- dane-users - list.sys4.de

Update on stats (no major changes)
by Viktor Dukhovni 28 Jan '17

28 Jan '17

[ The main notable change is that forpsi.cz have fixed the corner-case issues in their DNS and no longer generate occasional "bogus" denial of existence of TLSA records. ] As of today I count 106082 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are: 42447 domeneshop.no 34169 transip.nl 15176 udmedia.de 1737 bhosted.nl 1287 nederhost.net 892 ec-elements.com 390 core-networks.de 299 uvt.nl 261 bit.nl 256 omc-mail.com The real numbers are surely larger, because I don't have access to the full zone data for any ccTLDs, and in particular .de and .nl. There are 2332 unique zones in which the underlying MX hosts are found, this counts each of the above registrars as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2421) of distinct MX host server certificates that support the same ~106000 domains. Of the ~106000 domains, 609 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 63 (~3 are recent additions that will likely be resolved soon, the remaining ~60 are the for now stable population of broken domains). The number of domains with bad DNSSEC support is 388. The top 10 DNS providers (by broken domain count) are: 56 axc.nl - Slated to be resolved 37 infracom.nl 19 loopia.se 19 active24.cz 14 jsr-it.nl 12 cas-com.net 10 ignum.com 8 ovh.net 7 tse.jus.br 7 is.nl Around 100 of the broken domains have at least one working nameserver, and so are email-reachable, given enough retries. The number of domains that at some point were listed in Gmail's transparency report is 96 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these 46 are in recent reports (January 2017): bayern.de ietf.org ruhr-uni-bochum.de bund.de insee.fr samba.org comcast.net ish.de t-2.net dd24.net jpberlin.de torproject.org debian.org kabelmail.de tum.de domeneshop.no lrz.de uni-erlangen.de enron.email mail.com unitybox.de fau.de mail.de unitymedia.de freebsd.org netbsd.org web.de gentoo.org octopuce.fr webcruitermail.no gmx.at open.ch xfinity.com gmx.ch openssl.org xs4all.net gmx.com ouderportaal.nl xs4all.nl gmx.de overheid.nl xworks.net gmx.net posteo.de hr-manager.net registro.br A recent addition that is not listed above is "exim.org". It seems that "exim.org" mailing lists don't process enough email to land on Google transparency reports. I don't have any way to measure how many domains enable DANE outbound but aren't using DNSSEC for their own domain or are not publishing TLSA records. It is easy to do, just fire up a local validating resolver, adjust /etc/resolv.conf to list only 127.0.0.1 and/or ::1, and add a couple of lines to main.cf. So the stats I am reporting reflects only DANE adoption for inbound email. -- Viktor.

1 0

Best practice TLSA RRs for CA-issued certs
by Viktor Dukhovni 30 Dec '16

30 Dec '16

[ This assumes you are willing to trust your issuer CA to not misissue certificates for your domain, and include the CA certificate in your server chain file. ] One approach to making sure that DANE TLSA records are less likely to fail that should work well for sites using CA-issued certificates is to publish both "3 1 1" and "2 1 1" TLSA records: mx.example. IN TLSA 3 1 1 <digest of server public key> mx.example. IN TLSA 2 1 1 <digest of immediate issuer public key> * The "3 1 1" record protects against "expiration" accidents, and unexpected changes in the issuer's public key (if new certificate chain deployment is automated). * The "2 1 1" record protects against key rotation errors should a a new server private key be deployed without updating the TLSA RRs. Provided the new certificate is issued by the same CA is unexpired, ... the "2 1 1" record will match. With a bit of monitoring to ensure that both records match, simultaneous failure of both is much less likely. This even makes it possible to avoid pre-deployment DNS TLSA records updates when rotating certificates, provided at least one of the issuer public key or the server public key is unchanged in the new chain. In particular, this is the best practice with Let's Encrypt issued SMTP server certificates, as explained in: https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certifi… -- Viktor.

3 13

Update on stats (no major changes)
by Viktor Dukhovni 29 Dec '16

29 Dec '16

As of today I count 105264 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are: 42300 domeneshop.no 33519 transip.nl 15205 udmedia.de 1748 bhosted.nl 1292 nederhost.net 897 ec-elements.com 387 core-networks.de 300 uvt.nl 266 bit.nl 227 omc-mail.com The real numbers are surely larger, because I don't have access to the full zone data for any ccTLDs, and in particular .de and .nl. There are 2269 unique zones in which the underlying MX hosts are found, this counts each of the above registrars as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2349) of distinct MX host server certificates that support the same ~105000 domains. Of the ~105000 domains, 825 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 75 (~25 are recent additions that will likely be resolved soon, the remaining ~50 are the long-term stable population of broken domains). The number of domains with bad DNSSEC support is 405. The top 10 DNS providers (by broken domain count) are: 58 axc.nl 39 infracom.nl 22 registrar-servers.com 19 loopia.se 19 active24.cz 16 forpsi.net 12 jsr-it.nl 12 cas-com.net 9 ovh.net 9 ignum.com Around 100 of the broken domains have at least one working nameserver, and so are email-reachable, given enough retries. The number of domains that at some point were listed in Gmail's transparency report is 95 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these 44 are in the most recent report: gmx.at lrz.de xworks.net conjur.com.br mail.de asp4all.nl registro.br posteo.de bhosted.nl gmx.ch ruhr-uni-bochum.de overheid.nl open.ch uni-erlangen.de xs4all.nl anubisnetworks.com unitymedia.de domeneshop.no gmx.com web.de debian.org mail.com enron.email freebsd.org trashmail.com octopuce.fr gentoo.org xfinity.com comcast.net ietf.org bund.de dd24.net netbsd.org fau.de gmx.net openssl.org gmx.de hr-manager.net samba.org jpberlin.de t-2.net torproject.org kabelmail.de xs4all.net In September of 2016 I asked a contact at Google to count how many of the domains in the survey received correspondence from multiple Gmail users. Back then the number was 1,827 out of 56k domains. More recently the number is 2,266 out of ~105k domains. I don't have any way to measure how many domains enable DANE outbound but aren't using DNSSEC for their own domain or publishing TLSA records. It is easy to do, just fire up a local validating resolver, adjust /etc/resolv.conf to list only 127.0.0.1 and/or ::1, and add a couple of lines to main.cf. -- Viktor.

1 0

Update on stats (no major changes)
by Viktor Dukhovni 28 Nov '16

28 Nov '16

As of today I count 103599 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are (bit.nl is a newcomer to the top 10 list): 42124 domeneshop.no 32486 transip.nl 15100 udmedia.de 1759 bhosted.nl 1266 nederhost.net 903 ec-elements.com 374 core-networks.de 305 uvt.nl 258 bit.nl 207 omc-mail.com The real numbers are surely larger, because I don't have access to the full zone data for any ccTLDs, and in particular .de and .nl. There are 2191 unique zones in which the underlying MX hosts are found, this counts each of the above registrars as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2297) of distinct MX host server certificates that support the same ~104000 domains. Of the ~104000 domains, 772 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands at 61 (~10 are recent additions that will likely be resolved soon, the remaining ~50 are the long-term stable population of broken domains). The number of domains with bad DNSSEC support is 388. The top 10 DNS providers (by broken domain count) are: 49 axc.nl 39 infracom.nl 25 binero.se 23 registrar-servers.com 20 loopia.se 19 active24.cz 16 forpsi.net 12 cas-com.net 11 jsr-it.nl 10 ignum.com Around 100 of the broken domains have at least one working nameserver, and so are email-reachable, given enough retries. The number of domains that at some point were listed in Gmail's transparency report is 91 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these 44 are in the most recent report: gmx.at jpberlin.de t-2.net conjur.com.br lrz.de xs4all.net registro.br mail.de overheid.nl gmx.ch posteo.de xs4all.nl open.ch ruhr-uni-bochum.de domeneshop.no anubisnetworks.com tum.de webcruitermail.no gmx.com uni-erlangen.de debian.org mail.com unitybox.de freebsd.org trashmail.com unitymedia.de gentoo.org xfinity.com web.de ietf.org bayern.de octopuce.fr netbsd.org bund.de comcast.net openssl.org fau.de dd24.net samba.org gmx.de gmx.net torproject.org ish.de hr-manager.net -- Viktor.

1 0

Letsencrypt-dane-tlsa-bind9
by John ＠ KLaM 21 Nov '16

21 Nov '16

Ice recently had to switch CA, I was using Startcom but recent events make them unaccuptable. I have decided to go with Letsencrypt. This works for most things but is giving me some headaches with DANE/TLSA. I can generate the tlsa for my dns ( bind 9) using Victor's tlsagen script. I direct the output into a file which I will be included in the DNS zone file using ($include). I am not going the CSR route so I am assuming that if I do this whenever certbot is run I should wind up with an upto date tlsa record. My problem is how to get bind to recognise that there has been change. Is this a workable idea? What have I got wrong? TIA John A

3 2

posttls-finver vs. dane.sys4.de
by Andreas Schulze 02 Nov '16

02 Nov '16

Hello, we found messages to "sushi-circle.de" stay in our MTA facing outside world: "status=deferred (TLSA lookup error for login.enterprise-email.com:25)" dane.sys4.de doesn't mention any problems. in contrast: # posttls-finger sushi-circle.de posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.login.enterprise-email.com type=TLSA: Host not found, try again posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.login.enterprise-email.com type=TLSA: Host not found, try again posttls-finger: Failed to establish session to sushi-circle.de via login.enterprise-email.com: TLSA lookup error for login.enterprise-email.com:25 I guess some piece of software is wrong... force $destdomain to encrypt only let postfix deliver the messages. Andreas

2 1

Update on stats (domeneshop.no boosts the domain count)
by Viktor Dukhovni 11 Oct '16

11 Oct '16

[ Bcc'd to a contact at another large provider, which I hope will be the next one to top the list... No pressure Christian ... :-) ] Just recently domeneshop.no have published DANE TLSA records for the MX hosts that support many of their hosted domains. So today I count 102638 domains with correct DANE TLSA records for SMTP. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top 10 MX host providers by domain count are: 42231 domeneshop.no 31928 transip.nl 15092 udmedia.de 1792 bhosted.nl 1262 nederhost.net 905 ec-elements.com 377 core-networks.de 290 uvt.nl 205 omc-mail.com 181 hot-chilli.net The real numbers are surely larger, because I don't have access to the full zone data for any ccTLDs, and in particular .de and .nl. There are 2113 unique zones in which the underlying MX hosts are found, this counts each of the above registrars as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Alternatively, a similar number is seen in the count (2219) of distinct MX host server certificates that support the same ~102000 domains. Of the ~102000 domains, 539 have "partial" TLSA records, that cover only a subset of the MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands at 85 (~30 are recent additions that will likely be resolved soon, the remaining ~50 are the long-term stable population of broken domains). The number of domains with bad DNSSEC support is 414. The top 10 DNS providers (by broken domain count) are: 50 axc.nl 39 infracom.nl 24 registrar-servers.com 20 loopia.se 19 active24.cz 18 jsr-it.nl 16 forpsi.net 12 cas-com.net 8 is.nl 8 ignum.com The number of domains that at some point were listed in Gmail's transparency report is 81 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these 43 are in the most recent report: gmx.at mail.de otvi.nl conjur.com.br posteo.de overheid.nl nic.br ruhr-uni-bochum.de xs4all.nl registro.br tum.de domeneshop.no gmx.ch uni-erlangen.de webcruitermail.no open.ch web.de debian.org gmx.com octopuce.fr freebsd.org mail.com comcast.net gentoo.org xfinity.com dd24.net ietf.org bund.de gmx.net netbsd.org fau.de hr-manager.net openssl.org gmx.de t-2.net samba.org jpberlin.de xs4all.net torproject.org kabelmail.de asp4all.nl lrz.de bhosted.nl -- Viktor.

1 0

howto generate TLSA 0 0 0
by Andreas Schulze 16 Sep '16

16 Sep '16

Hello, I like to publish a PKIX-TA which mean I publisch a whole certificate, the whole blob... I found https://www.huque.com/bin/gen_tlsa but some commandline voodoo using openssl or ldns-dane would be cool. Any suggestions? Thanks & nice weekend Andreas -- A. Schulze DATEV eG

3 2

Update on stats
by Viktor Dukhovni 13 Sep '16

13 Sep '16

I've gained access to the full zone files for .com/.net and a few of the newer gTLDs. This makes it possible to do a more comprehensive survey of DANE SMTP support. The overall DANE domain count is now ~29800, but of course this is not a dramatic rise in adoption, rather an increase in the breadth of the survey. As expected the bulk of the DANE domains are hosted the handful of DNS/hosting providers who've enabled DANE support in bulk for the domains they host. The top five are: 16650 transip.nl 6020 udmedia.de 1110 nederhost.net 663 ec-elements.com 180 core-networks.de 24623 TOTAL The real numbers are surely larger, because I don't have access to the full zone data for any ccTLDs, and in particular .de and .nl. There 1850 unique zones in which the underlying MX hosts are found, this counts each of the above registrars as just one zone, so is a measure of the breadth of adoption in terms of servers deployed. Of the 29800 domains, 336 have "partial" TLSA records, that cover only a subset of the MX hosts, while this protects traffic to some of the MX hosts, the domain is still vulnerable to the usual active attacks via the remaining MX hosts. The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands at 50. The number of domains with bad DNSSEC support is 262. The top 10 DNS providers (by broken domain count) are: 41 isphuset.no 36 tse.jus.br 22 axc.nl 21 active24.cz 20 registrar-servers.com 15 forpsi.net 11 ovh.net 11 cas-com.net 11 bestregistrar.com 10 shockmedia.nl Forpsi have indicated they are working on a fix. Progress at isphuset.no (ulimately fsdata.se) is still stalled. If someone has working technical contacts at any of the others, please drop me a note. The number of domains that at some point were listed in Gmail's transparency report is 57 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these 32 are in the most recent report: gmx.at conjur.com.br registro.br gmx.ch gmx.com mail.com bund.de gmx.de jpberlin.de kabelmail.de lrz.de mail.de posteo.de ruhr-uni-bochum.de tum.de web.de octopuce.fr comcast.net dd24.net gmx.net t-2.net xs4all.net xworks.net xs4all.nl debian.org freebsd.org gentoo.org ietf.org netbsd.org openssl.org samba.org torproject.org The .br TLD still includes too large a fraction (10/50) of domains with incorrect TLSA RRs. This is a result of DNS hosting by registro.br, where TLSA records are easy to initially publish, but difficult to keep up to date. If a registrar hosts the DNS, but does not operate the SMTP server, TLSA record support may do more harm than good unless an easy to use API is made available to update the TLSA records (interactive Web UIs don't qualify). -- Viktor.

1 4

Postfix and PDNS
by Wolfgang Rosenauer 12 Jul '16

12 Jul '16

Hi, I just switched to PowerDNS Recursor on my Postfix mailserver since their latest version (4) now supports DNSSEC validation. Unfortunately now Postfix seems to be unable to verify DANE anymore. I always get only "Anonymous TLS connections" where I got "Verified" ones when using bind. Apparently and somewhat confirmed by tcpdump and the PowerDNS guys it seems that Postfix relies on the +AD flag to signal a DNSSEC validated response but doesn't request it. I can only find a set DO bit in the query's dump. I'm running Postfix 3.1.1 fwiw. Any idea? Thanks, Wolfgang

5 5