Summary: The DANE domain count is now 1,974,938

Much of the increase from last month is due to ~42k domains hosted by pcextreme.nl. Thank you PCextreme.

The number of domains that return DNSSEC-validated replies in response to MX queries is 12,108,902. Thus DANE TLSA is deployed on ~16.30% of domains with DNSSEC.

DANE as a percentage of DNSSEC domains is dropping recently, because growth in DNSSEC adoption has started to outpace growth in DANE adoption. This is a good problem to have, deploy even more DNSSEC, please! At this rate, I am anticipating ~13 million signed domains by the end of 2020, but a surprise large-scale deployment would be even better.

Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome.

As of today I count 1,974,938 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below.

1034619 one.com 141535 transip.nl 101743 domeneshop.no 89837 loopia.se 83032 infomaniak.ch 42021 pcextreme.nl 41648 webreus.nl 39437 active24.com 32936 antagonist.nl 30714 vevida.com 28703 zxcs.nl 26693 web4u.cz 25440 udmedia.de 17613 bhosted.nl 14851 flexfilter.nl 14114 onebit.cz 11688 protonmail.ch 6829 zonemx.eu 6035 soverin.net 5773 netzone.ch

The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented).

6864 TOTAL 2191 DE, Germany 1377 US, United States 1046 NL, Netherlands 548 FR, France 287 GB, United Kingdom 225 CZ, Czechia 163 CA, Canada 100 SG, Singapore 97 CH, Switzerland 90 FI, Finland 84 SE, Sweden 71 DK, Denmark 49 AU, Australia 47 AT, Austria 43 IE, Ireland 36 BR, Brazil 33 PL, Poland 32 RU, Russia 31 JP, Japan 30 IN, India

IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are:

3555 TOTAL 1459 DE, Germany 580 NL, Netherlands 572 US, United States 263 FR, France 127 CZ, Czechia 111 GB, United Kingdom 49 CH, Switzerland 41 RU, Russia 41 CA, Canada 40 SE, Sweden 37 SG, Singapore 25 AT, Austria 19 AU, Australia 16 JP, Japan 16 IE, Ireland 15 DK, Denmark 14 NO, Norway 14 FI, Finland 13 ID, Indonesia 11 BR, Brazil

There are 5893 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP.

The number of published MX host TLSA RRsets found is 8284. These cover 9276 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs).

The number of DANE domains that at some point were listed in Gmail's email transparency report is 356 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 174 are in recent (last 90 days of) reports:

ac-strasbourg.fr interim-netwerk.nl ru.ac.za active24.cz isc.org ru.nl aegee.org itesco.cz ruhr-uni-bochum.de atelkamera.nu jpberlin.de rvo.nl atlas.cz kabelmail.de samba.org bayern.de kadernickyservis.sk schoudercom.nl belastingdienst.nl keessmit.nl schuurman-schoenen.nl bhosted.nl klubpevnehozdravi.cz skatteverket.se bluerail.nl kpn.com smtp.cz boekwinkeltjes.nl krypton.cz societe.com boozyshop.nl leszexpertsfle.com solvinity.com boplatssyd-automail.se loopia.se sportfondsen.nl bund.de lrz.de ssonet.nl centrum.cz lugeja.ee star.dk clubedohardware.com.br mail.com stil.dk clubedominante.com mail.de switch.ch comcast.net mailbox.org t-2.com compagnie-des-sens.fr mailplus.nl t-2.net corpoflow.nl mailserver4.de telfort.com cuni.cz mailzerver.com thalesgroup.com debian.org mammoetmail.com theletter.se dictu.nl markteffectmail.nl tilburguniversity.edu digid.nl maximum.nl torproject.org domeneshop.no minbzk.nl transip.net duo.nl mindef.nl triodos.be egmontpublishing.dk minmyndighetspost.se triodos.co.uk elster.de mkbbelangen.nl triodos.com emta.ee mm1.nl triodos.es ezorg.nl mpssec.net triodos.nl fau.de mx-relay.com truetickets.nl fidesz.hu netbsd.org tum.de fmc-na.com netic.dk uib.no freebsd.org nic.br uitgeverijpica.nl freenet.de nic.cz uni-c.dk gentoo.org one.com uni-erlangen.de gerryweber.nl onebit.cz uni-muenchen.de gmx.at open.ch unitybox.de gmx.ch openssl.org unitymedia.de gmx.com optimail.cz univie.ac.at gmx.de ouderportaal.nl utwente.nl gmx.net overheid.nl uv.es goget.nu ozlabs.org uvt.nl govtrack.us pathe.nl virusfree.cz habr.com personligalmanacka.se volny.cz habramail.net politie.nl web.de handelsbanken.no posteo.de webcruitermail.no handelsbanken.se pre-sustainability.com westlotto.de herinneringenoplinnen.nl previder.nl whatpulse.org hostpoint.ch procurios.net xfinity.com hotelsinduitsland.com professioneelbegeleiden.nl xfinityhomesecurity.com hr-manager.net protonmail.ch xfinitymobile.com hr.nl protonmail.com xs4all.net ietf.org rediris.es xs4all.nl inexio.net registro.br xworks.net infomaniak.ch rijksoverheid.nl zaantheater.nl infomaniak.com riseup.net zone.eu ingthink.com rmit.ee zonevs.eu interconnect.nl rotterdam.nl zorgmail.nl

Of the ~1.97 million domains, 13448 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts.

The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 602. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts.

To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See:

https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-... https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-r... https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources

http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4

After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1093. The top 15 name server operators with problem domains are:

367 axc.nl 350 registrar-servers.com 86 ebola.cz 64 movenext.nl 34 epik.com 28 tiscomhosting.nl 24 metaregistrar.nl 22 nrdns.nl 22 infracom.nl 22 eatserver.nl 11 sylconia.net 11 iterik.nu 11 icosnethosting.com 10 openprovider.nl 10 is.nl

[ The situation with epik.com is more worrisome than it looks, while only 34 domains have SMTP servers affected by incorrect TLSA record denial of existence, in fact well over 100k domains exhibit the same symptoms, but presently don't receive email.

Given the pervasive failure to provision complete NSEC chains for domains with zone-apex wildcard records, I expect this will get worse, before it gets better. My correspondence with Epik support has not yet reached someone who is able to understand and solve the problem.

Essentially the same issue of missing NSEC for the zone-apex wildcard is plaguing axc.nl. Perhaps it is too easy for PowerDNS users to get this wrong. Don't know what can be done to help them correct their provisioning practices. ]

If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible.

Six of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports:

coren-sp.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr mobily.com.sa sauditelecom.com.sa