- dane-users - list.sys4.de

dane.sys4.de
by A. Schulze 24 Jun '20

24 Jun '20

Hello, first, thanks for the service! second my question: is there an API that allow me easier integration in automated monitoring? Andreas

2 1

Update on stats 2020-05
by Viktor Dukhovni 01 Jun '20

01 Jun '20

Summary: The DANE domain count is now 1,915,922. The number of domains that return DNSSEC-validated replies in response to MX queries is 11,527,814. Thus DANE TLSA is deployed on ~16.61% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,915,922 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1037280 one.com 139399 transip.nl 100897 domeneshop.no 89161 loopia.se 78214 infomaniak.ch 38950 active24.com 35233 webreus.nl 31605 antagonist.nl 30879 vevida.com 28311 zxcs.nl 26922 web4u.cz 25215 udmedia.de 17576 bhosted.nl 14932 flexfilter.nl 14026 onebit.cz 10759 protonmail.ch 6048 zonemx.eu 5785 netzone.ch 5780 soverin.net 5580 previder.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6637 TOTAL 2140 DE, Germany 1312 US, United States 991 NL, Netherlands 563 FR, France 273 GB, United Kingdom 225 CZ, Czechia 156 CA, Canada 96 SG, Singapore 88 CH, Switzerland 80 SE, Sweden 77 FI, Finland 68 DK, Denmark 54 AU, Australia 46 AT, Austria 45 IE, Ireland 35 BR, Brazil 34 IN, India 30 RU, Russia 30 PL, Poland 27 JP, Japan IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3386 TOTAL 1407 DE, Germany 545 US, United States 518 NL, Netherlands 263 FR, France 120 CZ, Czechia 108 GB, United Kingdom 42 CA, Canada 41 CH, Switzerland 39 SG, Singapore 35 SE, Sweden 31 RU, Russia 31 AT, Austria 19 IE, Ireland 19 AU, Australia 16 JP, Japan 15 DK, Denmark 12 NO, Norway 12 ID, Indonesia 12 FI, Finland 11 BR, Brazil There are 5649 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 7879. These cover 8848 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of DANE domains that at some point were listed in Gmail's email transparency report is 353 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 184 are in recent (last 90 days of) reports: univie.ac.at lrz.de keessmit.nl gmx.at mail.de kingsquare.nl triodos.be mailserver4.de mailplus.nl nic.br mensa.de minbzk.nl registro.br posteo.de mindef.nl gmx.ch ruhr-uni-bochum.de mkbbelangen.nl hostpoint.ch tu-chemnitz.de mm1.nl infomaniak.ch tum.de ouderportaal.nl open.ch uni-erlangen.de overheid.nl protonmail.ch uni-muenchen.de pathe.nl switch.ch unitybox.de politie.nl clubedominante.com unitymedia.de previder.nl comeseetv.com web.de professioneelbegeleiden.n coosto.com westlotto.de rijksoverheid.nl fmc-na.com dk-hostmaster.dk rotterdam.nl gmx.com egmontpublishing.dk ru.nl habr.com netic.dk rvo.nl hotelsinduitsland.com star.dk schoudercom.nl infomaniak.com stil.dk schuurman-schoenen.nl ingthink.com uni-c.dk sportfondsen.nl kpn.com tilburguniversity.edu ssonet.nl leszexpertsfle.com emta.ee triodos.nl mail.com lugeja.ee truetickets.nl mailzerver.com rmit.ee uitgeverijpica.nl mammoetmail.com rediris.es utwente.nl mx-relay.com triodos.es uvt.nl one.com uv.es xs4all.nl orverkiezing.com litebit.eu zaantheater.nl pre-sustainability.com zone.eu zorgmail.nl primexbt.com zonevs.eu domeneshop.no protonmail.com ac-strasbourg.fr handelsbanken.no societe.com compagnie-des-sens.fr uib.no solvinity.com fidesz.hu webcruitermail.no t-2.com comcast.net atelkamera.nu telfort.com dns-oarc.net goget.nu thalesgroup.com gmx.net aegee.org trashmail.com habramail.net debian.org triodos.com hr-manager.net freebsd.org xfinity.com inexio.net gentoo.org xfinityhomesecurity.com mpssec.net ietf.org xfinitymobile.com procurios.net isc.org active24.cz riseup.net lazarus-ide.org atlas.cz t-2.net mailbox.org centrum.cz transip.net netbsd.org cuni.cz xs4all.net openssl.org itesco.cz xworks.net ozlabs.org klubpevnehozdravi.cz belastingdienst.nl samba.org krypton.cz bhosted.nl torproject.org nic.cz bluerail.nl whatpulse.org onebit.cz boekwinkeltjes.nl asf.com.pt optimail.cz boozyshop.nl boplatssyd-automail.se smtp.cz corpoflow.nl handelsbanken.se virusfree.cz dictu.nl loopia.se volny.cz digid.nl minmyndighetspost.se bayern.de duo.nl personligalmanacka.se bund.de ezorg.nl skatteverket.se elster.de gerryweber.nl theletter.se fau.de herinneringenoplinnen.nl kadernickyservis.sk freenet.de hierinloggen.nl triodos.co.uk gmx.de hr.nl govtrack.us jpberlin.de intermax.nl ru.ac.za kabelmail.de Of the ~1.92 million domains, 5001 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 528. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1093. The top 13 name server operators with problem domains are: 344 registrar-servers.com 81 ebola.cz 72 movenext.nl 38 cdmon.net 33 flevohost.nl 30 tiscomhosting.nl 28 hostnet.nl 23 nrdns.nl 22 infracom.nl 19 metaregistrar.nl 18 eatserver.nl 17 epik.com 16 is.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr mobily.com.sa sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

RFC7672 2.2.2 "Secure CNAME" considered harmful?
by Rich Felker 22 May '20

22 May '20

I've been reading RFC7672, in particular the part about TLSA lookup for the "Secure CNAME" case. Not only can I not find a legitimate reason to attempt to obtain a TLSA record for the fully-resolved CNAME first; further, I've come up with a very plausible scenario where it's actively harmful and allows an untrusted party to seize control of the service. Consider a service hosted on dynamic IP address. One way to do this without needing one's own dynamic DNS infrastructure is with CNAMES. If one owns example.com, one can make foo.example.com a CNAME pointing to a hostname on an existing dynamic DNS provider, e.g. example.dyn.com. Traditionally, prior to DNSSEC and DANE, this would have allowed dyn.com to hijack the service by redirecting the A record for example.dyn.com. However, if example.com is authenticated by DNSSEC and has a TLSA record pinning a particular key for foo.example.com, one would expect this hijacking no longer to be possible -- if dyn.com redirected example.dyn.com, they would not have the private key matching the TLSA record, and could not hijack any traffic from clients performing DANE validation. However, RFC7672 section 2.2.2 specifically overrides this expectation for SMTP, and mandates that, if dyn.com is also authenticated, clients attempt to obtain a TLSA record for example.dyn.com and give it precedence over the one for foo.example.com. This reopens the possibility of hijacking, and seems outright wrong. I believe it can be mitigated by someone aware of the problem, with a dummy intermediate insecure zone: foo.example.com CNAME foo.dummy-insecure.example.com foo.dummy-insecure.example.com CNAME example.dyn.com where dummy-insecure.example.com is a zone that's intentionally left unsigned, to break the chain of authenticated data. But it seems unrealistic to expect people to know to do this, and error-prone since subtly non-conforming clients may misinterpret the broken chain of authenticated data as foo.example.com being insecure and not subject to DANE at all. Can anything be done about this? Is there a reason for the existence of the "Secure CNAME" case that needs to be preserved, or is this something that could be pushed for deprecation?

2 3

Update on stats 2020-04
by Viktor Dukhovni 01 May '20

01 May '20

News: 1. The most significant development this month is from Google managed DNS. Since early April they appear to be signing all newly registered domains in a number of TLDs, including the top 3 most popular gTLDs: .com, .org and .net. This amounts to ~10k domains per day, and has led to significantly faster growth in the DNS domain counts for the affected TLDs. As a result the number of DNSSEC tracked by the DANE survey is now over 11.2 million. Some graphs showing the change: https://stats.dnssec-tools.org/tld-graphs/com.png https://stats.dnssec-tools.org/tld-graphs/org.png https://stats.dnssec-tools.org/tld-graphs/net.png https://stats.dnssec-tools.org/tld-graphs/info.png https://stats.dnssec-tools.org/tld-graphs/biz.png and perhaps most dramatically: https://stats.dnssec-tools.org/tld-graphs/page.png https://stats.dnssec-tools.org/tld-graphs/ca.png Congratulations and thanks to Google. 2. Also thanks to mijnhostingpartner.nl (a.k.a. mijnpartnergroep.nl) for resolving all outstanding DNSSEC denial of existence issues. Together with partial progress at registrar-servers.com the problem domain count is down ~50%. In short, much good news on the DNSSEC front this month. Summary: The DANE domain count is now 1,882,215 The number of domains that return DNSSEC-validated replies in response to MX queries is 11,181,237. Thus DANE TLSA is deployed on ~16.83% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,882,215 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1028955 one.com 137999 transip.nl 100755 domeneshop.no 88978 loopia.se 74971 infomaniak.ch 38612 active24.com 31256 antagonist.nl 30954 vevida.com 28148 zxcs.nl 26886 web4u.cz 25101 udmedia.de 24999 webreus.nl 17442 bhosted.nl 15059 flexfilter.nl 13889 onebit.cz 10334 protonmail.ch 5791 netzone.ch 5632 soverin.net 5610 previder.nl 5435 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6520 TOTAL 2142 DE, Germany 1306 US, United States 955 NL, Netherlands 567 FR, France 267 GB, United Kingdom 226 CZ, Czechia 150 CA, Canada 89 SG, Singapore 89 CH, Switzerland 81 SE, Sweden 70 DK, Denmark 47 IE, Ireland 46 AU, Australia 45 AT, Austria 32 IN, India 31 BR, Brazil 28 RU, Russia 28 FI, Finland 27 PL, Poland 26 JP, Japan IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3298 TOTAL 1366 DE, Germany 557 US, United States 490 NL, Netherlands 261 FR, France 115 CZ, Czechia 105 GB, United Kingdom 43 SE, Sweden 40 CA, Canada 39 CH, Switzerland 35 SG, Singapore 29 AT, Austria 22 RU, Russia 16 DK, Denmark 15 JP, Japan 15 ID, Indonesia 15 AU, Australia 13 NO, Norway 11 IE, Ireland 11 FI, Finland 11 BR, Brazil There are 5532 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 7682. These cover 8602 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 341 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 174 are in recent (last 90 days of) reports: 12gobiking.nl ingthink.com ru.nl ac-strasbourg.fr intermax.nl ruhr-uni-bochum.de active24.cz isc.org rvo.nl aegee.org itesco.cz samba.org asf.com.pt jpberlin.de schoudercom.nl atelkamera.nu kabelmail.de schuurman-schoenen.nl atlas.cz kadernickyservis.sk skatteverket.se bayern.de kingsquare.nl smtp.cz belastingdienst.nl klubpevnehozdravi.cz societe.com bhosted.nl kpn.com solvinity.com bluerail.nl krypton.cz ssonet.nl boekwinkeltjes.nl lazarus-ide.org star.dk boozyshop.nl leszexpertsfle.com stil.dk boplatssyd-automail.se litebit.eu t-2.com bund.de loopia.se t-2.net centrum.cz lrz.de telfort.com clubedominante.com lugeja.ee thalesgroup.com comcast.net mail.com theletter.se comeseetv.com mail.de tilburguniversity.edu compagnie-des-sens.fr mailbox.org torproject.org coosto.com mailplus.nl transip.net corpoflow.nl mailserver4.de trashmail.com cuni.cz mammoetmail.com triodos.be debian.org mensa.de triodos.co.uk dictu.nl minbzk.nl triodos.com digid.nl mindef.nl triodos.es dk-hostmaster.dk minmyndighetspost.se triodos.nl dns-oarc.net mkbbelangen.nl truetickets.nl domeneshop.no mm1.nl tu-chemnitz.de egmontpublishing.dk mpssec.net tum.de elster.de netbsd.org uib.no emta.ee netic.dk uitgeverijpica.nl ezorg.nl nic.br uni-c.dk fau.de one.com uni-erlangen.de fmc-na.com onebit.cz uni-muenchen.de freebsd.org open.ch unitybox.de freenet.de openssl.org unitymedia.de gentoo.org optimail.cz univie.ac.at gerryweber.nl orverkiezing.com utwente.nl gmx.at ouderportaal.nl uv.es gmx.ch overheid.nl uvt.nl gmx.com ozlabs.org virusfree.cz gmx.de pathe.nl volny.cz gmx.net personligalmanacka.se web.de goget.nu politie.nl web200.eu govtrack.us posteo.de web200.hu habr.com previder.nl webcruitermail.no habramail.net primexbt.com westlotto.de handelsbanken.no procurios.net whatpulse.org handelsbanken.se protonmail.ch xfinity.com hierinloggen.nl protonmail.com xfinityhomesecurity.com hostpoint.ch rediris.es xfinitymobile.com hotelsinduitsland.com registro.br xs4all.net hr-manager.net rijksoverheid.nl xs4all.nl ietf.org riseup.net xworks.net inexio.net rmit.ee zone.eu infomaniak.ch rotterdam.nl zonevs.eu infomaniak.com ru.ac.za zorgmail.nl Of the ~1.88 million domains, 4562 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 590. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1128. The top 13 name server operators with problem domains are: 316 registrar-servers.com (significant reduction from last month) 72 movenext.nl 70 ebola.cz 69 axc.nl 43 cdmon.net 33 flevohost.nl 30 tiscomhosting.nl 28 hostnet.nl 22 infracom.nl 20 nrdns.nl 18 is.nl 16 metaregistrar.nl 14 eatserver.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Nine of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr ofda.gov[2] mobily.com.sa sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security. [2] For ofda.gov, TLSA lookups return truncated answers over UDP when the EDNS buffer size is < 1555 bytes (e.g. to try and avoid UDP fragmentation). But the nameservers don't support TCP, so queries timeout unless the EDNS buffer size is sufficiently large.

1 0

Upcoming Glibc changes and DANE support in Postfix, Exim, and perhaps other MTAs
by Viktor Dukhovni 15 Apr '20

15 Apr '20

On Tue, Apr 14, 2020 at 05:59:51PM -0400, Viktor Dukhovni wrote: > but if that is incompatible with other stub resolver libraries on the > same machine, you may need a private musl-specific configuration file. > > My money is on this being unnecessary. I'll let [you] know what I find > from dns-operations, and if possible perhaps a RIPE ATLAS probe, > assuming they support enabling AD=1. Apparently sufficiently recent glibc supports soliciting and censoring the AD-bit. https://gnutoolchain-gerrit.osci.io/r/c/glibc/+/461/3/NEWS * The DNS stub resolver will optionally send the AD (authenticated data) bit in queries if the trust-ad option is set via the options directive in /etc/resolv.conf (or if RES_TRUSTAD is set in _res.options). In this mode, the AD bit, as provided by the name server, is available to applications which call res_search and related functions. In the default mode, the AD bit is not set in queries, and it is automatically cleared in responses, indicating a lack of DNSSEC validation. (Therefore, the name servers and the network path to them are treated as untrusted.) I read this to mean that the new "trust-ad" option, if set, causes the glibc stub resolver to set AD=1 in queries, but otherwise, causes it to strip the AD bit from replies. I don't yet have access to systems with this recent a glibc to confirm the above, but this is likely relevant to Postfix and Exim administrators who enable DANE. You may need to explicitly add the "trust-ad" option to your /etc/resolv.conf, while of course also making sure that all the listed nameservers are local (loopback interface). -- Viktor.

1 0

ANN: Support of DANE and DNSSEC in Office 365 Exchange Online
by Patrick Ben Koetter 07 Apr '20

07 Apr '20

All, I'm extremely pleased to post that Microsoft has announced today they will support DANE <https://techcommunity.microsoft.com/t5/exchange-team-blog/support-of-dane-a…> and DNSSEC in Office 365 Exchange Online. Their first step will be to support outbound DANE by end of 2020 and they plan to add inbound support for DANE by end of 2021. Please note that they will also implement support for TLSRPT <https://tools.ietf.org/html/rfc8460>, which is a good thing[tm] if you run strict TLS policies for your email platform. Well done, Microsoft! It's great to see a big player step forward, adopt DANE and make email more secure. p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 2

Deprecating DNSSEC algorithms 5 (RSASHA1) and 7 (RSASHA1-NSEC3-SHA1)
by Viktor Dukhovni 06 Apr '20

06 Apr '20

Given the recent advances in SHA-1 collision attacks, https://www.dns.cam.ac.uk/news/2020-01-09-sha-mbles.html https://sha-mbles.github.io/ it is time to deprecate the remaining DNSSEC SHA-1 based DNSKEY algorithms. If you've deployed inbound DANE by publishing signed TLSA records for your MX hosts, but your underlying DNSSEC deployment uses DNSKEY algorithms other than 13 (recommended), 8 (popular) or 10 (fine, though not widely used), then you should migrate your domains to algorithm 13 (preferred) or 8. This should be done while the attacks are still costly, and have somewhat limited applicability. Algorithms 5 (RSASHA1) and 7 (RSASHA1-NSEC3-SHA1) may not be quite dead, but they are significantly wounded. If/when you do decide to switch algorithms, please perform the migration with care. Algorithm rollovers can be tricky. The basic process is: 1. Publish and activate a ZSK for the new algorithm. Your zone should now be double-signed, which each record having two RRSIGs. Don't forget to bump the SOA. 2. Wait for at least 2 maximum TTLs after the primary and all secondary nameservers have started serving the updated zone. 3. Publish and activate a KSK for the new algorithm. This KSK adds a second signature to your zone apex DNSKEY RRset. Don't forget to bump the SOA. 4. Wait for at least 2 maximum TTLs after the primary and all secondary nameservers have started serving the updated zone. 5. Arrange for the parent zone to publish DS records matching the new KSK in addition to DS RRs matching the KSKs for the previous algorithm. 6. Wait for at least 2 parent zone TTLs after all nameservers for the parent zone have started serving the new DS RRset. 7. Request deletion of the DS RRs for the old algorithm. 8. Wait for at least 2 parent zone TTLs after all nameservers for the parent zone have starting serving the new DS RRset. 9. Remove the old KSKs from your DNSKEY RRset after checking that the DS RRset with just the new algorithm matches your new KSK. 10. Wait for at least 2 maximum TTLs after the primary and all secondary nameservers have started serving the updated zone. 11. Deactivate the old ZSKs leaving the zone signed only under the new ZSKs. 12. Wait for at least 2 maximum TTLs after the primary and all secondary nameservers have started serving the updated zone. 13. Remove the old ZSKs from your DNSKEY RRset. The reason for all this is to maintain the followin invariants: A. Each algorithm mentioned in the parent zone DS RRset must have a matching KSK in the zone's DNSKEY RRset. B. Each KSK algorithm appearing in the zone's DNSKEY RRset must have a corresponding ZSK signature for each record in the zone. Therefore, new algorithms are introduced from the ZSK up, while old algorithms are removed from the DS RRset down. The various "wait" steps are needed to ensure that resolvers using cached data are able to validate your changing zone at all times. Presently, the DANE survey database shows ~230 thousand domains using algorithms 5 and 7. It would be great to see this number substantially reduced over the coming months. -- Viktor.

5 8

Update on stats 2020-03
by Viktor Dukhovni 01 Apr '20

01 Apr '20

Summary: The DANE domain count is now 1,877,704. The number of domains that return DNSSEC-validated replies in response to MX queries is 10,922,412. Thus DANE TLSA is deployed on ~17.19% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,877,704 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1035802 one.com 136509 transip.nl 100753 domeneshop.no 88719 loopia.se 71404 infomaniak.ch 38325 active24.com 31059 vevida.com 30605 antagonist.nl 27536 webreus.nl 26933 web4u.cz 26278 zxcs.nl 24969 udmedia.de 17444 bhosted.nl 15192 flexfilter.nl 13854 onebit.cz 9816 protonmail.ch 5810 netzone.ch 5631 previder.nl 5477 soverin.net 4872 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6347 TOTAL 2111 DE, Germany 1273 US, United States 919 NL, Netherlands 540 FR, France 261 GB, United Kingdom 215 CZ, Czechia 154 CA, Canada 87 CH, Switzerland 82 SG, Singapore 79 SE, Sweden 71 DK, Denmark 47 IE, Ireland 45 AU, Australia 41 AT, Austria 32 JP, Japan 28 IN, India 28 BR, Brazil 27 PL, Poland 25 RU, Russia 24 FI, Finland IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3247 TOTAL 1324 DE, Germany 559 US, United States 467 NL, Netherlands 270 FR, France 124 CZ, Czechia 99 GB, United Kingdom 39 SE, Sweden 39 CH, Switzerland 39 CA, Canada 35 SG, Singapore 25 RU, Russia 24 AT, Austria 20 IE, Ireland 16 ID, Indonesia 16 DK, Denmark 15 AU, Australia 14 NO, Norway 14 JP, Japan 11 FI, Finland 11 BR, Brazil There are 5361 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 8115. These cover 9040 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 334 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 160 are in recent (last 90 days of) reports: univie.ac.at lrz.de hierinloggen.nl gmx.at mail.de intermax.nl nic.br mailserver4.de kingsquare.nl registro.br mensa.de mailplus.nl gmx.ch posteo.de minbzk.nl hostpoint.ch ruhr-uni-bochum.de mindef.nl infomaniak.ch tum.de mm1.nl open.ch uni-erlangen.de ouderportaal.nl protonmail.ch unitybox.de overheid.nl anubisnetworks.com unitymedia.de pathe.nl clubedominante.com web.de politie.nl comeseetv.com westlotto.de previder.nl fmc-na.com dk-hostmaster.dk rijksoverheid.nl frenchtogether.com egmontpublishing.dk rotterdam.nl gmx.com netic.dk ru.nl habr.com star.dk rvo.nl hotelsinduitsland.com stil.dk schoudercom.nl infomaniak.com uni-c.dk schuurman-schoenen.nl ingthink.com tilburguniversity.edu ssonet.nl kpn.com emta.ee truetickets.nl leszexpertsfle.com lugeja.ee uvt.nl mail.com rmit.ee xs4all.nl mammoetmail.com rediris.es zorgmail.nl one.com uv.es domeneshop.no primexbt.com litebit.eu handelsbanken.no protonmail.com web200.eu uib.no solvinity.com zone.eu webcruitermail.no t-2.com ac-strasbourg.fr atelkamera.nu telfort.com compagnie-des-sens.fr goget.nu thalesgroup.com octopuce.fr aegee.org trashmail.com web200.hu debian.org xfinity.com comcast.net freebsd.org xfinityhomesecurity.com dns-oarc.net gentoo.org xfinitymobile.com gmx.net ietf.org active24.cz habramail.net isc.org atlas.cz hr-manager.net mailbox.org centrum.cz inexio.net netbsd.org cuni.cz mpssec.net openssl.org itesco.cz procurios.net ozlabs.org klubpevnehozdravi.cz riseup.net samba.org krypton.cz t-2.net slackbuilds.org onebit.cz transip.net torproject.org optimail.cz xs4all.net whatpulse.org smtp.cz xworks.net asf.com.pt virusfree.cz belastingdienst.nl boplatssyd-automail.se volny.cz bhosted.nl handelsbanken.se bayern.de bluerail.nl loopia.se bund.de boozyshop.nl minmyndighetspost.se elster.de corpoflow.nl personligalmanacka.se fau.de dictu.nl skatteverket.se freenet.de digid.nl theletter.se gmx.de ezorg.nl govtrack.us jpberlin.de gerryweber.nl ru.ac.za kabelmail.de Of the ~1.88 million domains, 4504 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 465. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 2050. The top 13 name server operators with problem domains are: 616 mijnhostingpartner.nl (fix expected any day now, but may be delayed) 559 registrar-servers.com (a.k.a. Neustar, continuing to grow slowly) 71 ebola.cz 70 movenext.nl 47 metaregistrar.nl 44 axc.nl 43 cdmon.net 37 hyp.net 34 flevohost.nl 30 tiscomhosting.nl 28 hostnet.nl 22 infracom.nl 18 is.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eleven of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br flytoyourheart.com topdecorationworld.com bncr.fi.cr mobily.com.sa sauditelecom.com.sa threadteaching.co.uk -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2020-02
by Viktor Dukhovni 01 Mar '20

01 Mar '20

Summary: The DANE domain count is now 1,842,179. The number of domains that return DNSSEC-validated replies in response to MX queries is 10,837,476. Thus DANE TLSA is deployed on ~17.00% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,842,179 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1039151 one.com 135237 transip.nl 100341 domeneshop.no 88535 loopia.se 68917 infomaniak.ch 37835 active24.com 31227 vevida.com 30345 antagonist.nl 26692 web4u.cz 24813 udmedia.de 22509 zxcs.nl 17374 bhosted.nl 15308 flexfilter.nl 13690 onebit.cz 9518 protonmail.ch 5814 netzone.ch 5575 previder.nl 5163 soverin.net 4756 mailplatform.eu 4321 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6251 TOTAL 2084 DE, Germany 1246 US, United States 896 NL, Netherlands 549 FR, France 256 GB, United Kingdom 201 CZ, Czechia 153 CA, Canada 85 CH, Switzerland 83 SG, Singapore 78 SE, Sweden 69 DK, Denmark 46 AT, Austria 44 IE, Ireland 43 JP, Japan 39 AU, Australia 31 BR, Brazil 27 RU, Russia 26 PL, Poland 25 IT, Italy 23 IN, India IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3176 TOTAL 1311 DE, Germany 531 US, United States 453 NL, Netherlands 263 FR, France 112 CZ, Czechia 98 GB, United Kingdom 41 SE, Sweden 35 SG, Singapore 34 AT, Austria 33 CH, Switzerland 32 JP, Japan 32 CA, Canada 31 RU, Russia 17 IE, Ireland 16 DK, Denmark 14 SI, Slovenia 13 NO, Norway 13 AU, Australia 12 ID, Indonesia 12 BR, Brazil There are 5296 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 8054. These cover 8964 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 322 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 155 are in recent (last 90 days of) reports: univie.ac.at jpberlin.de minbzk.nl gmx.at kabelmail.de mindef.nl register.bg lrz.de mm1.nl nic.br mail.de ouderportaal.nl registro.br mailserver4.de overheid.nl buymyweedonline.ca posteo.de pathe.nl gmx.ch ruhr-uni-bochum.de photofacts.nl infomaniak.ch tum.de politie.nl open.ch uni-erlangen.de previder.nl protonmail.ch uni-muenchen.de rijksoverheid.nl anubisnetworks.com unitybox.de ru.nl clubedominante.com unitymedia.de rvo.nl fmc-na.com web.de schoudercom.nl gmx.com egmontpublishing.dk schuurman-schoenen.nl habr.com netic.dk ssonet.nl hotelsinduitsland.com star.dk truetickets.nl infomaniak.com tilburguniversity.edu uvt.nl ingthink.com emta.ee xs4all.nl kpn.com lugeja.ee zorgmail.nl leszexpertsfle.com rmit.ee domeneshop.no mail.com rediris.es handelsbanken.no mammoetmail.com uv.es uib.no one.com web200.eu webcruitermail.no primexbt.com zone.eu atelkamera.nu protonmail.com ac-strasbourg.fr goget.nu solvinity.com compagnie-des-sens.fr aegee.org t-2.com octopuce.fr debian.org telfort.com web200.hu freebsd.org trashmail.com comcast.net gentoo.org vitstore.com dns-oarc.net ietf.org xfinity.com gmx.net isc.org xfinityhomesecurity.com habramail.net lazarus-ide.org xfinitymobile.com hr-manager.net mailbox.org active24.cz inexio.net netbsd.org atlas.cz mpssec.net openssl.org centrum.cz procurios.net ozlabs.org cuni.cz riseup.net samba.org itesco.cz t-2.net slackbuilds.org klubpevnehozdravi.cz transip.net torproject.org krypton.cz vevida.net whatpulse.org onebit.cz xs4all.net asf.com.pt optimail.cz xworks.net moikrug.ru smtp.cz belastingdienst.nl boplatssyd-automail.se virusfree.cz bhosted.nl handelsbanken.se volny.cz bluerail.nl loopia.se web4u.cz boozyshop.nl minmyndighetspost.se bayern.de corpoflow.nl personligalmanacka.se bund.de dictu.nl skatteverket.se elster.de digid.nl theletter.se fau.de intermax.nl govtrack.us freenet.de jasperalblas.nl ru.ac.za gmx.de mailplus.nl Of the ~1.84 million domains, 4424 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 466. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1846. The top 13 name server operators with problem domains are: 482 registrar-servers.com (count still growing slowly) 348 mijnhostingpartner.nl (operator expects a fix "before long") 275 axc.nl (new this month :-( ) 82 egensajt.se 64 movenext.nl 56 ebola.cz 46 metaregistrar.nl 30 tiscomhosting.nl 27 hostnet.nl 23 infracom.nl 22 cdmon.net 20 sylconia.net 17 is.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Nine (same as last month) of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br flytoyourheart.com topdecorationworld.com mobily.com.sa sauditelecom.com.sa threadteaching.co.uk -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2020-01
by Viktor Dukhovni 01 Feb '20

01 Feb '20

Summary: The DANE domain count is now 1,815,489. The number of domains that return DNSSEC-validated replies in response to MX queries is 10,778,108. Thus DANE TLSA is deployed on ~16.84% of domains with DNSSEC. This month I'd like to welcome infomaniak.ch to the list of top 20 DANE SMTP hosting providers. They're now in 5th place with >66k domains. Also, domeneshop.no, one of the earliest entries on the list, have crossed 100k entries for the first time this month. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,815,489 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below. 1021399 one.com 134322 transip.nl 100062 domeneshop.no 88088 loopia.se 66415 infomaniak.ch 37617 active24.com 31413 vevida.com 30081 antagonist.nl 26687 web4u.cz 24682 udmedia.de 19815 zxcs.nl 17317 bhosted.nl 15387 flexfilter.nl 13560 onebit.cz 9169 protonmail.ch 5854 netzone.ch 5583 previder.nl 4860 soverin.net 4741 mailplatform.eu 3771 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6099 TOTAL 2042 DE, Germany 1218 US, United States 910 NL, Netherlands 486 FR, France 238 GB, United Kingdom 202 CZ, Czechia 128 CA, Canada 82 CH, Switzerland 76 SE, Sweden 72 SG, Singapore 67 DK, Denmark 51 FI, Finland 46 AT, Austria 45 IE, Ireland 42 JP, Japan 40 AU, Australia 34 PL, Poland 28 BR, Brazil 27 RU, Russia 22 NO, Norway IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3133 TOTAL 1287 DE, Germany 534 US, United States 470 NL, Netherlands 266 FR, France 106 CZ, Czechia 99 GB, United Kingdom 45 SE, Sweden 33 AT, Austria 31 SG, Singapore 31 CA, Canada 30 JP, Japan 29 CH, Switzerland 18 RU, Russia 16 IE, Ireland 16 DK, Denmark 14 SI, Slovenia 13 NO, Norway 13 AU, Australia 12 BR, Brazil 9 FI, Finland There are 5122 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP. The number of published MX host TLSA RRsets found is 7866. These cover 8799 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 310 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 155 are in recent (last 90 days of) reports: univie.ac.at jpberlin.de jasperalblas.nl gmx.at lrz.de mailplus.nl register.bg mail.de minbzk.nl nic.br posteo.de mindef.nl registro.br ruhr-uni-bochum.de mm1.nl buymyweedonline.ca tum.de ouderportaal.nl gmx.ch uni-erlangen.de overheid.nl open.ch uni-muenchen.de pathe.nl protonmail.ch unitybox.de photofacts.nl anubisnetworks.com unitymedia.de photofactsacademy.nl clubedominante.com web.de politie.nl gmx.com egmontpublishing.dk previder.nl habr.com netic.dk rijksoverheid.nl hotelsinduitsland.com star.dk ru.nl ingthink.com tilburguniversity.edu rvo.nl kpn.com rediris.es schoudercom.nl mail.com uv.es schuurman-schoenen.nl mammoetmail.com komfortkasse.eu ssonet.nl one.com web200.eu truetickets.nl primexbt.com zone.eu uvt.nl protonmail.com ac-strasbourg.fr xs4all.nl societe.com kangouroukids.fr domeneshop.no solvinity.com octopuce.fr handelsbanken.no t-2.com web200.hu uib.no telfort.com comcast.net webcruitermail.no trashmail.com dns-oarc.net atelkamera.nu xfinity.com gmx.net debian.org xfinityhomesecurity.com habramail.net freebsd.org xfinitymobile.com hr-manager.net gentoo.org active24.cz inexio.net ietf.org atlas.cz mpssec.net isc.org centrum.cz procurios.net lazarus-ide.org cuni.cz riseup.net mailbox.org itesco.cz t-2.net netbsd.org klubpevnehozdravi.cz transip.net openssl.org krypton.cz vevida.net ozlabs.org onebit.cz xs4all.net samba.org optimail.cz belastingdienst.nl torproject.org server4u.cz bhosted.nl whatpulse.org smtp.cz billybird.nl moikrug.ru virusfree.cz bluerail.nl boplatssyd-automail.se volny.cz boozyshop.nl handelsbanken.se web4u.cz corpoflow.nl loopia.se bayern.de denhaag.nl minmyndighetspost.se bund.de dictu.nl personligalmanacka.se elster.de digid.nl skatteverket.se fau.de ezorg.nl theletter.se freenet.de fontys.nl govtrack.us gmx.de intermax.nl ru.ac.za Of the ~1.82 million domains, 4167 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 414. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP… https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1642. The top 13 name server operators with problem domains are: 425 registrar-servers.com 304 mijnhostingpartner.nl (varies between 200 and 500+) 96 egensajt.se 66 eurodns.com 64 2is.nl 63 movenext.nl 50 ebola.cz 45 metaregistrar.nl 31 tiscomhosting.nl 27 hostnet.nl 25 infracom.nl 22 cdmon.net 20 sylconia.net If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br flytoyourheart.com topdecorationworld.com mobily.com.sa sauditelecom.com.sa threadteaching.co.uk -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0