Summary: The DANE domain count is now 3,912,433 (c.f. 3,884,225 last
month).
The number of domains that return DNSSEC-validated replies in
response to MX queries is 22,903,540 (up from 22,676,526 last
month). Thus DANE TLSA is deployed on ~17.08% of domains with
DNSSEC. For more stats, see <https://stats.dnssec-tools.org/>.
[ See the Credits[0] list below my signature. ]
As of today, I count ~3.91 million domains with correct SMTP DANE TLSA records
at every primary MX host that accepts connections[1]. As expected, the bulk of
the DANE domains are hosted by the DNS/email hosting providers who've enabled
DANE support for the customer domains they host. The top 20 MX host providers
by domain count are below.
This month Last Month
---------- ----------
1333382 one.com 1324503 one.com
299458 hostpoint.ch 296480 hostpoint.ch
203039 infomaniak.ch 201194 infomaniak.ch
171198 transip.nl 170591 transip.nl
168858 mijndomein.nl 169148 mijndomein.nl
146592 jouwweb.nl 145940 argewebhosting.nl
144707 argewebhosting.nl 142604 jouwweb.nl
132528 simply.com 133765 simply.com
111147 hostnet.nl 111038 hostnet.nl
109837 domeneshop.no 109875 domeneshop.no
105606 loopia.se 105482 loopia.se
91554 webhostingserver.nl 91989 webhostingserver.nl
82952 forpsi.com 82865 forpsi.com
73635 zxcs.nl 72170 zxcs.nl
42379 protonmail.ch 41229 protonmail.ch
40463 antagonist.nl 40369 antagonist.nl
40012 active24.com 40341 active24.com
37765 webreus.nl 37912 webreus.nl
30673 pcextreme.nl 30944 pcextreme.nl
28631 xel.nl 28694 xel.nl
The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl,
.de and .uk. Speaking of countries, the IPv4 GeoIP distribution of
DANE-enabled MX hosts shows the below top 20 countries (each unique IP
address is counted, so multi-homed MX hosts are perhaps somewhat
over-represented).
This month Last month
----------- ----------
11268 TOTAL 11221 TOTAL
3525 DE, Germany 3506 DE, Germany
1889 NL, Netherlands 1883 NL, Netherlands
1866 US, United States 1870 US, United States
825 FR, France 803 FR, France
444 CZ, Czechia 439 CZ, Czechia
368 GB, United Kingdom 368 GB, United Kingdom
264 FI, Finland 260 FI, Finland
203 CA, Canada 207 CA, Canada
198 AT, Austria 204 AT, Austria
160 SE, Sweden 157 SE, Sweden
149 CH, Switzerland 148 CH, Switzerland
143 DK, Denmark 142 DK, Denmark
141 AU, Australia 138 AU, Australia
123 SG, Singapore 123 SG, Singapore
85 PL, Poland 89 PL, Poland
84 RU, Russia 83 RU, Russia
65 JP, Japan 61 JP, Japan
49 NO, Norway 49 NO, Norway
48 BR, Brazil 42 BR, Brazil
40 IT, Italy 41 IT, Italy
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by
DANE MX host IPv6 GeoIP are:
This month Last month
---------- ----------
8828 TOTAL 8772 TOTAL
3802 NL, Netherlands 3787 NL, Netherlands
2564 DE, Germany 2551 DE, Germany
847 US, United States 847 US, United States
364 FR, France 360 FR, France
183 GB, United Kingdom 184 CZ, Czechia
177 CZ, Czechia 182 GB, United Kingdom
115 FI, Finland 111 FI, Finland
83 CA, Canada 81 CA, Canada
80 SE, Sweden 73 SE, Sweden
72 AU, Australia 71 AU, Australia
65 CH, Switzerland 60 CH, Switzerland
48 SG, Singapore 49 SG, Singapore
48 AT, Austria 49 AT, Austria
43 RU, Russia 38 JP, Japan
42 JP, Japan 27 DK, Denmark
30 RO, Romania 25 RU, Russia
27 DK, Denmark 25 RO, Romania
24 NO, Norway 24 NO, Norway
19 BR, Brazil 21 UA, Ukraine
18 IE, Ireland 18 IE, Ireland
There are 9,324 unique zones (9,245 last month) in which the underlying
MX hosts are found. This counts each of the above providers as just one
zone, so is a measure of the breadth of adoption in terms of
organizations deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 20,191 (20,077 last
month). These cover 20,488 distinct MX hosts (20,367 last month, some
MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's
email transparency report is 1,028 (this is my ad-hoc criterion for a
domain being a large-enough actively used email domain). Of these, 562
are in recent (last 90 days of) reports (see [2] below my signature).
Of the ~3.91 million DANE domains, 14,246 (14,304 last month) have
"partial" TLSA records, that cover only a subset of the (secondary) MX
hosts. While this protects traffic to some of the MX hosts, such
domains are still vulnerable to the usual active attacks via the
remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer
STARTTLS (even though TLSA records are published) stands today at 1,796
(1,660 last month). Some of these have additional MX hosts that don't
have broken TLSA records, so mail can still arrive via the remaining MX
hosts. The affected domain counts for the top 10 problem MX hosts are:
148 mx1.systemhaus-ehst.de
138 mx2.dotxs.nl
110 mail.blueconsulting.cz
69 mx1.risse.cloud
35 mx1.mdbraber.com
23 mx1.dtsmail.me
23 fsn1-c04.xemo-net.de
22 semark.dk
19 web2.sys.ccs-baumann.de
18 mail.sig-io.nl
To avoid email outages, please make sure to monitor the validity of your
own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes
https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md
https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022/17
https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html
https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1
https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of
"real" email domains with bad DNSSEC support stands at 1,539 (1,805 last
month). The top 10 name server operators with problem domains are:
This Month Last month
---------- ----------
1131 neostrada.nl 1312 neostrada.nl
94 worldnic.com 96 worldnic.com
65 ebola.cz 66 ebola.cz
39 openprovider.nl 47 epik.com
16 dnssrv.nl 40 openprovider.nl
15 sectigoweb.com 33 dnssrv.nl
13 register.com 15 sectigoweb.com
10 ispapi.net 14 register.com
8 resolver.domains 10 ispapi.net
8 axc.nl 9 axc.nl
If anyone has good contacts at some of these providers, please encourage
them to remediate not only the broken domains (I can send them a list),
but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of
existence appears in the last 120 days of Google transparency reports:
mailazy.net
--
Viktor.
[0] Credits: The coverage of DNSSEC domains continues to improve with
ongoing data support from Paul Vixie of Farsight Security. Credits also
due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH,
.COM, .DK, .FI, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data
sources of ccTLD signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down,
presumably as a hurdle to botnet SMTP code that gives up where real MTAs
might persist. I am not a fan of this type of defence (it can also
impose undue latency on legitimate email). However, provided the dead
hosts still have TLSA records, (which don't need to match anything, just
need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency
reports:
univie.ac.at vicinityclo.de
huurexpert.nl
gmx.at web.de
hz.nl
vbv.at westlotto.de
ikdeburger.nl
vorsorgekasse.at aeldresagen.dk
interconnect.nl
atmozreunion.be allbuy.dk
interim-netwerk.nl
boozyshop.be annes-atelier.dk
jo-lyn.nl
vanbreda.be australian-bodycare.dk
kiesrijk.nl
digsys.bg avabeauty.dk
kwo.nl
cetelemnegocie.com.br bambustoej.dk
lcrdm.nl
dwvmail.com.br barons.dk
lico.nl
e-negociacao.com.br bigsaver.dk
liveatamsterdamsebos.nl
e-renegocie.com.br bog.dk
luxiez.nl
informativoclicksophia.com.br buchcopenhagen.dk
mail-studio.nl
nic.br calisweats.dk
mailmore.nl
registro.br camillakroeyer.dk
mailon.nl
activfitness-news.ch casanova.dk
mailplus.nl
blackout-bonusclub.ch computerworld.dk
managementboek.nl
coronavirusensuisse.ch damask.dk
markteffectmail.nl
creditum.ch danielspengetips.dk
mcmta.nl
gmx.ch danskebank.dk
messen.nl
hostpoint.ch datafordeler.dk
mijndomein.nl
infomaniak.ch def.dk
minbzk.nl
migros-runnwin.ch densidsteflaske.dk
mindef.nl
msochrono.ch dfi.dk
mm1.nl
open.ch dk-hostmaster.dk
nederweert.nl
protonmail.ch eftcentret.dk
netpoint.nl
sherlockhomes.ch ens.dk
netpointfactoring.nl
sms-gagnant.ch fibianet.dk
nieuwsservice-rvo.nl
switch.ch fvst.dk
nmnhevents.nl
simplelogin.co gastrotools.dk
notbranded.nl
albourne.com globestudios.dk
noties.nl
anonaddy.com idelig.dk
ns.nl
ansigtsyogaonline.com iphoneopladere.dk
nuudcare.nl
aotax.com konkurspriser.dk
nuwegexclusief.nl
boozyshop.com kystfisken.dk
otys.nl
cm.com labelking.dk
ouderenfonds.nl
colourfulrebel.com lacabra.dk
ouderportaal.nl
connectsb.com lbst.dk
overheid.nl
danskebank.com lederstof.dk
oxilionhosted.nl
datev.com lncrew.dk
parlement.nl
fabfilter.com lysetikloster.dk
partijvoordedieren.nl
farmergracy.com mobilcovers.dk
partnermail.nl
fastware-hosting.com mobilepay.dk
paypro.nl
fromanteel-watches.com musclehouse.dk
pipdenhaag.nl
gmx.com netic.dk
podiumcadeaukaart.nl
groed.com nickolinecamille.dk
politie.nl
habr.com nimara.dk
pp-prd.nl
highcharts.com nordd.dk
previder.nl
infomaniak.com nota.dk
prorun-mail.nl
ingthink.com opdagverden.dk
quicknet.nl
intakt.com punktum.dk
rdw.nl
johnbeerens.com seniornews.dk
revolt.nl
joomlapolis.com shapeit.dk
rijksoverheid.nl
jula.com sitnet.dk
rivm.nl
kabayarefashion.com skjold-burne.dk
rvo.nl
kolabnow.com smoon.dk
sans-mail.nl
librti.com sneakerzone.dk
schoudercom.nl
mactabeauty.com stil.dk
schuurman-schoenen.nl
mail.com thenap.dk
shampoobars.nl
mailzerver.com thesneakerstore.dk
shirtbyhand.nl
medimeisterschaften.com trueliving.dk
shoesme.nl
mixx.com venderbys.dk
sidn.nl
mplbeauty.com vin-huset.dk
sietskescholten.nl
nanolearning.com vind.dk
sizzthebrand.nl
nine-pine.com yuaiahaircare.dk
smartwatchbanden.nl
offshorecorptalk.com tilburguniversity.edu
soclever.nl
one.com just.ee
sportrusten.nl
orsys.com kohus.ee
ssonet.nl
pieter-pot.com rik.ee
stater.nl
pompomlondon.com turunduslabor.ee
svb.nl
ppcpcv.com myownconference.email
technicus.nl
protonmail.com spam-filter.email
telefoonglaasje.nl
protonvpn.com spotler.email
thealphamen.nl
renworkshops.com talentech.email
transip.nl
run-motion.com nuudcare.es
truetickets.nl
runbox.com egu.eu
tudelft.nl
sankakucomplex.com finesoftware.eu
tweedekamer.nl
scorecloud.com iaccept.eu
uitgeverijpica.nl
serverclienti.com litebit.eu
upcmail.nl
solvinity.com zonevs.eu
uvt.nl
speciale-offre.com danskebank.fi
uwv.nl
stasdock.com handelsbanken.fi
vacaturesonline.nl
stater.com metaburn.fi
vimexx.nl
stellarequipment.com raumanteatteri.fi
watchbandjes-shop.nl
tcs.com tarjousrinki.fi
waternet.nl
theintercept.com traficom.fi
werkzoeken.nl
thepcw.com ac-strasbourg.fr
ziggo.nl
thepcwholesale.com braceletsmartwatch.fr
zorgmail.nl
thesmmacademy.com compagnie-des-sens.fr
zoweg-mail.nl
tutanota.com edtm-actu.fr
8-bits.no
up2staff.com nuudcare.fr
annabellstefanussen.no
veganallsorts.com oo2.fr
babybanden.no
vivaldi.com passefranceallemagne.fr
bergengokart.no
webcruiter.com privea.fr
bull-ski-kajakk.no
webmailph.com tid.gov.hk
chillout.no
win-rar.com fidesz.hu
domeneshop.no
workvector.com italiamail.hu
frivannsliv.no
xfinity.com bluebiz.info
godvar.no
xfinityhomesecurity.com eurocontrol.int
guttelus.no
xfinitymobile.com infinex.io
handelsbanken.no
bncr.fi.cr rootnet.io
helsefysio.no
airbank.cz nuudcare.it
hyttefeber.no
akce-incomputer.cz neolink.link
idrettenonline.no
avatech.cz anonaddy.me
kashmina.no
balikovna.cz pm.me
lagerpriser.no
bewooden.cz proton.me
marikrogshus.no
cermat.cz army.mil
mystuff.no
cokoladovnajanek.cz dla.mil
nordicprint.no
cpost.cz health.mil
norskgrammatikk.no
csob.cz jten.mil
raskebriller.no
cuni.cz mail.mil
rushtrampoline.no
dashofer.cz navy.mil
sillysanta.no
dedra.cz nga.mil
smaaungene.no
e-kondomy.cz osd.mil
spillfabrikken.no
fio.cz socom.mil
strikkia.no
fishmax.cz uscg.mil
atelkamera.nu
gynkrup.cz usmc.mil
fitnessnu.nu
hypotecnibanka.cz benjaminfulford.net
goget.nu
innogy.cz comcast.net
aarding.org
itesco.cz ewetel.net
agirpourlenvironnement.org
justice.cz ficbook.net
debian.org
kb.cz fivem.net
eduroam.org
klenotyaurum.cz gmx.net
freebsd.org
klubpevnehozdravi.cz graphistepro.net
fridaysforfuture.org
ksporting.cz habramail.net
gentoo.org
manymail.cz hr-manager.net
ietf.org
mbank.cz mailanyone.net
isc.org
mfcr.cz masterinter.net
mailbox.org
mkluzkoviny.cz mijngezondheid.net
mailop.org
mojedatovaschranka.cz mpssec.net
netbsd.org
mrakyhracek.cz procurios.net
openssl.org
muni.cz relai-smtp.net
ozlabs.org
nic.cz ripe.net
postfix.org
o2.cz riseup.net
samba.org
optimail.cz soverin.net
torproject.org
outlet-alpine.cz speedkom.net
biotechnologia.com.pl
p-info.cz t-2.net
brebank.com.pl
pivoteka.cz yourdomainprovider.net
mobily.com.sa
poptavej.cz amsterdam.nl
arbetsformedlingen.se
pre.cz aquastorexl.nl
australian-bodycare.se
psp.cz argeweb.nl
bearplayshop.se
scrptd.cz belastingdienst.nl
bilprovningen.se
senat.cz beterspellen.nl
du.se
smtp.cz bewustpuur.nl
ecster.se
stoklasa.cz bhosted.nl
ellevio.se
tiscali.cz biblionetdrenthe.nl
fashion-copenhagen.se
vas-server.cz blushfashionstore.nl
handelsbanken.se
virusfree.cz bobo.nl
hellomantle.se
vitalpoint.cz body-supplies.nl
huskvarnafolketspark.se
vshosting.cz boekwinkeltjes.nl
koreanbeauty.se
web4u.cz bolerolimonadewinkel.nl
lnu.se
zafido.cz boozyshop.nl
lomervarde.se
zdravestravovani.cz box.nl
loopia.se
zonky.cz bruut.nl
merchsweden.se
bayern.de burgernet.nl
minmyndighetspost.se
brandenburg.de caracamilla.nl
naprapatlandslaget.se
bund.de carre.nl
nordicprint.se
bundesregierung.de casema.nl
performcollection.se
datev.de cbr.nl
polisen.se
deutsch-franzoesischer-freundschaftspass.de chello.nl
silverdotter.se
dfn.de clubplanner.nl
skatteverket.se
ekom21.de degros.nl
skolverket.se
elster.de deijsvogel.nl
snbostader.se
ewetel.de deonlinetandarts.nl
soleplus.se
fau.de derooijfotografie.nl
sunet.se
fh-rosenheim.de desan.nl
svenskhusman.se
freenet.de dewoningzoeker.nl
teknikdelar.se
gmx.de dictu.nl
theletter.se
huellen-shop.de digid.nl
websupport.se
jpberlin.de dimehouse.nl
agatinsvet.sk
lmu.de dorcas.nl
fio.sk
lrz.de druten.nl
kadernickyservis.sk
mail.de duo.nl
lenivakucharka.sk
mensa.de eabstest.nl
mklozkoviny.sk
mpg.de eduid.nl
rondogo.sk
posteo.de esuals.nl
satro.sk
ruhr-uni-bochum.de expeditionfestival.nl
toptop.sk
smartwatcharmbaender.de extinctionrebellion.nl
vyvado.sk
sys4.de ezorg.nl
zapardrobnych.sk
telefonseelsorge.de fivecityspa.nl
clientnews3.co.uk
th-rosenheim.de glamouryourhair.nl
herantapimesra.co.uk
tu-darmstadt.de haarlem.nl
millieandblake.co.uk
tum.de hobbygigant.nl
nuudcare.co.uk
tutanota.de home.nl
thewordman.co.uk
uni-augsburg.de hoogenboezem-nieuwsbrieven.nl
nuudcare.us
uni-bielefeld.de hr.nl
quantum-services.us
uni-erlangen.de hro.nl
ru.ac.za
uni-muenchen.de
