- dane-users - list.sys4.de

Update on stats 2019-12
by Viktor Dukhovni 01 Jan '20

01 Jan '20

Summary: The DANE domain count is now 1,734,012. The number of domains that return DNSSEC-validated replies in response to MX queries is 10,715,677. This is another large increase over last month when the total was 10,448,578. Thus DANE TLSA is deployed on ~16.18% of domains with DNSSEC. Also adoption of ECDSA P-256 (algorithm 13) continues to grow, and the number of domains using P-256 KSKs has now surpassed RSA-SHA256 (algorithm 8) to become the most widely used DNSSEC algorithm. See: https://stats.dnssec-tools.org/#parameter Happy New Year! Great progress over the past twelve months, Last year's December totals were 774,820 DANE SMTP domains and 8,878,369 DNSSEC-signed domains.] Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,734,012 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 1019882 one.com 132965 transip.nl 99844 domeneshop.no 88024 loopia.se 37425 active24.com 31555 vevida.com 29476 antagonist.nl 26738 web4u.cz 24646 udmedia.de 18342 zxcs.nl 17227 bhosted.nl 15468 flexfilter.nl 13505 onebit.cz 8765 protonmail.ch 5886 netzone.ch 5632 previder.nl 4707 mailplatform.eu 4116 soverin.net 3548 ips.nl 3239 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6015 TOTAL 1998 DE, Germany 1209 US, United States 892 NL, Netherlands 480 FR, France 229 GB, United Kingdom 194 CZ, Czechia 128 CA, Canada 82 CH, Switzerland 79 SG, Singapore 74 SE, Sweden 67 DK, Denmark 54 FI, Finland 46 IE, Ireland 45 AT, Austria 38 PL, Poland 38 JP, Japan 38 AU, Australia 30 RU, Russia 26 BR, Brazil 24 IT, Italy IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3103 TOTAL 1275 DE, Germany 540 US, United States 463 NL, Netherlands 261 FR, France 105 CZ, Czechia 90 GB, United Kingdom 41 SE, Sweden 33 SG, Singapore 30 CH, Switzerland 28 JP, Japan 28 CA, Canada 24 AT, Austria 18 IE, Ireland 17 RU, Russia 15 DK, Denmark 14 SI, Slovenia 13 NO, Norway 13 ID, Indonesia 12 FI, Finland 12 BR, Brazil There are 5053 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 7743. These cover 8629 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 297 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 147 are in recent (last 90 days of) reports: univie.ac.at jpberlin.de jasperalblas.nl gmx.at lrz.de mailplus.nl register.bg mail.de minbzk.nl nic.br posteo.de mindef.nl registro.br ruhr-uni-bochum.de mm1.nl buymyweedonline.ca tum.de ouderportaal.nl gmx.ch uni-erlangen.de overheid.nl open.ch uni-muenchen.de pathe.nl protonmail.ch unitybox.de photofacts.nl anubisnetworks.com unitymedia.de photofactsacademy.nl clubedominante.com web.de politie.nl gmx.com egmontpublishing.dk previder.nl habr.com netic.dk rijksoverheid.nl hotelsinduitsland.com star.dk ru.nl ingthink.com tilburguniversity.edu rvo.nl kpn.com rediris.es schoudercom.nl mail.com uv.es schuurman-schoenen.nl mammoetmail.com komfortkasse.eu ssonet.nl one.com web200.eu truetickets.nl primexbt.com zone.eu uvt.nl protonmail.com ac-strasbourg.fr xs4all.nl societe.com kangouroukids.fr domeneshop.no solvinity.com octopuce.fr handelsbanken.no t-2.com web200.hu uib.no telfort.com comcast.net webcruitermail.no trashmail.com dns-oarc.net atelkamera.nu xfinity.com gmx.net debian.org xfinityhomesecurity.com habramail.net freebsd.org xfinitymobile.com hr-manager.net gentoo.org active24.cz inexio.net ietf.org atlas.cz mpssec.net isc.org centrum.cz procurios.net lazarus-ide.org cuni.cz riseup.net mailbox.org itesco.cz t-2.net netbsd.org klubpevnehozdravi.cz transip.net openssl.org krypton.cz vevida.net ozlabs.org onebit.cz xs4all.net samba.org optimail.cz belastingdienst.nl torproject.org server4u.cz bhosted.nl whatpulse.org smtp.cz billybird.nl moikrug.ru virusfree.cz bluerail.nl boplatssyd-automail.se volny.cz boozyshop.nl handelsbanken.se web4u.cz corpoflow.nl loopia.se bayern.de denhaag.nl minmyndighetspost.se bund.de dictu.nl personligalmanacka.se elster.de digid.nl skatteverket.se fau.de ezorg.nl theletter.se freenet.de fontys.nl govtrack.us gmx.de intermax.nl ru.ac.za Of the ~1.73 million domains, 3382 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 426. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1372. The top 11 name server operators with problem domains are: 347 registrar-servers.com (new this month, fix expected in days) 221 mijnhostingpartner.nl (varies between 200 and 500+) 95 egensajt.se 62 movenext.nl 59 eurodns.com 47 metaregistrar.nl 32 tiscomhosting.nl 29 nrdns.nl 26 hostnet.nl 24 ebola.cz 20 sylconia.net If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Nine of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br flytoyourheart.com topdecorationworld.com mobily.com.sa sauditelecom.com.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Multiple Let's Encrypt X3 issuer certificates (same public key)
by Viktor Dukhovni 07 Dec '19

07 Dec '19

I'm seeing in active use two distinct issuer certificates for the Let's Encrypt Authority X3 CA: Issuer CommonName = DST Root CA X3 Issuer Organization = Digital Signature Trust Co. notBefore = 2016-03-17T16:40:46Z notAfter = 2021-03-17T16:40:46Z Subject CommonName = Let's Encrypt Authority X3 Subject Organization = Let's Encrypt pkey sha256: 2 1 1 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 Issuer CommonName = ISRG Root X1 Issuer Organization = Internet Security Research Group notBefore = 2016-10-06T15:43:55Z notAfter = 2021-10-06T15:43:55Z Subject CommonName = Let's Encrypt Authority X3 Subject Organization = Let's Encrypt pkey sha256: 2 1 1 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 While they share the same public key, and therefore the same matching "2 1 1" TLSA record, they unsurprisingly don't have the same full certificate "2 0 1" fingerprint. This is a good opportunity to remind users that you should not pin the "2 0 1" or "2 0 2" fingerprints for any public CAs (including Let's Encrypt) in your TLSA records. If you don't control the CA, it is too easy to be surprised by an unexpected change in the issuer certificate (new root, updated expiry, ...). While of course the CA can and sometimes will employ a new public key, key changes are less frequent, and it is more prudent to use "2 1 1" rather than "2 0 1" records (when not just using "3 X X" records). https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-… If you've not yet seen: https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources please do look over the materials there. In particular, implement *monitoring* for your server TLSA records making sure these match the certificate chain, and employ a resilient rollover scheme. If you're one of the brave users with certificates for multiple algorithms (say both RSA and ECDSA), make sure your TLSA records match the chains for both algorithms. -- Viktor.

1 0

Update on stats 2019-11
by Viktor Dukhovni 02 Dec '19

02 Dec '19

Summary: The DANE domain count is now 1,714,271. This is a substantial increase over last month, despite the data feeds from SIDN (.NL) and Farsight Security (passive DNS across all TLDs) not being ready in time for this month-end summary. The count will likely rise again, once those data sets are processed. The number of domains that return DNSSEC-validated replies in response to MX queries is 10,448,578. This is a large increase over last month when the total was 10,133,312. Thus DANE TLSA is deployed on ~16.41% of domains with DNSSEC. This month the DANE domain count for one.com is larger than one million. Congratulations and thanks again to one.com! Also adoption of ECDSA P-256 (algorithm 13) continues to grow, and the number of domains using P-256 KSKs has almost reached parity with RSA-SHA256 (algorithm 8), which is just ahead for now, but likely not for very much longer. https://stats.dnssec-tools.org/#parameter Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,714,271 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 1,013,231 one.com 130,768 transip.nl 98,944 domeneshop.no 88,010 loopia.se 37,102 active24.com 31,595 vevida.com 28,681 antagonist.nl 26,461 web4u.cz 24,373 udmedia.de 17,099 bhosted.nl 16,414 zxcs.nl 15,480 flexfilter.nl 13,341 onebit.cz 8,283 protonmail.ch 5,982 netzone.ch 5,567 previder.nl 4,658 mailplatform.eu 3,563 ips.nl 3,187 interconnect.nl 2,852 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 5862 TOTAL 1964 DE, Germany 1166 US, United States 852 NL, Netherlands 461 FR, France 229 GB, United Kingdom 189 CZ, Czechia 118 CA, Canada 96 SG, Singapore 81 CH, Switzerland 77 SE, Sweden 64 DK, Denmark 58 FI, Finland 46 IE, Ireland 41 AT, Austria 40 AU, Australia 39 JP, Japan 38 PL, Poland 28 RU, Russia 28 BR, Brazil 24 IT, Italy IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 3009 TOTAL 1248 DE, Germany 503 US, United States 434 NL, Netherlands 247 FR, France 112 CZ, Czechia 89 GB, United Kingdom 39 SE, Sweden 36 SG, Singapore 31 CH, Switzerland 30 RU, Russia 29 JP, Japan 26 CA, Canada 21 AT, Austria 19 IE, Ireland 14 SI, Slovenia 14 DK, Denmark 13 NO, Norway 12 ID, Indonesia 12 BR, Brazil 11 FI, Finland There are 4918 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 7570. These cover 8456 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 293 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 148 are in recent (last 90 days of) reports: univie.ac.at lrz.de minbzk.nl gmx.at mail.de mm1.nl nic.br posteo.de ouderportaal.nl registro.br ruhr-uni-bochum.de overheid.nl buymyweedonline.ca tum.de parlement.nl gmx.ch uni-erlangen.de pathe.nl open.ch uni-muenchen.de photofacts.nl protonmail.ch unitybox.de photofactsacademy.nl altospam.com unitymedia.de politie.nl anubisnetworks.com web.de previder.nl clubedominante.com egmontpublishing.dk rijksoverheid.nl fmc-na.com netic.dk ru.nl gmx.com star.dk schoudercom.nl habr.com tilburguniversity.edu schuurman-schoenen.nl hotelsinduitsland.com web200.eu ssonet.nl ingthink.com zone.eu truetickets.nl kpn.com ac-strasbourg.fr tweedekamer.nl mail.com kangouroukids.fr uitgeverijpica.nl mammoetmail.com octopuce.fr utwente.nl one.com web200.hu uvt.nl primexbt.com 247superhost.net xs4all.nl protonmail.com comcast.net domeneshop.no societe.com dns-oarc.net handelsbanken.no solvinity.com gmx.net uib.no t-2.com habramail.net webcruitermail.no telfort.com hr-manager.net atelkamera.nu trashmail.com inexio.net debian.org xfinity.com mpssec.net freebsd.org xfinityhomesecurity.com procurios.net gentoo.org xfinitymobile.com riseup.net ietf.org active24.cz t-2.net isc.org atlas.cz transip.net mailbox.org centrum.cz vevida.net netbsd.org cuni.cz xs4all.net openssl.org itesco.cz 50plusbeurs.nl ozlabs.org klubpevnehozdravi.cz belastingdienst.nl samba.org onebit.cz bhosted.nl torproject.org optimail.cz billybird.nl whatpulse.org server4u.cz bluerail.nl moikrug.ru smtp.cz boozyshop.nl boplatssyd-automail.se virusfree.cz corpoflow.nl handelsbanken.se volny.cz denhaag.nl loopia.se web4u.cz digid.nl minmyndighetspost.se bayern.de digistate.nl personligalmanacka.se bund.de ezorg.nl skatteverket.se elster.de fontys.nl theletter.se fau.de hr.nl govtrack.us freenet.de hro.nl ru.ac.za gmx.de intermax.nl jpberlin.de mailplus.nl Of the ~1.71 million domains, 3220 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 462. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1435. The top 10 name server operators with problem domains are: 400 mijnhostingpartner.nl 295 domaincontrol.com (a.k.a. Godaddy, new this month) 89 egensajt.se 53 movenext.nl 43 metaregistrar.nl 33 tiscomhosting.nl 30 eurodns.com 28 nrdns.nl 26 hostnet.nl 19 sylconia.net If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Twelve of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br groupconcorde.com kineticcu.com xoriant.com xpressbillpay.com mobily.com.sa sauditelecom.com.sa bog.gov.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

3 8

DANE blog and how-to
by Dennis Baaten 22 Nov '19

22 Nov '19

Hi all, For those considering DANE or working on implementing DANE: * Learn about the advantages of DANE by reading our newest blog post: https://blog.apnic.net/2019/11/20/better-mail-security-with-dane-for-smtp/ * Check our how-to for tips and tricks on implementing DANE and other mail standards: https://github.com/internetstandards/toolbox-wiki/ Thanks, Dennis -- ir. Dennis Baaten CISSP Security | Privacy | Ethical Hacking +31 (0)6 212 56 959 dennis(a)baaten.com Baaten ICT Security <https://www.baaten.com> https://www.baaten.com KvK: 62077651

1 0

Update on stats 2019-10
by Viktor Dukhovni 01 Nov '19

01 Nov '19

Summary: The DANE domain count is now 1,496,391 A significant portion of this month's domain count increase is a result of one.com signing a large number of .DK domains, 120 thousand and counting. Thank you one.com. The number of domains that return DNSSEC-validated replies in response to MX queries is 10,133,312. Thus DANE TLSA is deployed on ~14.76% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,496,391 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 862263 one.com 131061 transip.nl 98911 domeneshop.no 88102 loopia.se 36969 active24.com 31854 vevida.com 26514 web4u.cz 24392 udmedia.de 17203 bhosted.nl 16582 zxcs.nl 15626 flexfilter.nl 13333 onebit.cz 7765 protonmail.ch 5972 netzone.ch 5608 previder.nl 4683 mailplatform.eu 3623 ips.nl 3202 interconnect.nl 2578 provalue.nl 2321 zonemx.eu The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 5760 TOTAL 1938 DE, Germany 1159 US, United States 834 NL, Netherlands 417 FR, France 236 GB, United Kingdom 190 CZ, Czechia 117 CA, Canada 96 SG, Singapore 80 CH, Switzerland 76 SE, Sweden 58 FI, Finland 58 DK, Denmark 48 AT, Austria 46 IE, Ireland 37 PL, Poland 35 JP, Japan 33 AU, Australia 29 RU, Russia 29 BR, Brazil 24 IT, Italy IPv6 is less common than IPv4 for MX hosts (but improved IPv6 connectivity on my end this month finds more IPv6 DANE MTAs), and the top 20 countries by DANE MX host IPv6 GeoIP are: 2975 TOTAL 1220 DE, Germany 510 US, United States 422 NL, Netherlands 244 FR, France 105 CZ, Czechia 95 GB, United Kingdom 41 SE, Sweden 36 CH, Switzerland 35 SG, Singapore 28 CA, Canada 26 AT, Austria 25 RU, Russia 24 JP, Japan 19 IE, Ireland 16 DK, Denmark 14 SI, Slovenia 13 NO, Norway 12 FI, Finland 12 BR, Brazil 11 ID, Indonesia There are 4865 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 7418. These cover 8194 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 275 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 142 are in recent (last 90 days of) reports: univie.ac.at mensa.de minbzk.nl gmx.at posteo.de mm1.nl nic.br ruhr-uni-bochum.de ouderportaal.nl registro.br tum.de overheid.nl buymyweedonline.ca uni-erlangen.de parlement.nl gmx.ch uni-muenchen.de pathe.nl open.ch unitybox.de photofacts.nl protonmail.ch unitymedia.de photofactsacademy.nl anubisnetworks.com web.de politie.nl fmc-na.com egmontpublishing.dk previder.nl gmx.com netic.dk rijksoverheid.nl habr.com tilburguniversity.edu rvo.nl hotelsinduitsland.com web200.eu schoudercom.nl kpn.com zone.eu schuurman-schoenen.nl mail.com ac-strasbourg.fr ssonet.nl mammoetmail.com octopuce.fr truetickets.nl metafaq.com web200.hu tweedekamer.nl one.com 247superhost.net uitgeverijpica.nl protonmail.com comcast.net utwente.nl solvinity.com dns-oarc.net uvt.nl t-2.com gmx.net xs4all.nl telfort.com habramail.net domeneshop.no trashmail.com hr-manager.net handelsbanken.no xfinity.com inexio.net uib.no xfinityhomesecurity.com mpssec.net webcruitermail.no xfinitymobile.com procurios.net atelkamera.nu active24.cz riseup.net debian.org atlas.cz t-2.net freebsd.org centrum.cz transip.net gentoo.org cuni.cz transversal.net ietf.org klubpevnehozdravi.cz vevida.net isc.org onebit.cz xs4all.net netbsd.org optimail.cz belastingdienst.nl openssl.org smtp.cz bhosted.nl ozlabs.org virusfree.cz billybird.nl samba.org volny.cz bluerail.nl torproject.org web4u.cz boozyshop.nl whatpulse.org allsecur.de corpoflow.nl moikrug.ru bayern.de dictu.nl boplatssyd-automail.se bund.de digid.nl handelsbanken.se elster.de digistate.nl loopia.se fau.de ezorg.nl minmyndighetspost.se freenet.de fontys.nl personligalmanacka.se gmx.de hr.nl skatteverket.se jpberlin.de hro.nl theletter.se lc-srv.de intermax.nl govtrack.us lrz.de kingsquare.nl mail.de mailplus.nl Of the ~1.49 million domains, 3142 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 393. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 988. The top 10 name server operators with problem domains are: 255 mijnhostingpartner.nl 59 egensajt.se 48 movenext.nl 43 metaregistrar.nl 33 tiscomhosting.nl 30 nrdns.nl 29 webscale.co.za 26 hostnet.nl 21 sylconia.net 14 is.nl If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br mobily.com.sa sauditelecom.com.sa bog.gov.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-09
by Viktor Dukhovni 01 Oct '19

01 Oct '19

Summary: The DANE domain count is now 1,334,411 A significant portion of this month's domain count increase is a result of new DANE TLSA records at loopia.se, serving just over 88 thousand domains. Thank you loopia.se. The number of domains that return DNSSEC-validated replies in response to MX queries is 9,997,451. Thus DANE TLSA is deployed on ~13.34% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,334,411 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 741311 one.com 130008 transip.nl 98598 domeneshop.no 88127 loopia.se 36931 active24.com 31978 vevida.com 26891 web4u.cz 24424 udmedia.de 17089 bhosted.nl 15705 zxcs.nl 15680 flexfilter.nl 13349 onebit.cz 7394 protonmail.ch 5978 netzone.ch 5626 previder.nl 4678 mailplatform.eu 3635 ips.nl 3279 interconnect.nl 2578 provalue.nl 2214 nederhost.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6227 TOTAL 1964 DE, Germany 1397 US, United States 879 NL, Netherlands 436 FR, France 284 GB, United Kingdom 187 CZ, Czechia 140 CA, Canada 128 SG, Singapore 75 SE, Sweden 73 CH, Switzerland 58 DK, Denmark 52 JP, Japan 51 FI, Finland 49 IE, Ireland 45 AT, Austria 44 AU, Australia 40 IN, India 36 PL, Poland 32 BR, Brazil 28 RU, Russia IPv6 is less common than IPv4 for MX hosts (but improved IPv6 connectivity on my end this month finds more IPv6 DANE MTAs), and the top 20 countries by DANE MX host IPv6 GeoIP are: 3081 TOTAL 1222 DE, Germany 562 US, United States 425 NL, Netherlands 258 FR, France 110 GB, United Kingdom 105 CZ, Czechia 43 SG, Singapore 41 SE, Sweden 32 CH, Switzerland 30 CA, Canada 27 JP, Japan 25 RU, Russia 25 AT, Austria 19 IE, Ireland 15 DK, Denmark 14 NO, Norway 14 IN, India 13 AU, Australia 12 SI, Slovenia 12 ID, Indonesia There are 4738 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 7241. These cover 7766 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 273 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 142 are in recent (last 90 days of) reports: univie.ac.at mensa.de ouderportaal.nl gmx.at posteo.de overheid.nl nic.br ruhr-uni-bochum.de parlement.nl registro.br tum.de pathe.nl buymyweedonline.ca uni-erlangen.de photofacts.nl gmx.ch unitybox.de photofactsacademy.nl open.ch unitymedia.de politie.nl protonmail.ch web.de previder.nl anubisnetworks.com egmontpublishing.dk rijksoverheid.nl fmc-na.com netic.dk rvo.nl gmx.com tilburguniversity.edu schuurman-schoenen.nl habr.com web200.eu ssonet.nl hotelsinduitsland.com zone.eu transip.nl kpn.com ac-strasbourg.fr truetickets.nl mail.com octopuce.fr tweedekamer.nl mammoetmail.com web200.hu uitgeverijpica.nl metafaq.com 247superhost.net utwente.nl one.com comcast.net uvt.nl protonmail.com dns-oarc.net xs4all.nl societe.com gmx.net domeneshop.no solvinity.com habramail.net handelsbanken.no t-2.com hr-manager.net uib.no telfort.com inexio.net webcruitermail.no trashmail.com mpssec.net atelkamera.nu xfinity.com procurios.net debian.org xfinityhomesecurity.com riseup.net freebsd.org xfinitymobile.com t-2.net gentoo.org active24.cz transip.net ietf.org atlas.cz transversal.net isc.org centrum.cz vevida.net netbsd.org cuni.cz xs4all.net openssl.org klubpevnehozdravi.cz belastingdienst.nl ozlabs.org onebit.cz bhosted.nl samba.org optimail.cz billybird.nl torproject.org smtp.cz bluerail.nl whatpulse.org virusfree.cz boozyshop.nl asf.com.pt volny.cz corpoflow.nl moikrug.ru web4u.cz dictu.nl boplatssyd-automail.se allsecur.de digid.nl handelsbanken.se bayern.de digistate.nl loopia.se bund.de fontys.nl minmyndighetspost.se elster.de hr.nl personligalmanacka.se fau.de hro.nl skatteverket.se freenet.de interconnect.nl theletter.se gmx.de intermax.nl truepos.se jpberlin.de mailplus.nl govtrack.us lrz.de minbzk.nl mail.de mm1.nl Of the ~1.33 million domains, 2884 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 391. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 768. The top 10 name server operators with problem domains are: 164 mijnhostingpartner.nl 49 movenext.nl 41 metaregistrar.nl 33 tiscomhosting.nl 31 nrdns.nl 26 hostnet.nl 21 sylconia.net 15 is.nl 13 interhand.net 12 dnscluster.nl [ The above list no longer includes "gransy.com" where all issues were recently resolved. Thanks! Nine of the ten problem providers are Dutch! More progress by .NL DNS providers would be great. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Ten of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br key.com keybank.com mobily.com.sa sauditelecom.com.sa bog.gov.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-08
by Viktor Dukhovni 03 Sep '19

03 Sep '19

Summary: The DANE domain count is now 1,227,756. The number of domains that return DNSSEC-validated replies in response to MX queries is 9,878,661. Thus DANE TLSA is deployed on ~12.42% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,227,756 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 734903 one.com 127486 transip.nl 98404 domeneshop.no 36596 active24.com 32070 vevida.com 26968 web4u.cz 24317 udmedia.de 16392 bhosted.nl 15667 flexfilter.nl 13799 zxcs.nl 13156 onebit.cz 7109 protonmail.ch 6010 netzone.ch 5620 previder.nl 3664 ips.nl 3298 interconnect.nl 2572 provalue.nl 2225 nederhost.nl 1913 spamcluster.nl 1701 nmugroup.com The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 6089 TOTAL 1917 DE, Germany 1385 US, United States 839 NL, Netherlands 414 FR, France 274 GB, United Kingdom 181 CZ, Czechia 143 CA, Canada 128 SG, Singapore 78 CH, Switzerland 71 SE, Sweden 59 DK, Denmark 51 JP, Japan 49 AT, Austria 48 FI, Finland 45 IE, Ireland 43 AU, Australia 39 PL, Poland 38 IN, India 32 BR, Brazil 28 RU, Russia IPv6 is less common than IPv4 for MX hosts (but improved IPv6 connectivity on my end this month finds more IPv6 DANE MTAs), and the top 20 countries by DANE MX host IPv6 GeoIP are: 3002 TOTAL 1172 DE, Germany 523 US, United States 410 NL, Netherlands 254 FR, France 116 CZ, Czechia 110 GB, United Kingdom 43 SG, Singapore 41 RU, Russia 35 CH, Switzerland 34 SE, Sweden 34 CA, Canada 26 JP, Japan 24 AT, Austria 18 IE, Ireland 15 IN, India 15 DK, Denmark 14 SI, Slovenia 14 AU, Australia 13 NO, Norway 12 ID, Indonesia There are 4654 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 7097. These cover 7555 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 263 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 134 are in recent (last 90 days of) reports: univie.ac.at kabelmail.de intermax.nl gmx.at lrz.de mailplus.nl nic.br mail.de markteffectmail.nl registro.br mensa.de mm1.nl gmx.ch posteo.de ouderportaal.nl open.ch ruhr-uni-bochum.de overheid.nl protonmail.ch tum.de parlement.nl anubisnetworks.com uni-erlangen.de pathe.nl fmc-na.com unitybox.de photofacts.nl gmx.com unitymedia.de politie.nl habr.com web.de previder.nl hotelsinduitsland.com egmontpublishing.dk rvo.nl kpn.com netic.dk transip.nl mail.com tilburguniversity.edu truetickets.nl mammoetmail.com web200.eu tweedekamer.nl metafaq.com zone.eu uitgeverijpica.nl one.com ac-strasbourg.fr utwente.nl protonmail.com octopuce.fr uvt.nl societe.com web200.hu xs4all.nl solvinity.com 247superhost.net domeneshop.no t-2.com comcast.net handelsbanken.no telfort.com dns-oarc.net uib.no trashmail.com gmx.net webcruitermail.no xfinity.com habramail.net atelkamera.nu xfinityhomesecurity.com hr-manager.net aegee.org xfinitymobile.com inexio.net debian.org active24.cz mpssec.net freebsd.org atlas.cz procurios.net gentoo.org centrum.cz riseup.net ietf.org cuni.cz t-2.net isc.org itesco.cz transip.net netbsd.org klubpevnehozdravi.cz transversal.net openssl.org nic.cz vevida.net ozlabs.org onebit.cz xs4all.net samba.org smtp.cz xworks.net torproject.org virusfree.cz belastingdienst.nl whatpulse.org volny.cz bhosted.nl asf.com.pt allsecur.de billybird.nl moikrug.ru bayern.de bluerail.nl boplatssyd-automail.se bund.de boozyshop.nl handelsbanken.se elster.de corpoflow.nl minmyndighetspost.se fau.de dictu.nl personligalmanacka.se freenet.de digid.nl skatteverket.se gmx.de hr.nl govtrack.us jpberlin.de interconnect.nl Of the ~1.23 million domains, 2868 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 537. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1278. The top 10 name server operators with problem domains are: 526 mijnhostingpartner.nl 44 movenext.nl 39 metaregistrar.nl 38 gransy.com 33 tiscomhosting.nl 31 nrdns.nl 26 hostnet.nl 21 sylconia.net 16 serv-ict.net 16 axc.nl [ The above list no longer includes "dotserv.com" where all issues were recently resolved. Thanks! Nine of the ten problem providers are Dutch! It would be great if SIDN could apply some carrot and stick to incent .NL hosting providers to have correctly working DNSSEC implementations. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br mobily.com.sa sauditelecom.com.sa bog.gov.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-07
by Viktor Dukhovni 01 Aug '19

01 Aug '19

Summary: The DANE domain count is now 1,191,805 The number of domains that return DNSSEC-validated replies in response to MX queries is 9,866,733. Thus DANE TLSA is deployed on 12.08% of domains with DNSSEC. [ The total number of tracked signed delegations (DS RRsets) is 10,026,848, but not all the corresponding domains are up and running. ] Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. As of today I count 1,191,805 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 713339 one.com 127741 transip.nl 98672 domeneshop.no 36445 active24.com 32249 vevida.com 27261 web4u.cz 24283 udmedia.de 15760 flexfilter.nl 13854 zxcs.nl 13118 onebit.cz 11226 bhosted.nl 6026 netzone.ch 5662 previder.nl 3704 ips.nl 3304 interconnect.nl 2568 provalue.nl 2261 nederhost.nl 1706 nmugroup.com 1586 yourdomainprovider.net 1295 xcellerate.nl The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 5965 TOTAL 1879 DE, Germany 1367 US, United States 804 NL, Netherlands 408 FR, France 278 GB, United Kingdom 179 CZ, Czechia 136 CA, Canada 127 SG, Singapore 75 CH, Switzerland 72 SE, Sweden 57 DK, Denmark 52 JP, Japan 46 AT, Austria 45 IE, Ireland 43 FI, Finland 43 AU, Australia 36 PL, Poland 36 BR, Brazil 33 IN, India 27 RU, Russia IPv6 is less common than IPv4 for MX hosts (but improved IPv6 connectivity on my end this month finds more IPv6 DANE MTAs), and the top 20 countries by DANE MX host IPv6 GeoIP are: 2941 TOTAL 1146 DE, Germany 528 US, United States 396 NL, Netherlands 251 FR, France 119 CZ, Czechia 111 GB, United Kingdom 41 SG, Singapore 35 CH, Switzerland 34 SE, Sweden 30 RU, Russia 27 CA, Canada 25 JP, Japan 24 AT, Austria 16 IE, Ireland 14 SI, Slovenia 14 NO, Norway 14 AU, Australia 13 DK, Denmark 12 ID, Indonesia 12 BR, Brazil There are 4576 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 6971. These cover 7425 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 255 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 136 are in recent (last 90 days of) reports: univie.ac.at mensa.de mailplus.nl gmx.at posteo.de markteffectmail.nl transip.be ruhr-uni-bochum.de minbzk.nl nic.br tum.de mm1.nl registro.br uni-erlangen.de ouderportaal.nl gmx.ch uni-muenchen.de overheid.nl open.ch unitybox.de pathe.nl anubisnetworks.com unitymedia.de photofacts.nl fmc-na.com web.de politie.nl gmx.com egmontpublishing.dk previder.nl habr.com netic.dk rijksoverheid.nl hotelsinduitsland.com tilburguniversity.edu rotterdam.nl kpn.com web200.eu rvo.nl mail.com zone.eu ssonet.nl one.com ac-strasbourg.fr transip.nl societe.com octopuce.fr truetickets.nl solvinity.com web200.hu utwente.nl t-2.com 247superhost.net uvt.nl telfort.com comcast.net xs4all.nl trashmail.com dns-oarc.net domeneshop.no xfinity.com gmx.net handelsbanken.no xfinityhomesecurity.com habramail.net uib.no xfinitymobile.com hr-manager.net webcruitermail.no active24.cz inexio.net atelkamera.nu atlas.cz mpssec.net aegee.org centrum.cz procurios.net debian.org cuni.cz riseup.net freebsd.org itesco.cz t-2.net gentoo.org klubpevnehozdravi.cz transip.net ietf.org nic.cz transversal.net isc.org onebit.cz vevida.net netbsd.org smtp.cz xs4all.net openssl.org virusfree.cz xworks.net ozlabs.org volny.cz belastingdienst.nl samba.org allsecur.de bhosted.nl torproject.org bayern.de bluerail.nl asf.com.pt bund.de boekwinkeltjes.nl moikrug.ru elster.de boozyshop.nl boplatssyd-automail.se fau.de corpoflow.nl handelsbanken.se freenet.de denhaag.nl minmyndighetspost.se gmx.de dictu.nl personligalmanacka.se jpberlin.de digid.nl skatteverket.se kabelmail.de hr.nl govtrack.us lrz.de interconnect.nl mail.de intermax.nl Of the ~1.19 million domains, 2526 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 501. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1178. The top 10 name server operators with problem domains are: 489 mijnhostingpartner.nl 41 metaregistrar.nl 38 movenext.nl 34 dotserv.com 33 tiscomhosting.nl 31 nrdns.nl 23 domaincontrol.com 22 sylconia.net 14 is.nl 14 interhand.net [ Seven of the ten problem providers are Dutch. It would be great if SIDN could apply some carrot and stick to incent .NL hosting providers to have correctly working DNSSEC implementations. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Ten of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br (Nameservers REFUSE TLSA lookups) trt01.gov.br (Zone mostly unsigned) trtrio.gov.br (Zone mostly unsigned) trt1.jus.br (Zone mostly unsigned) trtrj.jus.br (Zone mostly unsigned) bluehosting.host (NSEC RRs don't cover wildcard) rackeo.host (NSEC RRs don't cover wildcard) mobily.com.sa (firewall blocks TLSA queries) sauditelecom.com.sa (firewall blocks TLSA queries) bog.gov.sa (firewall blocks TLSA queries) -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Update on stats 2019-06
by Viktor Dukhovni 01 Jul '19

01 Jul '19

Summary: The DANE domain count is now 1,185,097 The number of domains that return DNSSEC-validated replies in response to MX queries is 9,810,062. Thus DANE TLSA is deployed on 12.08% of domains with DNSSEC. Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome. Appeal: A handful of providers still have long-term broken DNSSEC denial of existence. It would be really great if (at least): mijnhostingpartner.nl (Much improved, remediation in progress) metaregistrar.nl (Wrong empty non-terminal handling) tiscomhosting.nl (Missing wildcard NSEC for NODATA response) dotserv.com (invalid NSEC chain order) movenext.nl (NSEC replies don't cover wildcard) nrdns.nl (Malformed NSEC3 or ServFail) sylconia.nl (Malformed NSEC3 chain) fixed their nameserver and/or zone provisioning code. While the O(10^3) affected domains are a small fraction of the O(10^7) signed domains, they are a much larger fraction of the signed domains for those particular providers. Appeal: The number of domains with neglected outdated TLSA records, has grown to ~600. PLEASE *monitor* your deployment, and implement a cert/key rollover process that does not (even temporarily) disrupt the validity of your certificate chain as compared to the published (cached) TLSA records: https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources If you're willing and able to help reach out to the operators of MX hosts with misconfigured TLSA RRsets, please get in touch. As of today I count 1,185,097 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are: 710477 one.com 126697 transip.nl 97776 domeneshop.no 36407 active24.com 32344 vevida.com 27345 web4u.cz 24153 udmedia.de 15734 flexfilter.nl 13127 zxcs.nl 13003 onebit.cz 11082 bhosted.nl 6024 netzone.ch 5644 previder.nl 3768 ips.nl 3393 interconnect.nl 2574 provalue.nl 2277 nederhost.nl 1694 nmugroup.com 1573 yourdomainprovider.net 1322 hi7.de The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented). 5347 TOTAL 1782 DE, Germany 1123 US, United States 745 NL, Netherlands 382 FR, France 220 GB, United Kingdom 173 CZ, Czechia 122 CA, Canada 86 SG, Singapore 73 SE, Sweden 72 CH, Switzerland 58 DK, Denmark 43 AT, Austria 41 FI, Finland 40 IE, Ireland 38 PL, Poland 37 BR, Brazil 34 AU, Australia 29 JP, Japan 27 RU, Russia 20 IT, Italy IPv6 is still comparatively rare for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are: 1884 TOTAL 711 DE, Germany 314 NL, Netherlands 217 FR, France 165 US, United States 121 CZ, Czechia 72 GB, United Kingdom 39 SE, Sweden 36 RU, Russia 31 CH, Switzerland 22 AT, Austria 19 CA, Canada 15 IE, Ireland 13 NO, Norway 11 SI, Slovenia 11 AU, Australia 10 FI, Finland 10 DK, Denmark 10 BR, Brazil 5 LT, Republic of Lithuania 5 IT, Italy There are 4505 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. The number of published MX host TLSA RRsets found is 6827. These cover 7282 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs). The number of domains that at some point were listed in Gmail's email transparency report is 255 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 136 are in recent (last 90 days of) reports: univie.ac.at posteo.de mailplus.nl gmx.at ruhr-uni-bochum.de markteffectmail.nl transip.be tum.de minbzk.nl nic.br uni-erlangen.de mm1.nl registro.br uni-muenchen.de ouderportaal.nl gmx.ch unitybox.de overheid.nl open.ch unitymedia.de pathe.nl anubisnetworks.com web.de photofacts.nl fmc-na.com egmontpublishing.dk politie.nl gmx.com netic.dk previder.nl habr.com tilburguniversity.edu rijksoverheid.nl hotelsinduitsland.com web200.eu rotterdam.nl kpn.com zone.eu rvo.nl mail.com ac-strasbourg.fr specsaversrelation.nl one.com insee.fr ssonet.nl solvinity.com octopuce.fr transip.nl t-2.com web200.hu truetickets.nl telfort.com 247superhost.net utwente.nl trashmail.com comcast.net uvt.nl xfinity.com dd24.net xs4all.nl xfinityhomesecurity.com dns-oarc.net domeneshop.no xfinitymobile.com gmx.net handelsbanken.no active24.cz habramail.net uib.no atlas.cz hr-manager.net webcruitermail.no centrum.cz inexio.net atelkamera.nu cuni.cz mpssec.net aegee.org itesco.cz procurios.net debian.org klubpevnehozdravi.cz riseup.net freebsd.org nic.cz t-2.net gentoo.org onebit.cz transip.net ietf.org server4u.cz transversal.net isc.org smtp.cz vevida.net netbsd.org virusfree.cz xs4all.net openssl.org volny.cz xworks.net ozlabs.org allsecur.de belastingdienst.nl samba.org bayern.de bhosted.nl torproject.org bund.de bluerail.nl asf.com.pt elster.de boekwinkeltjes.nl moikrug.ru fau.de corpoflow.nl boplatssyd-automail.se freenet.de denhaag.nl handelsbanken.se gmx.de dictu.nl minmyndighetspost.se jpberlin.de digid.nl personligalmanacka.se kabelmail.de hierinloggen.nl skatteverket.se lrz.de hr.nl govtrack.us mail.de interconnect.nl mensa.de intermax.nl Of the ~1.18 million domains, 2533 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 615. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at: https://github.com/danefail/list To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See: https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4 After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 759. The top 10 name server operators with problem domains are: 174 mijnhostingpartner.nl 40 metaregistrar.nl 34 tiscomhosting.nl 34 movenext.nl 34 dotserv.com 31 nrdns.nl 20 sylconia.nl 14 is.nl 12 dnscluster.nl 11 vultr.com [ Both epik.com and binero.se have resolved all issues since last month. And mijnhostingpartner.nl is making great progress, if the root cause is resolved this month, this could be the last time they're mentioned here in a negative light. Eight of the ten problem providers are Dutch. It would be great if SIDN could apply some carrot and stick to incent .NL hosting providers to have correctly working DNSSEC implementations. ] If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible. Nine of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports: coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br key.com keybank.com sauditelecom.com.sa bog.gov.sa -- Viktor. [1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

1 0

Proofpoint announces DANE support
by Knubben, B.S.J. (Bart) - Forum Standaardisatie 25 Jun '19

25 Jun '19

Hi, See: https://twitter.com/ProofpointJ/status/1143536219126677504 and also https://mobile.twitter.com/internet_nl/status/1143548855075651584 -- Best regards, Bart Knubben Dutch Standardisation Forum https://www.forumstandaardisatie.nl/content/english Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

1 0