Summary: The DANE domain count is now 3,949,527 (3,923,543 last month).

The number of domains that return DNSSEC-validated replies in response to MX queries is 23,173,417 (up slightly from 23,180,180 last month). Thus DANE TLSA is deployed on ~17.04% of domains with DNSSEC. For more stats, see https://stats.dnssec-tools.org/. [ See the Credits[0] list below my signature. ]

As of today, I count ~3.95 million domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections[1]. As expected, the bulk of the DANE domains are hosted by the DNS/email hosting providers who've enabled DANE support for the customer domains they host. The top 20 MX host providers by domain count are below.

This month Last Month ---------- ---------- 1314953 one.com 1322240 one.com 303663 hostpoint.ch 302353 hostpoint.ch 212629 infomaniak.ch 209052 infomaniak.ch 172311 transip.nl 171630 transip.nl 169592 mijndomein.nl 168815 mijndomein.nl 161972 jouwweb.nl 156229 jouwweb.nl 139685 argewebhosting.nl 141433 argewebhosting.nl 131004 simply.com 129838 simply.com 111235 hostnet.nl 111275 hostnet.nl 109839 domeneshop.no 109926 domeneshop.no 106090 loopia.se 105948 loopia.se 90348 webhostingserver.nl 91048 webhostingserver.nl 83074 forpsi.com 83031 forpsi.com 81323 zxcs.nl 81293 zxcs.nl 44928 protonmail.ch 44103 protonmail.ch 40974 antagonist.nl 40754 antagonist.nl 39102 active24.com 39341 active24.com 36892 webreus.nl 37235 webreus.nl 29674 pcextreme.nl 30037 pcextreme.nl 28404 xel.nl 28501 xel.nl

The real numbers are surely larger, because I don't have access to the full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl, .de and .uk. Speaking of countries, the IPv4 GeoIP distribution of DANE-enabled MX hosts shows the below top 20 countries (each unique IP address is counted, so multi-homed MX hosts are perhaps somewhat over-represented).

This month Last month ----------- ---------- 11663 TOTAL 11403 TOTAL 3687 DE, Germany 3586 DE, Germany 1932 NL, Netherlands 1887 NL, Netherlands 1888 US, United States 1885 US, United States 883 FR, France 864 FR, France 458 CZ, Czechia 452 CZ, Czechia 364 GB, United Kingdom 360 GB, United Kingdom 267 FI, Finland 264 FI, Finland 213 CA, Canada 203 CA, Canada 176 AT, Austria 179 AT, Austria 171 CH, Switzerland 165 SE, Sweden 161 SE, Sweden 148 CH, Switzerland 147 DK, Denmark 146 DK, Denmark 141 AU, Australia 144 AU, Australia 123 SG, Singapore 125 SG, Singapore 107 RU, Russia 90 PL, Poland 88 PL, Poland 85 RU, Russia 64 JP, Japan 65 JP, Japan 60 NO, Norway 55 BR, Brazil 51 BR, Brazil 52 NO, Norway 47 IT, Italy 42 IT, Italy

IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by DANE MX host IPv6 GeoIP are:

This month Last month ---------- ---------- 9445 TOTAL 9295 TOTAL 4224 NL, Netherlands 4201 NL, Netherlands 2659 DE, Germany 2602 DE, Germany 881 US, United States 866 US, United States 389 FR, France 375 FR, France 189 CZ, Czechia 178 GB, United Kingdom 177 GB, United Kingdom 178 CZ, Czechia 110 FI, Finland 110 FI, Finland 87 CA, Canada 82 CA, Canada 81 SE, Sweden 80 SE, Sweden 72 AU, Australia 72 AU, Australia 68 CH, Switzerland 65 CH, Switzerland 49 SG, Singapore 50 SG, Singapore 47 AT, Austria 49 AT, Austria 43 RU, Russia 41 JP, Japan 39 JP, Japan 30 RU, Russia 30 BR, Brazil 28 RO, Romania 28 RO, Romania 27 NO, Norway 26 NO, Norway 26 BR, Brazil 23 DK, Denmark 24 DK, Denmark 18 LT, Lithuania 18 IE, Ireland

There are 9,773 unique zones (9,391 last month) in which the underlying MX hosts are found. This counts each of the above providers as just one zone, so is a measure of the breadth of adoption in terms of organizations deploying DANE SMTP.

The number of published MX host TLSA RRsets found is 20,781 (20,808 last month). These cover 21,077 distinct MX hosts (21,102 last month, some MX hosts share the same TLSA records through CNAMEs).

The number of DANE domains that at some point were listed in Gmail's email transparency report is 1,090 (this is my ad-hoc criterion for a domain being a large-enough actively used email domain). Of these, 569 are in recent (last 90 days of) reports (see [2] below my signature).

Of the ~3.95 million DANE domains, 14,236 (14,262 last month) have "partial" TLSA records, that cover only a subset of the (secondary) MX hosts. While this protects traffic to some of the MX hosts, such domains are still vulnerable to the usual active attacks via the remaining MX hosts.

The number of domains with incorrect TLSA records or failure to offer STARTTLS (even though TLSA records are published) stands today at 1,873 (2,180 last month). Some of these have additional MX hosts that don't have broken TLSA records, so mail can still arrive via the remaining MX hosts. The affected domain counts for the top 10 problem MX hosts are:

177 mx2.tkservers.com 132 mx2.dotxs.net 44 mx.neutraldomains.net 41 svr3.it-df.net 35 mx1.mdbraber.com 23 smtp2.kruik-it.nl 22 mail.mxx.dk 20 fsn1-c04.xemo-net.de 19 web2.sys.ccs-baumann.de 15 mx1.zeromeaning.com

To avoid email outages, please make sure to monitor the validity of your own TLSA records, and implement a reliable key rotation procedure. See:

https://dane.sys4.de/common_mistakes https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-... https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-r... https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources

https://datatracker.ietf.org/doc/html/rfc7671#section-8.1 https://datatracker.ietf.org/doc/html/rfc7671#section-8.4

After eliminating parked domains that do not accept email, the number of "real" email domains with bad DNSSEC support stands at 901 (1,057 last month). The top 10 name server operators with problem domains are:

This Month Last month ---------- ---------- 665 neostrada.nl 715 neostrada.nl 62 worldnic.com 70 worldnic.com 24 openprovider.nl 60 ebola.cz 14 sectigoweb.com 32 openprovider.nl 13 register.com 14 sectigoweb.com 9 dnssrv.nl 13 register.com 8 ispapi.net 10 dnssrv.nl 7 vultr.com 8 ispapi.net 6 resolver.domains 7 vultr.com 6 forpsi.net 7 cloudns.net

If anyone has good contacts at some of these providers, please encourage them to remediate not only the broken domains (I can send them a list), but also the root cause that makes the breakage possible.

Just one of the domains whose nameservers have broken denial of existence appears in the last 120 days of Google transparency reports:

mailazy.net

-- Viktor.

[0] Credits: The coverage of DNSSEC domains continues to improve with ongoing data support from Paul Vixie of Farsight Security. Credits also due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH, .COM, .DK, .FI, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data sources of ccTLD signed delegations welcome.

[1] Some domains deliberately include MX hosts that are always down, presumably as a hurdle to botnet SMTP code that gives up where real MTAs might persist. I am not a fan of this type of defence (it can also impose undue latency on legitimate email). However, provided the dead hosts still have TLSA records, (which don't need to match anything, just need to exist and be well-formed) there's no loss of security.

[2] DANE domains appearing in last 90 days of Google Email transparency reports:

univie.ac.at tum.de hostingpeople.nl gmx.at tutanota.de hostnet.nl vbv.at uni-augsburg.de hr.nl boozyshop.be uni-bielefeld.de hro.nl eos-contentia.be uni-erlangen.de huurexpert.nl triodos.be uni-muenchen.de ikdeburger.nl vanbreda.be vicinityclo.de inspirerendleven.nl nra.bg web.de interconnect.nl cetelemnegocie.com.br westlotto.de interim-netwerk.nl dwvmail.com.br aeldresagen.dk ithodaalderop.nl e-negociacao.com.br allbuy.dk josephinajewelry.nl e-renegocie.com.br anna-hjorth.dk kiesrijk.nl zaaztelecom.com.br annebrauner.dk liveatamsterdamsebos.nl nic.br australian-bodycare.dk mailmore.nl registro.br avabeauty.dk mailon.nl activfitness-news.ch bambustoej.dk mailplus.nl blackout-bonusclub.ch barons.dk managementboek.nl gmx.ch bigsaver.dk markteffectmail.nl handy-abovergleich.ch bog.dk mcmta.nl hostpoint.ch camillakroeyer.dk mijndomein.nl infomaniak.ch casanova.dk minbzk.nl msochrono.ch champagneklubben.dk mindef.nl open.ch computerworld.dk mm1.nl protonmail.ch damask.dk nieuwsservice-rvo.nl sherlockhomes.ch danielspengetips.dk notbranded.nl sms-gagnant.ch danskebank.dk ns.nl switch.ch denmentalekriger.dk nuudcare.nl wog.ch densidsteflaske.dk nuwegexclusief.nl simplelogin.co dfi.dk opnaarwonderland.nl albourne.com dressforsuccess.dk ouderenfonds.nl anonaddy.com ens.dk ouderportaal.nl ansigtsyogaonline.com fibianet.dk overheid.nl canva-facile.com foraeldresparring.dk oxilionhosted.nl cm.com gastrotools.dk partijvoordedieren.nl collarofsweden.com globestudios.dk partnermail.nl connectsb.com hook-up.dk podiumcadeaukaart.nl danskebank.com hostedsepo.dk pp-prd.nl datev.com idelig.dk previder.nl denhaag.com iphoneopladere.dk prorun-mail.nl exegy.com kagegrisen.dk protislank.nl farmergracy.com kk.dk quicknet.nl fastware-hosting.com kodbilen.dk rdw.nl flaneurhomme.com konkurspriser.dk rijksoverheid.nl fromanteel-watches.com kystfisken.dk rvig.nl gmx.com labelking.dk rvo.nl goodforme.com lacabra.dk sans-mail.nl habr.com lederstof.dk schuurman-schoenen.nl headachecalendar.com mobilcovers.dk shampoobars.nl highcharts.com musclehouse.dk shapeit.nl infomaniak.com netic.dk shoesme.nl ingthink.com nfinitybeauty.dk sietskescholten.nl intakt.com nimara.dk sizzthebrand.nl itskaos.com nordd.dk smartwatchbanden.nl johnbeerens.com nota.dk sportrusten.nl joomlapolis.com opdagverden.dk ssonet.nl jula.com pengeogfrihed.dk stater.nl kabayarefashion.com perfectjeans.dk svb.nl kae-cosmetici.com sengefabrikken.dk technicus.nl kantarresearch.com seniornews.dk telefoonglaasje.nl kheaa.com shapeit.dk teslin.nl leszexpertsfle.com skjold-burne.dk thealphamen.nl librti.com smoon.dk toms.nl mail.com sneakerzone.dk transip.nl mailzerver.com stil.dk triodos.nl mixx.com stpt.dk truetickets.nl mplbeauty.com strongcurves.dk tudelft.nl nanolearning.com sygeforsikring.dk uitgeverijpica.nl nine-pine.com thenap.dk upcmail.nl novashops.com thesneakerstore.dk uvt.nl one.com trueliving.dk uwv.nl orsys.com venderbys.dk vacaturesonline.nl ottobredesign.com vin-huset.dk vandale.nl pieter-pot.com vind.dk vimexx.nl polyas.com yuaiahaircare.dk vluchtelingenwerk.nl pompomlondon.com tilburguniversity.edu vogeldagboek.nl protonmail.com maarahvapood.ee voor14.nl run-motion.com minuvalik.ee vunzigedeuntjes.nl sankakucomplex.com surveyturtle.ee watchbandjes-shop.nl scorecloud.com turunduslabor.ee waternet.nl serverclienti.com zone.ee wehkampfinance.nl sneakerjeans.com myownconference.email werkzoeken.nl solvinity.com spam-filter.email wonenmetlef.nl speciale-offre.com spotler.email ziggo.nl sportnotch.com nuudcare.es zorgmail.nl stasdock.com triodos.es zoweg-mail.nl stater.com egu.eu annabellstefanussen.no stellarequipment.com iaccept.eu babybanden.no tcs.com litebit.eu bergengokart.no the-vfl.com outletdelcalcio.eu bull-ski-kajakk.no theintercept.com zerolime.eu chillout.no thepcw.com zone.eu domeneshop.no thepcwholesale.com zonevs.eu dressmykid.no thesmmacademy.com danskebank.fi godvar.no thingsilikethingsilove.com handelsbanken.fi guttelus.no triodos.com metaburn.fi hyttefeber.no tutanota.com rockdenim.fi idrettenonline.no up2staff.com ac-strasbourg.fr lagerpriser.no veganallsorts.com braceletsmartwatch.fr marikrogshus.no vivaldi.com compagnie-des-sens.fr modostore.no webcruiter.com edtm-actu.fr mystuff.no win-rar.com nuudcare.fr nordicprint.no xfinity.com oo2.fr norskgrammatikk.no xfinityhomesecurity.com passefranceallemagne.fr raskebriller.no xfinitymobile.com privea.fr rushtrampoline.no bncr.fi.cr tid.gov.hk sillysanta.no airbank.cz fidesz.hu smaaungene.no akce-incomputer.cz italiamail.hu spillfabrikken.no amenit.cz bluebiz.info strikkia.no balikovna.cz eurocontrol.int suksessmednetthandel.no bewooden.cz infinex.io analysedanmark.nu cokoladovnajanek.cz nuudcare.it atelkamera.nu cpost.cz neolink.link goget.nu creammy.cz nic.lv hallbarhalsa.nu cro.cz anonaddy.me lenhud.nu csob.cz pm.me agirpourlenvironnement.org cuni.cz proton.me checkmyads.org dashofer.cz army.mil debian.org dedra.cz dla.mil freebsd.org e-kondomy.cz dma.mil fridaysforfuture.org ecps.cz health.mil gentoo.org fio.cz jten.mil ietf.org hobynaradi.cz mail.mil mailbox.org hypotecnibanka.cz navy.mil mailop.org innogy.cz nga.mil netbsd.org itesco.cz osd.mil openssl.org kb.cz socom.mil ozlabs.org klenotyaurum.cz uscg.mil postfix.org klubpevnehozdravi.cz usmc.mil samba.org ksporting.cz apnic.net torproject.org manymail.cz comcast.net biotechnologia.com.pl maxmax.cz ewetel.net mobily.com.sa mbank.cz ficbook.net arbetsformedlingen.se mfcr.cz fivem.net australian-bodycare.se mkluzkoviny.cz gmx.net bearplay.se mojedatovaschranka.cz habramail.net bearplayshop.se mrakyhracek.cz hr-manager.net bidflow.se muni.cz inexio.net bilprovningen.se nic.cz intares.net crtzoo.se nilia.cz mailanyone.net ecster.se nku.cz masterinter.net egensajt.se o2.cz mijngezondheid.net ellevio.se opravdovezlociny.cz mpssec.net epochtimes-mejl.se optimail.cz octopoos.net fashion-copenhagen.se outlet-alpine.cz procurios.net handelsbanken.se p-info.cz riseup.net hellomantle.se pivoteka.cz s-qrc.net jaramba.se poptavej.cz soverin.net klasspengar.se pre.cz speedkom.net koreanbeauty.se rozhlas.cz t-2.net kulturaktiebolaget.se scrptd.cz amsterdam.nl livlyclothing.se smtp.cz amsterdamwinefestival.nl lnu.se sparkys.cz aquastorexl.nl lomervarde.se stoklasa.cz bankhoesdiscounter.nl loopia.se thinline.cz belastingdienst.nl malarfabriken.se tiscali.cz beterinbeleggen.nl merchsweden.se vas-server.cz beterspellen.nl minmyndighetspost.se virusfree.cz bewustpuur.nl nordicprint.se vitalpoint.cz bhosted.nl nordicsheep.se vshosting.cz blushfashionstore.nl performcollection.se zafido.cz bobo.nl polisen.se zlocinozrouti.cz body-supplies.nl refitness.se zonky.cz bolerolimonadewinkel.nl sillysanta.se bayern.de boozyshop.nl silverdotter.se brandenburg.de box.nl skatteverket.se bund.de bruut.nl skolverket.se bundesregierung.de caracamilla.nl snbostader.se datev.de carre.nl soleplus.se datronic.de casema.nl teeshoppen.se dfn.de cbr.nl teknikdelar.se elster.de chello.nl theletter.se ewetel.de clubplanner.nl websupport.se fau.de csvjongholland.nl agatinsvet.sk freenet.de degros.nl fio.sk gmx.de derooijfotografie.nl lenivakucharka.sk hi7.de desan.nl mklozkoviny.sk huellen-shop.de dictu.nl nakupujzdravo.sk jpberlin.de digibtw.nl penzionmara.sk lmu.de digid.nl rondogo.sk lrz.de dimehouse.nl toptop.sk mail.de domain-registry.nl zapardrobnych.sk mensa.de dorcas.nl zeit-des-wandels.tv mindline-analytics.de duo.nl clientnews3.co.uk mpg.de eabstest.nl millieandblake.co.uk posteo.de efactuurdirect.nl nuudcare.co.uk ruhr-uni-bochum.de esuals.nl thewordman.co.uk smartwatcharmbaender.de extinctionrebellion.nl triodos.co.uk stwm.de ezorg.nl nuudcare.us sys4.de frfc1908.nl quantum-services.us taures.de hobbygigant.nl ru.ac.za tu-darmstadt.de home.nl