Summary: The DANE domain count is now 4,069,697 (4,022,036 last month).
The number of domains that return DNSSEC-validated replies in response to MX queries is 23,199,861 (23,122,328 last month). Thus DANE TLSA is deployed on ~17.54% of domains with DNSSEC. For more stats, see https://stats.dnssec-tools.org/.
[ The credits[0] list is below my signature. ]
Reminder: If you're relying on trust-anchor (usage DANE-TA(2)) TLSA records matching a Let's Encrypt issuing CA, please note important recent and upcoming changes in Let's Encrypt certificate issuance:
https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/HESAY65... https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/GLRVY2C... https://list.sys4.de/hyperkitty/list/dane-users@list.sys4.de/message/X4SS2EE...
[ This month there's a stready trickle of domains whose DANE authentication fails because the DST cross certificate for the ISRG X1 root is no longer included in Let's Encrypt certificate chains. ]
As of today, I count ~4.07 million domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below.
This month Last Month ---------- ---------- 1305272 one.com 1305552 one.com 310345 hostpoint.ch 308177 hostpoint.ch 228070 infomaniak.ch 223679 infomaniak.ch 191647 jouwweb.nl 181030 jouwweb.nl 173391 transip.nl 173116 transip.nl 171433 mijndomein.nl 170668 mijndomein.nl 161671 simply.com 135204 argewebhosting.nl 133508 argewebhosting.nl 129324 simply.com 112176 hostnet.nl 111973 hostnet.nl 110331 domeneshop.no 110214 domeneshop.no 106740 loopia.se 106668 loopia.se 87960 webhostingserver.nl 88592 webhostingserver.nl 83860 zxcs.nl 83114 zxcs.nl 83010 forpsi.com 82996 forpsi.com 49979 protonmail.ch 48550 protonmail.ch 41335 antagonist.nl 41346 antagonist.nl 37883 active24.com 37932 active24.com 35476 webreus.nl 35799 webreus.nl 27833 xel.nl 28089 pcextreme.nl 27552 pcextreme.nl 27964 xel.nl
The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl, .de and .uk. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented).
This month Last month ----------- ---------- 12348 TOTAL 12241 TOTAL 3958 DE, Germany 3906 DE, Germany 1962 NL, The Netherlands 1972 NL, The Netherlands 1929 US, United States 1912 US, United States 888 FR, France 871 FR, France 492 CZ, Czechia 486 CZ, Czechia 418 GB, United Kingdom 414 GB, United Kingdom 309 FI, Finland 290 FI, Finland 231 CH, Switzerland 245 CA, Canada 209 CA, Canada 221 CH, Switzerland 204 AT, Austria 193 AT, Austria 175 SE, Sweden 166 SE, Sweden 168 DK, Denmark 156 DK, Denmark 150 AU, Australia 152 AU, Australia 119 SG, Singapore 121 SG, Singapore 115 PL, Poland 121 PL, Poland 100 RU, Russia 103 RU, Russia 66 NO, Norway 66 NO, Norway 60 BR, Brazil 57 JP, Japan 57 JP, Japan 56 BR, Brazil 56 IT, Italy 53 IT, Italy
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are:
This month Last month ---------- ---------- 9785 TOTAL 9761 TOTAL 4215 NL, The Netherlands 4263 NL, The Netherlands 2907 DE, Germany 2849 DE, Germany 906 US, United States 905 US, United States 398 FR, France 417 FR, France 213 CZ, Czechia 210 CZ, Czechia 185 GB, United Kingdom 180 GB, United Kingdom 116 FI, Finland 109 FI, Finland 88 CA, Canada 87 CA, Canada 83 SE, Sweden 80 CH, Switzerland 80 CH, Switzerland 78 SE, Sweden 76 AU, Australia 75 AU, Australia 56 AT, Austria 52 AT, Austria 43 SG, Singapore 46 SG, Singapore 40 JP, Japan 36 JP, Japan 32 RU, Russia 32 RO, Romania 31 RO, Romania 30 BR, Brazil 31 NO, Norway 29 RU, Russia 30 DK, Denmark 29 NO, Norway 30 BR, Brazil 28 DK, Denmark 17 LT, Lithuania 18 LT, Lithuania
There are 10,895 unique zones (10,719 last month) in which the underlying MX hosts are found. This counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 21,863 (24,636 last month). These cover 22,163 distinct MX hosts (24,945 last month, some MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's email transparency report is 1,272 (1,199 last month, this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 743 (683 last month) are in recent (last 90 days of) reports (see [2] below my signature).
Of the ~4.07 million DANE domains, 14,334 (14,204 last month) have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer STARTTLS (even though TLSA records are published) stands today at 2,344 (2,424 last month). Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. The affected domain counts for the top 10 problem MX hosts are:
547 mx2.xcellerate.nl 171 mx2.tkservers.com 25 mail.orionpanel.nl 23 semark.dk 22 web1.sys.ccs-baumann.de 22 smtp2.kruik-it.nl 15 mail.nationaalarchief.nl 15 mail.mostertman.com 15 artemis.strebsjig.net 14 mail.liebner-server.de
To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-... https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-r... https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1 https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 697 (838 last month). The top 10 name server operators with problem domains are:
This Month Last month ---------- ---------- 463 neostrada.nl 490 neostrada.nl 54 worldnic.com 58 worldnic.com 21 active24.cz 21 openprovider.nl 17 openprovider.nl 21 active24.cz 14 sectigoweb.com 14 sectigoweb.com 12 register.com 13 register.com 7 dnssrv.nl 7 dnssrv.nl 6 vultr.com 6 vultr.com 6 ispapi.net 6 ispapi.net 6 forpsi.net 6 forpsi.net
If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of existence appears in the last 120 days of Google transparency reports:
mailazy.net
-- Viktor.
[0] Credits: Hosting for the DANE/DNSSEC project is donated by isi.edu (Wes Hardaker and team). Wes also hosts and maintains the https://stats.dnssec-tools.org website. Thanks go to ICANN for sponsoring acquisition of the server hardware.
Coverage of DNSSEC domains continues to improve with ongoing data support from Chris Mikkelson from domaintools.com. Credits also due to ICANN providing gTLD data via CZDS, and to the ccTLD registries for .CH, .DK, .FI, .FR, .IS, .LI, .NL, .NU and .SE. More data sources of ccTLD signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency reports:
freshstore.app sifjakobs.de kadaster.nl univie.ac.at sillysanta.de kiesrijk.nl gmx.at smartwatcharmbaender.de klassiekemuziek.nl vbv.at sys4.de liveatamsterdamsebos.nl boozyshop.be taures.de maastrichtuniversity.nl eos-contentia.be tu-darmstadt.de mailmore.nl shopping-nivelles.be tum.de mailon.nl triodos.be tutanota.de mailplus.nl nra.bg uni-augsburg.de managementboek.nl register.bg uni-bielefeld.de markteffectmail.nl dwvmail.com.br uni-erlangen.de mcmta.nl e-negociacao.com.br uni-muenchen.de merkmeisjeskleding.nl e-renegocie.com.br vicinityclo.de mijndomein.nl zaaztelecom.com.br web.de mijnmagazines.nl aneel.gov.br westlotto.de minbzk.nl nic.br sanchezadv.digital mindef.nl mst.org.br aeldresagen.dk minvenj.nl registro.br allbuy.dk mm1.nl activfitness-news.ch annebrauner.dk mulderretail.nl blackout-bonusclub.ch anodyne.dk nefkens.nl escalade.ch athleticstudio.dk netpoint.nl gmx.ch attode.dk netpointfactoring.nl handy-abovergleich.ch avabeauty.dk nieuwsservice-rvo.nl hostpoint.ch barons.dk nmnhevents.nl infomaniak.ch bigsaver.dk notbranded.nl kalender-win.ch bisgaardshoes.dk ns.nl msochrono.ch blandselvfroe.dk nuudcare.nl open.ch boblberg.dk nuwegexclusief.nl protonmail.ch bog.dk okki.nl sherlockhomes.ch borgerforslag.dk oomverzekeringen.nl sms-gagnant.ch bymelanie.dk opnaarwonderland.nl switch.ch bystinewinther.dk ouderenfonds.nl votreopinion.ch camillakroeyer.dk ouderportaal.nl biolinky.co champagneklubben.dk outlawevents.nl bionoble.co cillouettes.dk overheid.nl simplelogin.co computerworld.dk oxilionhosted.nl aim-care.com damask.dk ozsw.nl albourne.com danskebank.dk partijvoordedieren.nl alcanside.com densidsteflaske.dk partnermail.nl also.com dfi.dk podiumcadeaukaart.nl anonaddy.com dressforsuccess.dk politie.nl ansigtsyogaonline.com ejvinds.dk pp-prd.nl aotax.com fibianet.dk previder.nl autogespot.com foraeldresparring.dk proefdiervrij.nl azizbekkaoui.com frisorenogbaronen.dk prorun-mail.nl barasportswear.com fvst.dk protislank.nl beyondmedals.com gasolinegrill.dk puurfiguur.nl boozyshop.com gastrotools.dk quicknet.nl buroventures.com globestudios.dk ranzijn.nl byic.com hook-up.dk rdw.nl cainte.com hostedsepo.dk rebirth-festival.nl canva-facile.com idelig.dk rechtspraak.nl caskcartel.com inkpro.dk restaurant-sparkling.nl cm.com kagegrisen.dk rijksoverheid.nl collarofsweden.com kk.dk rivm.nl connectsb.com kodbilen.dk rotterdam.nl cornerstoneplatform.com konkurspriser.dk rvo.nl danskebank.com kystfisken.dk sans-mail.nl datev.com lacabra.dk schuurman-schoenen.nl denhaag.com lammeskindet.dk shampoobars.nl detectiveforaday.com lederstof.dk shapeit.nl eliteincomesociety.com legekammeraten.dk shoesme.nl enoksenwatches.com littleluux.dk sizzthebrand.nl europesnus.com mastri.dk smartwatchbanden.nl explorer-hotels.com memery.dk sportrusten.nl fabfilter.com mobilcovers.dk ssonet.nl farmergracy.com modstroem.dk stage-app.nl fastware-hosting.com musclehouse.dk stater.nl flaneurhomme.com naturhandel.dk steunactie.nl fromanteel-watches.com netic.dk supportervanschoon.nl gearboxdigital.com nexsmart.dk technicus.nl giarite.com nfinitybeauty.dk teeshoppen.nl gmx.com nimara.dk telefoonglaasje.nl gohoeorgohome.com no1shop.dk thealphamen.nl goodforme.com nordd.dk thefightcompany.nl gosoaky.com nordelegastro.dk transip.nl grimfrost.com nordicsheep.dk triodos.nl habitamat.com nota.dk truetickets.nl habr.com online-mode.dk u-mailer.nl hannahbarrettyoga.com opdagverden.dk uitgeverijpica.nl headachecalendar.com perfectjeans.dk upcmail.nl hedon.com sengefabrikken.dk upfront.nl highcharts.com seniornews.dk uvt.nl hwigroup.com shapeit.dk uwv.nl imcnig.com sillysanta.dk vacaturesonline.nl infomaniak.com skjold-burne.dk valys.nl ingthink.com smoon.dk vimexx.nl intakt.com sneakerzone.dk vluchtelingenwerk.nl johnbeerens.com stil.dk vpo.nl joomlapolis.com stormfashion.dk vunzigedeuntjes.nl jula.com sygeforsikring.dk vvv-venlo.nl justpadel.com taenk.dk watchbandjes-shop.nl kabayarefashion.com thenap.dk waternet.nl kae-cosmetici.com thesneakerstore.dk werkzoeken.nl kheaa.com trueliving.dk woongarantvolmacht.nl leszexpertsfle.com trustfitness.dk ziggo.nl librti.com venderbys.dk zorgmail.nl lizamariefit.com viggo.dk ankerstjerne.no luvrefranco.com vind.dk annabellstefanussen.no mail.com yuaiahaircare.dk babybanden.no maileroo.com tilburguniversity.edu bull-ski-kajakk.no mailzerver.com biotheka.ee chillout.no marsblade.com holt.ee day-et.no medicaskinpro.com maarahvapood.ee dinholdning.no meriamecouture.com minuvalik.ee domeneshop.no mplbeauty.com pesapuuperekeskus.ee dressmykid.no mydrivingacademy.com sirena.ee gjormer.no naillak.com surveyturtle.ee guttelus.no nanolearning.com turunduslabor.ee handelsbanken.no nautisme-pratique.com myownconference.email hoppin.no neonfilter.com spam-filter.email hypopressivtrening.no nine-pine.com spotler.email hyttefeber.no nomadeyewear.com talentech.email idrettenonline.no nordicbasketball.com triodos.es jule-genser.no nordicdogtrainer.com egu.eu kristinetghardeberg.no novashops.com finesoftware.eu lagerpriser.no number-nineshop.com qard.eu lillepr.no oenling.com rybarik.eu marikrogshus.no offshorecorptalk.com zone.eu metaburn.no one.com zonevs.eu mystuff.no orsys.com danskebank.fi nordiskbylien.no ottobredesign.com f-solutions.fi norisma.no pageloot.com handelsbanken.fi norskgrammatikk.no planetnusa.com hersecret.fi raskebriller.no polyas.com io-tech.fi rushtrampoline.no pompomlondon.com metaburn.fi smaaungene.no ppcpcv.com raumanteatteri.fi spillfabrikken.no protonmail.com sillysanta.fi stilshoppen.no recwatches.com swiftbanker.fi strikkia.no remy-jupille.com traficom.fi tickettothemoon.no run-motion.com ac-strasbourg.fr veronicalill.no runbox.com boozyshop.fr atelkamera.nu sankakucomplex.com braceletsmartwatch.fr goget.nu schizinfo.com compagnie-des-sens.fr happydays.nu scienceshepherd.com edtm-actu.fr lenhud.nu scorecloud.com oo2.fr skjutsgruppen.nu serverclienti.com passefranceallemagne.fr calyxinstitute.org sisuknitwear.com printique.fr debian.org solvinity.com privea.fr freebsd.org stasdock.com fvap.gov fridaysforfuture.org stater.com aklub.hu gentoo.org stellarequipment.com fidesz.hu ietf.org tcs.com italiamail.hu mailbox.org techvisiongames.com marathonlife.hu mailop.org theintercept.com nyirbatorvaroskartya.hu netbsd.org thelabelmachine.com pulowear.hu openssl.org thepcw.com zsibvasar.hu ozlabs.org thepcwholesale.com bluebiz.info postfix.org tibush.com j360.info rfc-editor.org trainwithlov.com eurocontrol.int samba.org triodos.com simplelogin.io torproject.org tuftingshop.com nuudcare.it un-ihe.org tutanota.com hoj.life loopia.rs ugritone.com neolink.link pinnbet.rs up2staff.com education.lu mobily.com.sa vivaldi.com etat.lu advisamail.se webcruiter.com restena.lu arbetsformedlingen.se xfinity.com anonaddy.me bearbell.se xfinityhomesecurity.com pm.me bearplayshop.se xfinitymobile.com proton.me bilprovningen.se ymeuniverse.com army.mil dingolfshop.se zangra.com dla.mil ellevio.se bncr.fi.cr health.mil epochtimes-mejl.se airbank.cz jten.mil fotproffsen.se akce-incomputer.cz mail.mil getthegallop.se amenit.cz navy.mil getvibes.se balikovna.cz nga.mil glowid.se bewooden.cz osd.mil handelsbanken.se cinemax.cz socom.mil hellomantle.se cokoladovnajanek.cz spaceforce.mil inkrebel.se cpost.cz uscg.mil innebandy24.se creammy.cz usmc.mil jaramba.se csob.cz aifi.net jul-troja.se csobstavebni.cz comcast.net koreanbeauty.se cuni.cz ewetel.net kth.se dashofer.cz ficbook.net kulturaktiebolaget.se dedra.cz fivem.net livlyclothing.se e-kondomy.cz forwardemail.net lnu.se ekokoza.cz gmx.net lomervarde.se fio.cz graphistepro.net loopia.se gov.cz habramail.net merchsweden.se hobynaradi.cz hr-manager.net metaburn.se hypotecnibanka.cz institutocultivo.net mikaelapuranen.se innogy.cz intares.net minmyndighetspost.se itesco.cz mailanyone.net naprapatlandslaget.se kb.cz masterinter.net naturligtsnygg.se klenotyaurum.cz mijngezondheid.net nordd.se klubpevnehozdravi.cz mpssec.net nordicsheep.se ksporting.cz procurios.net polisen.se manymail.cz ripe.net redaktionen.se mbank.cz riseup.net samblamail.se mfcr.cz s-qrc.net sillysanta.se mindsoft.cz soverin.net silverdotter.se mkluzkoviny.cz space.net skatteverket.se mojedatovaschranka.cz t-2.net skolverket.se mojemincovna.cz transip.net snbostader.se mrakyhracek.cz alexstory.nl soleplus.se muni.cz amsterdam.nl spelfabrik.se nic.cz aquastorexl.nl svenskhusman.se o2.cz arthouse-online.nl teeshoppen.se opravdovezlociny.cz balanzs.nl teknikdelar.se optimail.cz bankhoesdiscounter.nl teknikhallen.se outlet-alpine.cz belastingdienst.nl theletter.se p-info.cz bellobox.nl websupport.se pivoteka.cz beterspellen.nl agatinsvet.sk poptavej.cz bewustpuur.nl coopka.sk scrptd.cz bhosted.nl edirect.sk server4u.cz blushfashionstore.nl fio.sk shopex.cz bobo.nl gravirovane.sk smtp.cz body-supplies.nl hecht.sk sparkys.cz bolerolimonadewinkel.nl mamaaja.sk stoklasa.cz boozyshop.nl meditec.sk tefal.cz box.nl mklozkoviny.sk thinline.cz bruut.nl mnforce-panel.sk vas-server.cz carre.nl nakupujzdravo.sk vitalpoint.cz casema.nl nameserver.sk vshosting.cz cateringdekorenbloem.nl nlp-akademia.sk zafido.cz cbr.nl partner.sk zdravestravovani.cz chello.nl penzionmara.sk zonky.cz citotoetsgroep4.nl poziadavka.sk bayern.de clubplanner.nl primatravel.sk bisgaardshoes.de commithappiness.nl rondogo.sk brandenburg.de cornemarchand.nl travelmail.sk bund.de debrandaris.nl zapardrobnych.sk datev.de degros.nl exercere.store dbtg.de deonlinetandarts.nl zeit-des-wandels.tv denic.de derooijfotografie.nl afinepairofshoes.co.uk dfn.de desan.nl clientnews3.co.uk elster.de dictu.nl handelsbanken.co.uk ewetel.de digid.nl honeybalm.co.uk fau.de dimehouse.nl millieandblake.co.uk freenet.de dorcas.nl nuudcare.co.uk gmx.de duo.nl teeshoppen.co.uk huellen-shop.de esuals.nl thecalzonekitchen.co.uk iks-jena.de extinctionrebellion.nl thewordman.co.uk jawliner.de ezorg.nl triodos.co.uk jpberlin.de fitnesskoerier.nl nuudcare.us knauermann.de fivecityspa.nl quantum-services.us lmu.de floathouse.nl ru.ac.za lrz.de glamouryourhair.nl swiftbanker.co.za mail.de hobbygigant.nl benzakdenimdevelopers.com mail2many.de home.nl conscience-et-realites.com mensa.de hostnet.nl thingsilikethingsilove.com mpg.de huurexpert.nl agirpourlenvironnement.org oberstdorf.de ikdeburger.nl allevakantiehuizeninbelgie.nl posteo.de interim-netwerk.nl hoogenboezem-nieuwsbrieven.nl ruhr-uni-bochum.de jointherebellion.nl deutsch-franzoesischer-freundschaftspass.de secumail.de josephinajewelry.nl