Summary: The DANE domain count is now 1,227,756.
The number of domains that return DNSSEC-validated replies in response to MX queries is 9,878,661. Thus DANE TLSA is deployed on ~12.42% of domains with DNSSEC.
Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome.
As of today I count 1,227,756 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are:
734903 one.com 127486 transip.nl 98404 domeneshop.no 36596 active24.com 32070 vevida.com 26968 web4u.cz 24317 udmedia.de 16392 bhosted.nl 15667 flexfilter.nl 13799 zxcs.nl 13156 onebit.cz 7109 protonmail.ch 6010 netzone.ch 5620 previder.nl 3664 ips.nl 3298 interconnect.nl 2572 provalue.nl 2225 nederhost.nl 1913 spamcluster.nl 1701 nmugroup.com
The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented).
6089 TOTAL 1917 DE, Germany 1385 US, United States 839 NL, Netherlands 414 FR, France 274 GB, United Kingdom 181 CZ, Czechia 143 CA, Canada 128 SG, Singapore 78 CH, Switzerland 71 SE, Sweden 59 DK, Denmark 51 JP, Japan 49 AT, Austria 48 FI, Finland 45 IE, Ireland 43 AU, Australia 39 PL, Poland 38 IN, India 32 BR, Brazil 28 RU, Russia
IPv6 is less common than IPv4 for MX hosts (but improved IPv6 connectivity on my end this month finds more IPv6 DANE MTAs), and the top 20 countries by DANE MX host IPv6 GeoIP are:
3002 TOTAL 1172 DE, Germany 523 US, United States 410 NL, Netherlands 254 FR, France 116 CZ, Czechia 110 GB, United Kingdom 43 SG, Singapore 41 RU, Russia 35 CH, Switzerland 34 SE, Sweden 34 CA, Canada 26 JP, Japan 24 AT, Austria 18 IE, Ireland 15 IN, India 15 DK, Denmark 14 SI, Slovenia 14 AU, Australia 13 NO, Norway 12 ID, Indonesia
There are 4654 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of servers deployed.
The number of published MX host TLSA RRsets found is 7097. These cover 7555 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs).
The number of domains that at some point were listed in Gmail's email transparency report is 263 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 134 are in recent (last 90 days of) reports:
univie.ac.at kabelmail.de intermax.nl gmx.at lrz.de mailplus.nl nic.br mail.de markteffectmail.nl registro.br mensa.de mm1.nl gmx.ch posteo.de ouderportaal.nl open.ch ruhr-uni-bochum.de overheid.nl protonmail.ch tum.de parlement.nl anubisnetworks.com uni-erlangen.de pathe.nl fmc-na.com unitybox.de photofacts.nl gmx.com unitymedia.de politie.nl habr.com web.de previder.nl hotelsinduitsland.com egmontpublishing.dk rvo.nl kpn.com netic.dk transip.nl mail.com tilburguniversity.edu truetickets.nl mammoetmail.com web200.eu tweedekamer.nl metafaq.com zone.eu uitgeverijpica.nl one.com ac-strasbourg.fr utwente.nl protonmail.com octopuce.fr uvt.nl societe.com web200.hu xs4all.nl solvinity.com 247superhost.net domeneshop.no t-2.com comcast.net handelsbanken.no telfort.com dns-oarc.net uib.no trashmail.com gmx.net webcruitermail.no xfinity.com habramail.net atelkamera.nu xfinityhomesecurity.com hr-manager.net aegee.org xfinitymobile.com inexio.net debian.org active24.cz mpssec.net freebsd.org atlas.cz procurios.net gentoo.org centrum.cz riseup.net ietf.org cuni.cz t-2.net isc.org itesco.cz transip.net netbsd.org klubpevnehozdravi.cz transversal.net openssl.org nic.cz vevida.net ozlabs.org onebit.cz xs4all.net samba.org smtp.cz xworks.net torproject.org virusfree.cz belastingdienst.nl whatpulse.org volny.cz bhosted.nl asf.com.pt allsecur.de billybird.nl moikrug.ru bayern.de bluerail.nl boplatssyd-automail.se bund.de boozyshop.nl handelsbanken.se elster.de corpoflow.nl minmyndighetspost.se fau.de dictu.nl personligalmanacka.se freenet.de digid.nl skatteverket.se gmx.de hr.nl govtrack.us jpberlin.de interconnect.nl
Of the ~1.23 million domains, 2868 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts.
The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 537. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. A partial list is available at:
https://github.com/danefail/list
To avoid getting listed, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1278. The top 10 name server operators with problem domains are:
526 mijnhostingpartner.nl 44 movenext.nl 39 metaregistrar.nl 38 gransy.com 33 tiscomhosting.nl 31 nrdns.nl 26 hostnet.nl 21 sylconia.net 16 serv-ict.net 16 axc.nl
[ The above list no longer includes "dotserv.com" where all issues were recently resolved. Thanks! Nine of the ten problem providers are Dutch! It would be great if SIDN could apply some carrot and stick to incent .NL hosting providers to have correctly working DNSSEC implementations. ]
If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible.
Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports:
coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br mobily.com.sa sauditelecom.com.sa bog.gov.sa