Summary: The DANE domain count is now 3,884,225 (c.f. 3,812,790 last
month). This is in good measure thanks to one.com, who've
over the past two months DANE-enabled over 100,000 new domains.
The number of domains that return DNSSEC-validated replies in
response to MX queries is 22,676,526 (up from 22,203,497 last
month). Thus DANE TLSA is deployed on ~17.12% of domains with
DNSSEC. For more stats, see <https://stats.dnssec-tools.org/>.
[ See the Credits[0] list below my signature. ]
As of today, I count ~3.88 million domains with correct SMTP DANE TLSA records
at every primary MX host that accepts connections[1]. As expected, the bulk of
the DANE domains are hosted by the DNS/email hosting providers who've enabled
DANE support for the customer domains they host. The top 20 MX host providers
by domain count are below.
This month Last Month
---------- ----------
1324503 one.com 1248752 one.com
296480 hostpoint.ch 294782 hostpoint.ch
201194 infomaniak.ch 200314 infomaniak.ch
170591 transip.nl 170011 transip.nl
169148 mijndomein.nl 169976 mijndomein.nl
145940 argewebhosting.nl 147502 argewebhosting.nl
142604 jouwweb.nl 139123 jouwweb.nl
133765 simply.com 135347 simply.com
111038 hostnet.nl 110750 hostnet.nl
109875 domeneshop.no 109742 domeneshop.no
105482 loopia.se 105546 loopia.se
91989 webhostingserver.nl 92424 webhostingserver.nl
82865 forpsi.com 82448 forpsi.com
72170 zxcs.nl 71985 zxcs.nl
41229 protonmail.ch 40359 protonmail.ch
40369 antagonist.nl 40321 active24.com
40341 active24.com 40309 antagonist.nl
37912 webreus.nl 38217 webreus.nl
30944 pcextreme.nl 31292 pcextreme.nl
28694 xel.nl 28743 xel.nl
The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .br, .cz, .fr, .eu, .no, .be,
.pl, .de and .uk. Speaking of countries, the IPv4 GeoIP distribution of
DANE-enabled MX hosts shows the below top 20 countries (each unique IP
address is counted, so multi-homed MX hosts are perhaps somewhat
over-represented).
This month Last month
----------- ----------
11221 TOTAL 11161 TOTAL
3506 DE, Germany 3471 DE, Germany
1883 NL, Netherlands 1882 US, United States
1870 US, United States 1879 NL, Netherlands
803 FR, France 810 FR, France
439 CZ, Czechia 431 CZ, Czechia
368 GB, United Kingdom 373 GB, United Kingdom
260 FI, Finland 254 FI, Finland
207 CA, Canada 215 CA, Canada
204 AT, Austria 192 AT, Austria
157 SE, Sweden 152 SE, Sweden
148 CH, Switzerland 143 CH, Switzerland
142 DK, Denmark 140 AU, Australia
138 AU, Australia 136 DK, Denmark
123 SG, Singapore 114 SG, Singapore
89 PL, Poland 85 RU, Russia
83 RU, Russia 84 PL, Poland
61 JP, Japan 64 JP, Japan
49 NO, Norway 50 NO, Norway
42 BR, Brazil 44 BR, Brazil
41 IT, Italy 41 IT, Italy
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by
DANE MX host IPv6 GeoIP are:
This month Last month
---------- ----------
8772 TOTAL 8691 TOTAL
3787 NL, Netherlands 3709 NL, Netherlands
2551 DE, Germany 2510 DE, Germany
847 US, United States 879 US, United States
360 FR, France 374 FR, France
184 CZ, Czechia 188 CZ, Czechia
182 GB, United Kingdom 179 GB, United Kingdom
111 FI, Finland 110 FI, Finland
81 CA, Canada 81 CA, Canada
73 SE, Sweden 71 SE, Sweden
71 AU, Australia 69 AU, Australia
60 CH, Switzerland 61 CH, Switzerland
49 SG, Singapore 44 AT, Austria
49 AT, Austria 43 JP, Japan
38 JP, Japan 41 RU, Russia
27 DK, Denmark 39 SG, Singapore
25 RU, Russia 25 DK, Denmark
25 RO, Romania 24 NO, Norway
24 NO, Norway 21 RO, Romania
21 UA, Ukraine 19 IE, Ireland
18 IE, Ireland 17 BR, Brazil
There are 9,245 unique zones (9,220 last month) in which the underlying
MX hosts are found. This counts each of the above providers as just one
zone, so is a measure of the breadth of adoption in terms of
organizations deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 20,077 (19,823 last
month). These cover 20,367 distinct MX hosts (20,113 last month, some
MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's
email transparency report is 1,011 (this is my ad-hoc criterion for a
domain being a large-enough actively used email domain). Of these, 565
are in recent (last 90 days of) reports (see [2] below my signature).
Of the ~3.88 million DANE domains, 14,304 (12,922 last month) have
"partial" TLSA records, that cover only a subset of the (secondary) MX
hosts. While this protects traffic to some of the MX hosts, such
domains are still vulnerable to the usual active attacks via the
remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer
STARTTLS (even though TLSA records are published) stands today at 1,796
(1,660 last month). Some of these have additional MX hosts that don't
have broken TLSA records, so mail can still arrive via the remaining MX
hosts. The affected domain counts for the top 10 problem MX hosts are:
139 mx2.solutive.nl
137 mx1.dotxs.net
110 mail.blueconsulting.cz
67 mx1.mail-services.net
35 mx1.mdbraber.com
23 fsn1-c04.xemo-net.de
22 semark.dk
20 mx1.logging.ch
18 web2.sys.ccs-baumann.de
16 home.lutra.it
To avoid email outages, please make sure to monitor the validity of your
own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes
https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md
https://www.mail-archive.com/[email protected]/msg00308.html
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022/17
https://www.mail-archive.com/[email protected]/msg00285.html
https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1
https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of
"real" email domains with bad DNSSEC support stands at 1,805 (2,018 last
month). The top 10 name server operators with problem domains are:
This Month Last month
---------- ----------
1312 neostrada.nl 1500 neostrada.nl
96 worldnic.com 99 worldnic.com
66 ebola.cz 67 ebola.cz
47 epik.com 47 epik.com
40 openprovider.nl 40 openprovider.nl
33 dnssrv.nl 40 dnssrv.nl
15 sectigoweb.com 15 sectigoweb.com
14 register.com 15 register.com
10 ispapi.net 14 std-service.de
9 axc.nl 11 ispapi.net
If anyone has good contacts at some of these providers, please encourage
them to remediate not only the broken domains (I can send them a list),
but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of
existence appears in the last 120 days of Google transparency reports:
mailazy.net
--
Viktor.
[0] Credits: The coverage of DNSSEC domains continues to improve with
ongoing data support from Paul Vixie of Farsight Security. Credits also
due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH,
.COM, .DK, .FI, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data
sources of ccTLD signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down,
presumably as a hurdle to botnet SMTP code that gives up where real MTAs
might persist. I am not a fan of this type of defence (it can also
impose undue latency on legitimate email). However, provided the dead
hosts still have TLSA records, (which don't need to match anything, just
need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency
reports:
univie.ac.at uni-erlangen.de
interconnect.nl
gmx.at uni-muenchen.de
interim-netwerk.nl
vbv.at vicinityclo.de
jo-lyn.nl
vorsorgekasse.at web.de
kaagenbraassem.nl
boozyshop.be westlotto.de
kiesrijk.nl
vanbreda.be aeldresagen.dk
kwo.nl
digsys.bg allbuy.dk
ledlichtstunter.nl
cetelemnegocie.com.br annes-atelier.dk
ledstripxl.nl
dwvmail.com.br australian-bodycare.dk
lico.nl
e-negociacao.com.br avabeauty.dk
luxiez.nl
e-renegocie.com.br bambustoej.dk
mail-studio.nl
informativoclicksophia.com.br barons.dk
mailmore.nl
nic.br bigsaver.dk
mailon.nl
registro.br bog.dk
mailplus.nl
20km.ch buchcopenhagen.dk
managementboek.nl
activfitness-news.ch calisweats.dk
markteffectmail.nl
blackout-bonusclub.ch camillakroeyer.dk
mcmta.nl
cbd420.ch computerworld.dk
messen.nl
coronavirusensuisse.ch damask.dk
mijndomein.nl
creditum.ch danskebank.dk
minbzk.nl
gmx.ch densidsteflaske.dk
mindef.nl
hostpoint.ch dfi.dk
mm1.nl
infomaniak.ch dk-hostmaster.dk
nederweert.nl
migros-runnwin.ch eftcentret.dk
nieuwsservice-rvo.nl
msochrono.ch ens.dk
nmnhevents.nl
open.ch fibianet.dk
notbranded.nl
protonmail.ch foraeldresparring.dk
ns.nl
sherlockhomes.ch fvst.dk
nubeterengels.nl
sms-gagnant.ch gastrotools.dk
nuudcare.nl
switch.ch globestudios.dk
nuwegexclusief.nl
santeglobale.club idelig.dk
otys.nl
simplelogin.co incover.dk
ouderenfonds.nl
albourne.com iphoneopladere.dk
ouderportaal.nl
anonaddy.com kodbilen.dk
overheid.nl
ansigtsyogaonline.com konkurspriser.dk
oxilionhosted.nl
aotax.com kystfisken.dk
parlement.nl
boozyshop.com labelking.dk
partijvoordedieren.nl
cm.com lacabra.dk
partnermail.nl
colourfulrebel.com lbst.dk
paypro.nl
connectsb.com lncrew.dk
pipdenhaag.nl
danskebank.com lysetikloster.dk
podiumcadeaukaart.nl
datev.com mobilcovers.dk
politie.nl
denhaag.com mobilepay.dk
pp-prd.nl
fabfilter.com musclehouse.dk
previder.nl
farmergracy.com netic.dk
prorun-mail.nl
fastware-hosting.com nickolinecamille.dk
quicknet.nl
gmx.com nimara.dk
rdw.nl
groed.com nordd.dk
revolt.nl
habr.com nota.dk
rijksoverheid.nl
highcharts.com punktum.dk
rivm.nl
infomaniak.com seniornews.dk
rvo.nl
ingthink.com shapeit.dk
sans-mail.nl
intakt.com sitnet.dk
schoudercom.nl
johnbeerens.com skjold-burne.dk
schuurman-schoenen.nl
jula.com smoon.dk
shampoobars.nl
kabayarefashion.com sneakerzone.dk
shapeit.nl
kolabnow.com soelvstein.dk
shirtbyhand.nl
librti.com stil.dk
shoesme.nl
mactabeauty.com sundhedspolitisktidsskrift.dk
sidn.nl
mail.com thenap.dk
sietskescholten.nl
medimeisterschaften.com thesneakerstore.dk
sizzthebrand.nl
mplbeauty.com trueliving.dk
smartwatchbanden.nl
nanolearning.com venderbys.dk
soclever.nl
nine-pine.com vin-huset.dk
sportrusten.nl
one.com vind.dk
ssonet.nl
orsys.com yuaiahaircare.dk
stater.nl
pieter-pot.com tilburguniversity.edu
svb.nl
pompomlondon.com just.ee
telefoonglaasje.nl
ppcpcv.com kohus.ee
thealphamen.nl
protonmail.com mkm.ee
transip.nl
protonvpn.com rik.ee
triodos.nl
renworkshops.com turunduslabor.ee
truetickets.nl
run-motion.com myownconference.email
tudelft.nl
runbox.com spam-filter.email
tweedekamer.nl
sankakucomplex.com spotler.email
uitgeverijpica.nl
scorecloud.com nuudcare.es
upcmail.nl
serverclienti.com triodos.es
uvt.nl
solvinity.com egu.eu
uwv.nl
speciale-offre.com finesoftware.eu
venauto.nl
stasdock.com iaccept.eu
vimexx.nl
stater.com litebit.eu
vlissingen.nl
stellarequipment.com zonevs.eu
watchbandjes-shop.nl
t-2.com danskebank.fi
waternet.nl
tcs.com handelsbanken.fi
xel.nl
teamfdm.com metaburn.fi
ziggo.nl
thalesgroup.com tarjousrinki.fi
zorgmail.nl
theintercept.com traficom.fi
8-bits.no
thepcw.com ac-strasbourg.fr
annabellstefanussen.no
thepcwholesale.com braceletsmartwatch.fr
babybanden.no
thesmmacademy.com compagnie-des-sens.fr
bergengokart.no
triodos.com edtm-actu.fr
bull-ski-kajakk.no
tutanota.com nuudcare.fr
chillout.no
up2staff.com oo2.fr
domeneshop.no
veganallsorts.com passefranceallemagne.fr
frivannsliv.no
vivaldi.com privea.fr
godvar.no
webcruiter.com fidesz.hu
guttelus.no
webmailph.com italiamail.hu
handelsbanken.no
xfinity.com diyguru.in
helsefysio.no
xfinityhomesecurity.com bluebiz.info
hyttefeber.no
xfinitymobile.com eurocontrol.int
idrettenonline.no
bncr.fi.cr nuudcare.it
kashmina.no
airbank.cz neolink.link
lagerpriser.no
akce-incomputer.cz anonaddy.me
marikrogshus.no
avatech.cz pm.me
mystuff.no
balikovna.cz proton.me
nordicprint.no
bewooden.cz army.mil
norskgrammatikk.no
cokoladovnajanek.cz dla.mil
raskebriller.no
cpost.cz health.mil
rushtrampoline.no
csob.cz jten.mil
sillysanta.no
cuni.cz mail.mil
smaaungene.no
dashofer.cz navy.mil
spillfabrikken.no
dedra.cz nga.mil
strikkia.no
e-kondomy.cz osd.mil
webcruitermail.no
fio.cz socom.mil
atelkamera.nu
fishmax.cz uscg.mil
goget.nu
gov.cz usmc.mil
aarding.org
gynkrup.cz benjaminfulford.net
agirpourlenvironnement.org
hypotecnibanka.cz comcast.net
debian.org
innogy.cz ewetel.net
eduroam.org
itesco.cz ficbook.net
freebsd.org
justice.cz fivem.net
fridaysforfuture.org
kb.cz gmx.net
gentoo.org
klenotyaurum.cz graphistepro.net
ietf.org
klubpevnehozdravi.cz habramail.net
isc.org
ksporting.cz hr-manager.net
mailbox.org
manymail.cz is-bg.net
mailop.org
mbank.cz masterinter.net
netbsd.org
mfcr.cz mijngezondheid.net
openssl.org
mkluzkoviny.cz mpssec.net
ozlabs.org
mojedatovaschranka.cz procurios.net
postfix.org
mrakyhracek.cz relai-smtp.net
samba.org
muni.cz ripe.net
torproject.org
nic.cz riseup.net
biotechnologia.com.pl
o2.cz soverin.net
brebank.com.pl
optimail.cz speedkom.net
anacom.pt
outlet-alpine.cz t-2.net
mobily.com.sa
p-info.cz yourdomainprovider.net
advania.se
pivoteka.cz 123autoparts.nl
arbetsformedlingen.se
poptavej.cz amsterdam.nl
australian-bodycare.se
pre.cz aquastorexl.nl
bearplayshop.se
psp.cz argeweb.nl
bilprovningen.se
scrptd.cz belastingdienst.nl
crtzoo.se
senat.cz beterspellen.nl
du.se
server4u.cz bhosted.nl
ecster.se
shopex.cz biblionetdrenthe.nl
ellevio.se
smtp.cz blushfashionstore.nl
fashion-copenhagen.se
stoklasa.cz bobo.nl
handelsbanken.se
tiscali.cz body-supplies.nl
hellomantle.se
vas-server.cz boekwinkeltjes.nl
huskvarnafolketspark.se
virusfree.cz boksen.nl
koreanbeauty.se
vitalpoint.cz boozyshop.nl
lnu.se
vshosting.cz box.nl
lomervarde.se
web4u.cz bronckhorst.nl
loopia.se
zafido.cz bruut.nl
merchsweden.se
zdravestravovani.cz burgernet.nl
minmyndighetspost.se
zlate-mince.cz caracamilla.nl
nordicprint.se
zonky.cz carre.nl
performcollection.se
bayern.de casema.nl
polisen.se
brandenburg.de cbr.nl
refitness.se
bund.de chello.nl
silverdotter.se
bundesregierung.de clubplanner.nl
skatteverket.se
datev.de degros.nl
skolverket.se
deutsch-franzoesischer-freundschaftspass.de deijsvogel.nl
snbostader.se
dfn.de derooijfotografie.nl
soleplus.se
ekom21.de desan.nl
spelfabrik.se
elster.de dictu.nl
sunet.se
ewetel.de digibtw.nl
svenskhusman.se
fau.de digid.nl
teknikdelar.se
fh-rosenheim.de dimehouse.nl
theletter.se
freenet.de domain-registry.nl
websupport.se
gmx.de dorcas.nl
agatinsvet.sk
huellen-shop.de duo.nl
fio.sk
jpberlin.de eabstest.nl
mklozkoviny.sk
lrz.de eduid.nl
rondogo.sk
mail.de esuals.nl
satro.sk
mensa.de expeditionfestival.nl
toptop.sk
mpg.de extinctionrebellion.nl
vyvado.sk
posteo.de ezorg.nl
zapardrobnych.sk
ruhr-uni-bochum.de fivecityspa.nl
clientnews3.co.uk
sifjakobs.de glamouryourhair.nl
handelsbanken.co.uk
smartwatcharmbaender.de haarlem.nl
herantapimesra.co.uk
sys4.de hobbygigant.nl
millieandblake.co.uk
telefonseelsorge.de home.nl
nuudcare.co.uk
th-rosenheim.de hoogenboezem-nieuwsbrieven.nl
thewordman.co.uk
tu-darmstadt.de hr.nl
triodos.co.uk
tum.de hro.nl
nuudcare.us
tutanota.de huurexpert.nl
quantum-services.us
uni-augsburg.de hz.nl
ru.ac.za
uni-bielefeld.de
