Summary: The DANE domain count is now 1,929,893

The number of domains that return DNSSEC-validated replies in response to MX queries is 11,728,469. Thus DANE TLSA is deployed on ~16.45% of domains with DNSSEC.

DANE as a percentage of DNSSEC domains is dropping recently, because growth in DNSSEC adoption has started to outpace growth in DANE adoption. This is a good problem to have, deploy even more DNSSEC, please! At this rate, I am anticipating ~13 million signed domains by the end of 2020, but a surprise large-scale deployment would be even better.

Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome.

As of today I count 1,929,893 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below.

1038314 one.com 140578 transip.nl 101181 domeneshop.no 89447 loopia.se 80663 infomaniak.ch 41035 webreus.nl 39255 active24.com 32282 antagonist.nl 30793 vevida.com 28642 zxcs.nl 26840 web4u.cz 25353 udmedia.de 17599 bhosted.nl 15003 flexfilter.nl 14114 onebit.cz 11144 protonmail.ch 6432 zonemx.eu 5926 soverin.net 5790 netzone.ch 5590 previder.nl

The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .no/.cz/.de/.eu/.be. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented).

6728 TOTAL 2147 DE, Germany 1336 US, United States 1008 NL, Netherlands 576 FR, France 283 GB, United Kingdom 226 CZ, Czechia 153 CA, Canada 102 SG, Singapore 93 CH, Switzerland 84 FI, Finland 82 SE, Sweden 70 DK, Denmark 51 AU, Australia 48 AT, Austria 42 IE, Ireland 35 BR, Brazil 32 IN, India 30 JP, Japan 28 RU, Russia 26 PL, Poland

IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are:

3458 TOTAL 1426 DE, Germany 565 US, United States 521 NL, Netherlands 274 FR, France 125 CZ, Czechia 105 GB, United Kingdom 46 RU, Russia 42 CH, Switzerland 40 SG, Singapore 40 CA, Canada 36 SE, Sweden 32 AT, Austria 20 AU, Australia 16 JP, Japan 16 IE, Ireland 14 NO, Norway 14 DK, Denmark 13 ID, Indonesia 12 FI, Finland 11 BR, Brazil

There are 5760 unique zones in which the underlying MX hosts are found, this counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP.

The number of published MX host TLSA RRsets found is 8056. These cover 9041 distinct MX hosts (some MX hosts share the same TLSA records through CNAMEs).

The number of DANE domains that at some point were listed in Gmail's email transparency report is 353 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 172 are in recent (last 90 days of) reports:

univie.ac.at jpberlin.de maximum.nl gmx.at kabelmail.de minbzk.nl triodos.be lrz.de mindef.nl clubedohardware.com.br mail.de mkbbelangen.nl nic.br mailserver4.de mm1.nl registro.br posteo.de ouderportaal.nl gmx.ch ruhr-uni-bochum.de overheid.nl hostpoint.ch tu-chemnitz.de pathe.nl infomaniak.ch tum.de politie.nl open.ch uni-erlangen.de previder.nl protonmail.ch uni-muenchen.de professioneelbegeleiden.n switch.ch unitybox.de rijksoverheid.nl clubedominante.com unitymedia.de rotterdam.nl coosto.com web.de ru.nl fmc-na.com westlotto.de rvo.nl gmx.com egmontpublishing.dk schoudercom.nl habr.com netic.dk schuurman-schoenen.nl hotelsinduitsland.com star.dk sportfondsen.nl infomaniak.com lugeja.ee ssonet.nl ingthink.com rediris.es triodos.nl kpn.com triodos.es truetickets.nl leszexpertsfle.com uv.es uitgeverijpica.nl mail.com litebit.eu utwente.nl mailzerver.com zone.eu xs4all.nl mammoetmail.com zonevs.eu zaantheater.nl mx-relay.com ac-strasbourg.fr zorgmail.nl one.com compagnie-des-sens.fr domeneshop.no pre-sustainability.com fidesz.hu handelsbanken.no primexbt.com comcast.net uib.no protonmail.com dns-oarc.net webcruitermail.no societe.com gmx.net atelkamera.nu solvinity.com habramail.net goget.nu t-2.com hr-manager.net aegee.org telfort.com inexio.net debian.org thalesgroup.com mpssec.net freebsd.org triodos.com procurios.net gentoo.org xfinity.com riseup.net ietf.org xfinityhomesecurity.com t-2.net isc.org xfinitymobile.com transip.net lazarus-ide.org active24.cz xs4all.net mailbox.org atlas.cz xworks.net netbsd.org centrum.cz belastingdienst.nl openssl.org cuni.cz bhosted.nl ozlabs.org itesco.cz bluerail.nl samba.org klubpevnehozdravi.cz boekwinkeltjes.nl torproject.org krypton.cz boozyshop.nl whatpulse.org nic.cz corpoflow.nl boplatssyd-automail.se onebit.cz dictu.nl handelsbanken.se optimail.cz digid.nl loopia.se smtp.cz duo.nl minmyndighetspost.se virusfree.cz ezorg.nl personligalmanacka.se volny.cz gerryweber.nl skatteverket.se bayern.de herinneringenoplinnen.nl theletter.se bund.de hr.nl kadernickyservis.sk elster.de interconnect.nl triodos.co.uk fau.de keessmit.nl govtrack.us freenet.de mailplus.nl ru.ac.za gmx.de

Of the ~1.93 million domains, 5387 have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts.

The number of domains with incorrect TLSA records or failure to advertise STARTTLS (even though TLSA records are published) stands today at 806. Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts.

To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See:

https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-... https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-r... https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources

http://tools.ietf.org/html/rfc7671#section-8.1 http://tools.ietf.org/html/rfc7671#section-8.4

After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 1093. The top 16 name server operators with problem domains are:

379 registrar-servers.com - NameCheap, no ETA... :-( 366 axc.nl - Usually fixed promptly, not this month 86 ebola.cz 71 movenext.nl 36 cdmon.net 31 flevohost.nl 29 tiscomhosting.nl 28 hostnet.nl 24 nrdns.nl 23 eatserver.nl 22 metaregistrar.nl 22 infracom.nl 20 epik.com 17 vandersalm-it.nl 15 is.nl 12 sylconia.net

If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible.

Eight of the domains all whose nameservers have broken denial of existence appear in the last 120 days of Google transparency reports:

coren-sp.gov.br trt01.gov.br trtrio.gov.br trt1.jus.br trtrj.jus.br bncr.fi.cr mobily.com.sa sauditelecom.com.sa