- dane-users - list.sys4.de

Update on stats 2017-05
by Viktor Dukhovni 01 Jun '17

01 Jun '17

As of today I count 169812 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are: 69614 domeneshop.no 59404 transip.nl 18372 udmedia.de 6733 bhosted.nl 1831 nederhost.net 997 ec-elements.com 501 core-networks.de 339 bit.nl 334 omc-mail.com 309 uvt.nl [ The 365 "networking4all.net" domains from last month are gone, because they got bought by metaregistrar.nl and the new MX hosts are not in DNSSEC signed zones. Otherwise, the total would now have been over 170000. ] The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.nl/.de. There are 2567 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2667) of distinct MX host server certificates that support the same ~169000 domains. A related number is 3818 TLSA RRsets found for MX host TCP port 25. This includes secondary MX hosts and domains none of whose primary MX hosts have TLSA records. The number of domains that at some point were listed in Gmail's email transparency report is 108 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 54 are in recent reports: anubisnetworks.com gmx.de posteo.de asf.com.pt gmx.net registro.br asp4all.nl hr-manager.net ruhr-uni-bochum.de bayern.de ietf.org samba.org bhosted.nl isc.org solvinity.com bund.de jpberlin.de t-2.com comcast.net lrz.de t-2.net dd24.net mail.com t-2.si debian.org mail.de torproject.org domeneshop.no netbsd.org trashmail.com elster.de nic.br tum.de enron.email nic.cz uni-erlangen.de fau.de octopuce.fr unitymedia.de freebsd.org open.ch web.de gentoo.org openssl.org webcruitermail.no gmx.at ouderportaal.nl xfinity.com gmx.ch overheid.nl xs4all.net gmx.com pathe.nl xs4all.nl Of the ~169000 domains, 749 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 93. The list of the 54 underlying MX hosts that serve these domains and whose TLSA records don't match reality. Hall of Shame: mail.dipietro.id.au mail.enzevalos.de dorothy.goldenhairdafo.ne eumembers.stansoft.bg hmserver.de hs.kuzenkov.net catabra.com.br mail.manima.de oostergo.net server29.prazernavida.com www.mtg.de ren.warunek.net mail.pgp.inf.br mx1.spamsponge.de cinnamon.nl my.mai1.ch mail.0pc.eu mail.e-rave.nl alpaca.attackllama.com gamepixel.eu mail.jekuiken.nl mail.danmolik.com mx.quentindavid.fr mail.myzt.nl mail.digitalwebpros.com servmail.fr bounder.steelyard.nl demo.liveconfig.com mail.nonoserver.info mx.wm.net.nz ny-do.pieterpottie.com mx.datenknoten.me beerstra.org diablo.sgt.com mx.giesen.me smtp.copi.org tusk.sgt.com smtp.aechelon.net eumembers.datacentrix.org mx1.wittsend.com mail.castleturing.net smtp3.amadigi.ovh mx.bels.cz mail.d3fy.net mail.pasion.ro gaia.nfx.cz datawebb.dafcorp.net mail.lahl.rocks badf00d.de anubis.delphij.net protector.rajmax.si mail.denniseffing.de goldenhairdafo.net email.themcintyres.us The number of domains with bad DNSSEC support is 438. The increase is due to a comprehensive scan of all 4.6 million DNSSEC domains in the survey, previously some parts of the survey did not record SERVFAIL results. the top 10 DNS providers with problem domains are: 68 jsr-it.nl 58 infracom.nl - Was slated to be resolved in March, delayed... 27 is.nl 24 active24.cz 23 tiscomhosting.nl 18 metaregistrar.nl 15 rdw.nl 10 firstfind.nl 9 cas-com.net 8 loopia.se Around 50 of the broken domains have at least one working nameserver, and so are email-reachable, given enough retries. Only 6 of these DNS-broken domains appear in historical Google Email transparency reports: rzd.ru tse.jus.br tiviths.com.br trt1.jus.br trtrj.jus.br tjce.jus.br The associated DNS lookup issues are: _25._tcp.ims1.rzd.ru. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.ims1.rzd.ru/dnssec/ _25._tcp.ims2.rzd.ru. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.ims2.rzd.ru/dnssec/ _25._tcp.lalavava.tse.jus.br. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.lalavava.tse.jus.br/dnssec/ _25._tcp.mx.tiviths.com.br. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.mx.tiviths.com.br/dnssec/ _25._tcp.mx1.trt1.jus.br. IN TLSA ? ; zone signature failure: http://dnsviz.net/d/_25._tcp.mx1.trt1.jus.br/dnssec/ _25._tcp.mx1.trtrj.jus.br. IN TLSA ? ; zone signature failure: http://dnsviz.net/d/_25._tcp.mx1.trtrj.jus.br/dnssec/ _25._tcp.mx2.tjce.jus.br. IN TLSA ? ; SOA signature failure: http://dnsviz.net/d/_25._tcp.mx2.tjce.jus.br/dnssec/ [ See <https://tools.ietf.org/html/draft-ietf-dnsop-no-response-issue-08>, Much of the TLSA non-response issue seems to be related to a "feature" of Arbor Networks firewalls, that enables droping of DNS requests for all but the most common RRtypes. Do not make the mistake of enabling this firewall "feature". ] The oldest outstanding DNS issue is another SOA signature issue at truman.edu dating back to Nov/2014: http://dnsviz.net/d/_25._tcp.barracuda.truman.edu/VGzORw/dnssec/ I hope some day soon they'll start missing email they care about and take the time to resolve the problem. -- Viktor.

1 1

Test tool havedane.net and NCSC-NL factsheet on DANE
by Bart Knubben 19 May '17

19 May '17

1. Check this new tool for testing if your mail server checks DANE when sending email: https://havedane.net 2. Recently the Dutch NCSC published a factsheet "Secure the connections of mail servers" with regard to DANE and STARTTLS. See: https://www.ncsc.nl/english/current-topics/factsheets/factsheet-secure-the-… -- Best regards, Bart Knubben

3 2

Update on stats (axc.nl DNS issues resolved this month)
by Viktor Dukhovni 30 Apr '17

30 Apr '17

As of today I count 168708 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are: 69372 domeneshop.no 58498 transip.nl 18224 udmedia.de 6769 bhosted.nl 1824 nederhost.net 993 ec-elements.com 494 core-networks.de 365 networking4all.net 337 bit.nl 328 omc-mail.com The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs. However, this month, I was able to obtain nearly comprehensive domain lists for .no, .nl and .de, which accounts for the unusually large increase over the previous month's totals. There are 2529 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2644) of distinct MX host server certificates that support the same ~168000 domains. A related number is 3795 TLSA RRsets found for MX host TCP port 25. This includes secondary MX hosts and domains none of whose primary MX hosts have TLSA records. The number of domains that at some point were listed in Gmail's email transparency report is 105 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 53 are in recent reports (April 2017): gmx.at jpberlin.de bhosted.nl nic.br lrz.de ouderportaal.nl registro.br mail.de overheid.nl gmx.ch posteo.de pathe.nl open.ch ruhr-uni-bochum.de xs4all.nl anubisnetworks.com tum.de domeneshop.no gmx.com uni-erlangen.de webcruitermail.no mail.com unitymedia.de debian.org solvinity.com web.de freebsd.org t-2.com enron.email gentoo.org trashmail.com octopuce.fr ietf.org xfinity.com comcast.net isc.org nic.cz dd24.net netbsd.org bayern.de gmx.net openssl.org bund.de hr-manager.net samba.org elster.de t-2.net torproject.org fau.de xs4all.net asf.com.pt gmx.de asp4all.nl Of the ~168000 domains, 737 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 73 (~10 are recent additions that may be resolved soon, the remaining ~60 are the for now stable population of broken domains). This month I'm posting the list of the 40 underlying MX hosts that serve these domains and whose TLSA records don't match reality. Hall of Shame: mail.dipietro.id.au mx.quentindavid.fr mail.jekuiken.nl mail.pgp.inf.br servmail.fr mail.myzt.nl mail.digitalwebpros.com mail.nonoserver.info bounder.steelyard.nl demo.liveconfig.com mail.laukas.lt mx.wm.net.nz ny-do.pieterpottie.com mx.datenknoten.me kitsune.one diablo.sgt.com mx.giesen.me baobrien.org tusk.sgt.com mail.castleturing.net beerstra.org mx.bels.cz datawebb.dafcorp.net smtp.copi.org mail.enzevalos.de anubis.delphij.net eumembers.datacentrix.org mail.manima.de dorothy.goldenhairdafo.net smtp3.amadigi.ovh www.mtg.de hs.kuzenkov.net protector.rajmax.si mx1.spamsponge.de oostergo.net email.themcintyres.us gamepixel.eu ren.warunek.net mail.thomspooren.eu mail.e-rave.nl The number of domains with bad DNSSEC support is 263. With axc.nl (the previous #1) resolved this month, the top 13 DNS providers with problem domains, after a 5-way tie for 8th place are: 37 infracom.nl - Was slated to be resolved in March, delayed... 18 loopia.se 18 active24.cz 14 jsr-it.nl 13 rdw.nl 9 cas-com.net 8 metaregistrar.nl 6 tiscomhosting.nl 6 pfsc.com 6 ovh.net Around 50 of the broken domains have at least one working nameserver, and so are email-reachable, given enough retries. Only 6 of these DNS-broken domains appear in historical Google Email transparency reports: tjce.jus.br trt1.jus.br trtrj.jus.br tse.jus.br amsterdam.nl rzd.ru The associated DNS lookup issues are: _25._tcp.ims1.rzd.ru. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.ims1.rzd.ru/dnssec/ _25._tcp.ims2.rzd.ru. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.ims2.rzd.ru/dnssec/ _25._tcp.lalavava.tse.jus.br. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.lalavava.tse.jus.br/dnssec/ _25._tcp.mx1.trt1.jus.br. IN TLSA ? ; zone signature failure: http://dnsviz.net/d/_25._tcp.mx1.trt1.jus.br/dnssec/ _25._tcp.mx1.trtrj.jus.br. IN TLSA ? ; zone signature failure: http://dnsviz.net/d/_25._tcp.mx1.trtrj.jus.br/dnssec/ _25._tcp.mx2.tjce.jus.br. IN TLSA ? ; SOA signature failure: http://dnsviz.net/d/_25._tcp.mx2.tjce.jus.br/dnssec/ _25._tcp.mxin1.amsterdam.nl. IN TLSA ? ; TLSA non-response: http://dnsviz.net/d/_25._tcp.mxin1.amsterdam.nl/dnssec/ [ See <https://tools.ietf.org/html/draft-ietf-dnsop-no-response-issue-08>, Much of the TLSA non-response issue seems to be related to a "feature" of Arbor Networks firewalls, that enables droping of DNS requests for all but the most common RRtypes. Do not make the mistake of enabling this firewall "feature". ] The oldest outstanding DNS issue is another SOA signature issue at truman.edu dating back to Nov/2014: http://dnsviz.net/d/_25._tcp.barracuda.truman.edu/VGzORw/dnssec/ I hope some day soon they'll start missing email they care about and take the time to resolve the problem. -- Viktor.

1 0

OT. renew-hook
by John 29 Apr '17

29 Apr '17

I have written a renew-hook for letsencrypt, and it does not need SRV records. It seems to work but I have limited facility/ability to test. If there is anybody out there interested would they try it, test it and let me know whats wrong with it. Its a bash script, and should probably be rewritten in something a little more tamper proof. I am currently brushing up on my C++ and looking into Python, suggestions as to language welcome. renew-hook <https://github.com/zzz2002/Certbot_TLSAgen_Hook> JohnA

1 0

Letsencrypt renew-hook
by john 26 Apr '17

26 Apr '17

I have been working on a renew-hook for letsencrypt/certbot. The idea was that it would generate new TLSA records when the certificates were updated, automatically install them and automatically remove the old ones after a suitable delay. While I was putting it together I made some assumptions about the environment that TLSA records would be found in, in particular the DNS configuration. It seems I am probably wrong. Is an automatic TLSA update system worth doing? Are the prerequisites that I think might make it work too onerous. Eg. Linux servers, need SRV records in order to determine the port and host for each TLSA record. John A

4 5

?
by John Allen 20 Apr '17

20 Apr '17

Is the following assumption reasonable? if there are multiple TLSA dane-ee (type 3) records for a particular service, none of which match the current generated record, they can (maybe should) be deleted. The same "rule" can be could be applied to dane type 2 records.

3 3

Assumptions
by John 20 Apr '17

20 Apr '17

Are the following assumptions reasonable? if there are multiple TLSA dane-ee (type 3) records for a particular service, none of which match the current generated record, they can (maybe should) be deleted. The same "rule" can be could be applied to dane type 2 records.

2 1

Assumption about TLSA records
by John Allen 20 Apr '17

20 Apr '17

Is the following assumption reasonable? if there are multiple TLSA dane-ee (type 3) records for a particular service, none of which match the current generated record, they can (maybe should) be deleted. The same "rule" can be could be applied to dane type 2 records.

1 0

Assumption abot TLSA records
by John Allen 20 Apr '17

20 Apr '17

Is the following assumption reasonable? if there are multiple TLSA dane-ee (type 3) records for a particular service, none of which match the current generated record, they can (maybe should) be deleted. The same "rule" can be could be applied to dane type 2 records.

1 0

Lestencrypt "renew-hook"
by John Allen 13 Apr '17

13 Apr '17

I have just put the latest version of the above up on github https://github.com/zzz2002/Certbot_TLSAgen_Hook Anybody with time on their hand,wold yo mind taking a look and letting me know what wrong with it/ what doesn't work/what could be done better.... Happy Easter to those who celebrate it this weekend, to those who don't have a good & safe weekend, enjoy yourselves. JohnA

1 0