uib.no freebsd.org nic.br uitgeverijpica.nl freenet.de nic.cz uni-c.dk gentoo.org one.com uni-erlangen.de gerryweber.nl onebit.cz uni-muenchen.de gmx.at open.ch unitybox.de gmx.ch openssl.org unitymedia.de gmx.com optimail.cz univie.ac.at gmx.de ouderportaal.nl utwente.nl gmx.net overheid.nl uv.es goget.nu ozlabs.org uvt.nl govtrack.us pathe.nl virusfree.cz habr.com personligalmanacka.se volny.cz habramail.net politie.nl web.de handelsbanken.no posteo.de webcruitermail.no handelsbanken.se pre-sustainability.com westlotto.de herinneringenoplinnen.nl previder.nl whatpulse.org hostpoint.ch procurios.net xfinity.com hotelsinduitsland.com professioneelbegeleiden.nl xfinityhomesecurity.com hr-manager.net protonmail.ch xfinitymobile.com hr.nl protonmail.com xs4all.net ietf.org rediris.es xs4all.nl inexio.net registro.br xworks.net infomaniak.ch rijksoverheid.nl zaantheater.nl infomaniak.com riseup.net zone.eu ingthink.com rmit.ee zonevs.eu interconnect.nl rotterdam.nl zorgmail.nl Of the ~1.97 million domains, 13448 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 602. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1093. The top 15 name server operators with problem domains are: 367 axc.nl 350 registrar-servers.com 86 ebola.cz 64 movenext.nl 34 epik.com 28 tiscomhosting.nl 24 metaregistrar.nl 22 nrdns.nl 22 infracom.nl 22 eatserver.nl 11 sylconia.net 11 iterik.nu 11 icosnethosting.com 10 openprovider.nl 10 is.nl [ The situation with epik.com is more worrisome than it looks, while only 34 domains have SMTP servers affected by incorrect TLSA record denial of existence, in fact well over 100k domains exhibit the same symptoms, but presently don't receive email. Given the pervasive failure to provision complete NSEC chains for domains with zone-apex wildcard records, I expect this will get worse, before it gets better. My correspondence with Epik support has not yet reached someone who is able to understand and solve the problem. Essentially the same issue of missing NSEC for the zone-apex wildcard is plaguing axc.nl. Perhaps it is too easy for PowerDNS users to get this wrong. Don't know what can be done to help them correct their provisioning practices. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Six of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr mobily.com.sa sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2020-06
by Viktor Dukhovni 01 Jul '20

01 Jul '20

Summary: The DANE domain count is now 1,929,893 The number of domains that return DNSSEC-validated replies in response to MX queries is 11,728,469. Thus DANE TLSA is deployed on ~16.45% of domains with DNSSEC. DANE as a percentage of DNSSEC domains is dropping recently, because growth in DNSSEC adoption has started to outpace growth in DANE adoption. This is a good problem to have, deploy even more DNSSEC, please! At this rate, I am anticipating ~13 million signed domains by the end of 2020, but a surprise large-scale deployment would be even better. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,929,893 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1038314 one.com 140578 transip.nl 101181 domeneshop.no 89447 loopia.se 80663 infomaniak.ch 41035 webreus.nl 39255 active24.com 32282 antagonist.nl 30793 vevida.com 28642 zxcs.nl 26840 web4u.cz 25353 udmedia.de 17599 bhosted.nl 15003 flexfilter.nl 14114 onebit.cz 11144 protonmail.ch 6432 zonemx.eu 5926 soverin.net 5790 netzone.ch 5590 previder.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6728 TOTAL 2147 DE, Germany 1336 US, United States 1008 NL, Netherlands 576 FR, France 283 GB, United Kingdom 226 CZ, Czechia 153 CA, Canada 102 SG, Singapore 93 CH, Switzerland 84 FI, Finland 82 SE, Sweden 70 DK, Denmark 51 AU, Australia 48 AT, Austria 42 IE, Ireland 35 BR, Brazil 32 IN, India 30 JP, Japan 28 RU, Russia 26 PL, Poland IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3458 TOTAL 1426 DE, Germany 565 US, United States 521 NL, Netherlands 274 FR, France 125 CZ, Czechia 105 GB, United Kingdom 46 RU, Russia 42 CH, Switzerland 40 SG, Singapore 40 CA, Canada 36 SE, Sweden 32 AT, Austria 20 AU, Australia 16 JP, Japan 16 IE, Ireland 14 NO, Norway 14 DK, Denmark 13 ID, Indonesia 12 FI, Finland 11 BR, Brazil There are 5760 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 8056. These cover 9041 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 353 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 172 are in recent (last 90 days of) reports: univie.ac.at jpberlin.de maximum.nl gmx.at kabelmail.de minbzk.nl triodos.be lrz.de mindef.nl clubedohardware.com.br mail.de mkbbelangen.nl nic.br mailserver4.de mm1.nl registro.br posteo.de ouderportaal.nl gmx.ch ruhr-uni-bochum.de overheid.nl hostpoint.ch tu-chemnitz.de pathe.nl infomaniak.ch tum.de politie.nl open.ch uni-erlangen.de previder.nl protonmail.ch uni-muenchen.de professioneelbegeleiden.n switch.ch unitybox.de rijksoverheid.nl clubedominante.com unitymedia.de rotterdam.nl coosto.com web.de ru.nl fmc-na.com westlotto.de rvo.nl gmx.com egmontpublishing.dk schoudercom.nl habr.com netic.dk schuurman-schoenen.nl hotelsinduitsland.com star.dk sportfondsen.nl infomaniak.com lugeja.ee ssonet.nl ingthink.com rediris.es triodos.nl kpn.com triodos.es truetickets.nl leszexpertsfle.com uv.es uitgeverijpica.nl mail.com litebit.eu utwente.nl mailzerver.com zone.eu xs4all.nl mammoetmail.com zonevs.eu zaantheater.nl mx-relay.com ac-strasbourg.fr zorgmail.nl one.com compagnie-des-sens.fr domeneshop.no pre-sustainability.com fidesz.hu handelsbanken.no primexbt.com comcast.net uib.no protonmail.com dns-oarc.net webcruitermail.no societe.com gmx.net atelkamera.nu solvinity.com habramail.net goget.nu t-2.com hr-manager.net aegee.org telfort.com inexio.net debian.org thalesgroup.com mpssec.net freebsd.org triodos.com procurios.net gentoo.org xfinity.com riseup.net ietf.org xfinityhomesecurity.com t-2.net isc.org xfinitymobile.com transip.net lazarus-ide.org active24.cz xs4all.net mailbox.org atlas.cz xworks.net netbsd.org centrum.cz belastingdienst.nl openssl.org cuni.cz bhosted.nl ozlabs.org itesco.cz bluerail.nl samba.org klubpevnehozdravi.cz boekwinkeltjes.nl torproject.org krypton.cz boozyshop.nl whatpulse.org nic.cz corpoflow.nl boplatssyd-automail.se onebit.cz dictu.nl handelsbanken.se optimail.cz digid.nl loopia.se smtp.cz duo.nl minmyndighetspost.se virusfree.cz ezorg.nl personligalmanacka.se volny.cz gerryweber.nl skatteverket.se bayern.de herinneringenoplinnen.nl theletter.se bund.de hr.nl kadernickyservis.sk elster.de interconnect.nl triodos.co.uk fau.de keessmit.nl govtrack.us freenet.de mailplus.nl ru.ac.za gmx.de Of the ~1.93 million domains, 5387 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 806. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1093. The top 16 name server operators with problem domains are: 379 registrar-servers.com - NameCheap, no ETA... :-( 366 axc.nl - Usually fixed promptly, not this month 86 ebola.cz 71 movenext.nl 36 cdmon.net 31 flevohost.nl 29 tiscomhosting.nl 28 hostnet.nl 24 nrdns.nl 23 eatserver.nl 22 metaregistrar.nl 22 infracom.nl 20 epik.com 17 vandersalm-it.nl 15 is.nl 12 sylconia.net If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr mobily.com.sa sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0