Summary: The DANE domain count is now 3,949,527 (3,923,543 last month).
The number of domains that return DNSSEC-validated replies in
response to MX queries is 23,173,417 (up slightly from 23,180,180
last month). Thus DANE TLSA is deployed on ~17.04% of domains with
DNSSEC. For more stats, see <https://stats.dnssec-tools.org/>.
[ See the Credits[0] list below my signature. ]
As of today, I count ~3.95 million domains with correct SMTP DANE TLSA records
at every primary MX host that accepts connections[1]. As expected, the bulk of
the DANE domains are hosted by the DNS/email hosting providers who've enabled
DANE support for the customer domains they host. The top 20 MX host providers
by domain count are below.
This month Last Month
---------- ----------
1314953 one.com 1322240 one.com
303663 hostpoint.ch 302353 hostpoint.ch
212629 infomaniak.ch 209052 infomaniak.ch
172311 transip.nl 171630 transip.nl
169592 mijndomein.nl 168815 mijndomein.nl
161972 jouwweb.nl 156229 jouwweb.nl
139685 argewebhosting.nl 141433 argewebhosting.nl
131004 simply.com 129838 simply.com
111235 hostnet.nl 111275 hostnet.nl
109839 domeneshop.no 109926 domeneshop.no
106090 loopia.se 105948 loopia.se
90348 webhostingserver.nl 91048 webhostingserver.nl
83074 forpsi.com 83031 forpsi.com
81323 zxcs.nl 81293 zxcs.nl
44928 protonmail.ch 44103 protonmail.ch
40974 antagonist.nl 40754 antagonist.nl
39102 active24.com 39341 active24.com
36892 webreus.nl 37235 webreus.nl
29674 pcextreme.nl 30037 pcextreme.nl
28404 xel.nl 28501 xel.nl
The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl,
.de and .uk. Speaking of countries, the IPv4 GeoIP distribution of
DANE-enabled MX hosts shows the below top 20 countries (each unique IP
address is counted, so multi-homed MX hosts are perhaps somewhat
over-represented).
This month Last month
----------- ----------
11663 TOTAL 11403 TOTAL
3687 DE, Germany 3586 DE, Germany
1932 NL, Netherlands 1887 NL, Netherlands
1888 US, United States 1885 US, United States
883 FR, France 864 FR, France
458 CZ, Czechia 452 CZ, Czechia
364 GB, United Kingdom 360 GB, United Kingdom
267 FI, Finland 264 FI, Finland
213 CA, Canada 203 CA, Canada
176 AT, Austria 179 AT, Austria
171 CH, Switzerland 165 SE, Sweden
161 SE, Sweden 148 CH, Switzerland
147 DK, Denmark 146 DK, Denmark
141 AU, Australia 144 AU, Australia
123 SG, Singapore 125 SG, Singapore
107 RU, Russia 90 PL, Poland
88 PL, Poland 85 RU, Russia
64 JP, Japan 65 JP, Japan
60 NO, Norway 55 BR, Brazil
51 BR, Brazil 52 NO, Norway
47 IT, Italy 42 IT, Italy
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by
DANE MX host IPv6 GeoIP are:
This month Last month
---------- ----------
9445 TOTAL 9295 TOTAL
4224 NL, Netherlands 4201 NL, Netherlands
2659 DE, Germany 2602 DE, Germany
881 US, United States 866 US, United States
389 FR, France 375 FR, France
189 CZ, Czechia 178 GB, United Kingdom
177 GB, United Kingdom 178 CZ, Czechia
110 FI, Finland 110 FI, Finland
87 CA, Canada 82 CA, Canada
81 SE, Sweden 80 SE, Sweden
72 AU, Australia 72 AU, Australia
68 CH, Switzerland 65 CH, Switzerland
49 SG, Singapore 50 SG, Singapore
47 AT, Austria 49 AT, Austria
43 RU, Russia 41 JP, Japan
39 JP, Japan 30 RU, Russia
30 BR, Brazil 28 RO, Romania
28 RO, Romania 27 NO, Norway
26 NO, Norway 26 BR, Brazil
23 DK, Denmark 24 DK, Denmark
18 LT, Lithuania 18 IE, Ireland
There are 9,773 unique zones (9,391 last month) in which the underlying
MX hosts are found. This counts each of the above providers as just one
zone, so is a measure of the breadth of adoption in terms of
organizations deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 20,781 (20,808 last
month). These cover 21,077 distinct MX hosts (21,102 last month, some
MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's
email transparency report is 1,090 (this is my ad-hoc criterion for a
domain being a large-enough actively used email domain). Of these, 569
are in recent (last 90 days of) reports (see [2] below my signature).
Of the ~3.95 million DANE domains, 14,236 (14,262 last month) have
"partial" TLSA records, that cover only a subset of the (secondary) MX
hosts. While this protects traffic to some of the MX hosts, such
domains are still vulnerable to the usual active attacks via the
remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer
STARTTLS (even though TLSA records are published) stands today at 1,873
(2,180 last month). Some of these have additional MX hosts that don't
have broken TLSA records, so mail can still arrive via the remaining MX
hosts. The affected domain counts for the top 10 problem MX hosts are:
177 mx2.tkservers.com
132 mx2.dotxs.net
44 mx.neutraldomains.net
41 svr3.it-df.net
35 mx1.mdbraber.com
23 smtp2.kruik-it.nl
22 mail.mxx.dk
20 fsn1-c04.xemo-net.de
19 web2.sys.ccs-baumann.de
15 mx1.zeromeaning.com
To avoid email outages, please make sure to monitor the validity of your
own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes
https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md
https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022/17
https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html
https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1
https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of
"real" email domains with bad DNSSEC support stands at 901 (1,057 last
month). The top 10 name server operators with problem domains are:
This Month Last month
---------- ----------
665 neostrada.nl 715 neostrada.nl
62 worldnic.com 70 worldnic.com
24 openprovider.nl 60 ebola.cz
14 sectigoweb.com 32 openprovider.nl
13 register.com 14 sectigoweb.com
9 dnssrv.nl 13 register.com
8 ispapi.net 10 dnssrv.nl
7 vultr.com 8 ispapi.net
6 resolver.domains 7 vultr.com
6 forpsi.net 7 cloudns.net
If anyone has good contacts at some of these providers, please encourage
them to remediate not only the broken domains (I can send them a list),
but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of
existence appears in the last 120 days of Google transparency reports:
mailazy.net
--
Viktor.
[0] Credits: The coverage of DNSSEC domains continues to improve with
ongoing data support from Paul Vixie of Farsight Security. Credits also
due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH,
.COM, .DK, .FI, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data
sources of ccTLD signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down,
presumably as a hurdle to botnet SMTP code that gives up where real MTAs
might persist. I am not a fan of this type of defence (it can also
impose undue latency on legitimate email). However, provided the dead
hosts still have TLSA records, (which don't need to match anything, just
need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency
reports:
univie.ac.at tum.de hostingpeople.nl
gmx.at tutanota.de hostnet.nl
vbv.at uni-augsburg.de hr.nl
boozyshop.be uni-bielefeld.de hro.nl
eos-contentia.be uni-erlangen.de huurexpert.nl
triodos.be uni-muenchen.de ikdeburger.nl
vanbreda.be vicinityclo.de inspirerendleven.nl
nra.bg web.de interconnect.nl
cetelemnegocie.com.br westlotto.de interim-netwerk.nl
dwvmail.com.br aeldresagen.dk ithodaalderop.nl
e-negociacao.com.br allbuy.dk josephinajewelry.nl
e-renegocie.com.br anna-hjorth.dk kiesrijk.nl
zaaztelecom.com.br annebrauner.dk liveatamsterdamsebos.nl
nic.br australian-bodycare.dk mailmore.nl
registro.br avabeauty.dk mailon.nl
activfitness-news.ch bambustoej.dk mailplus.nl
blackout-bonusclub.ch barons.dk managementboek.nl
gmx.ch bigsaver.dk markteffectmail.nl
handy-abovergleich.ch bog.dk mcmta.nl
hostpoint.ch camillakroeyer.dk mijndomein.nl
infomaniak.ch casanova.dk minbzk.nl
msochrono.ch champagneklubben.dk mindef.nl
open.ch computerworld.dk mm1.nl
protonmail.ch damask.dk nieuwsservice-rvo.nl
sherlockhomes.ch danielspengetips.dk notbranded.nl
sms-gagnant.ch danskebank.dk ns.nl
switch.ch denmentalekriger.dk nuudcare.nl
wog.ch densidsteflaske.dk nuwegexclusief.nl
simplelogin.co dfi.dk opnaarwonderland.nl
albourne.com dressforsuccess.dk ouderenfonds.nl
anonaddy.com ens.dk ouderportaal.nl
ansigtsyogaonline.com fibianet.dk overheid.nl
canva-facile.com foraeldresparring.dk oxilionhosted.nl
cm.com gastrotools.dk partijvoordedieren.nl
collarofsweden.com globestudios.dk partnermail.nl
connectsb.com hook-up.dk podiumcadeaukaart.nl
danskebank.com hostedsepo.dk pp-prd.nl
datev.com idelig.dk previder.nl
denhaag.com iphoneopladere.dk prorun-mail.nl
exegy.com kagegrisen.dk protislank.nl
farmergracy.com kk.dk quicknet.nl
fastware-hosting.com kodbilen.dk rdw.nl
flaneurhomme.com konkurspriser.dk rijksoverheid.nl
fromanteel-watches.com kystfisken.dk rvig.nl
gmx.com labelking.dk rvo.nl
goodforme.com lacabra.dk sans-mail.nl
habr.com lederstof.dk schuurman-schoenen.nl
headachecalendar.com mobilcovers.dk shampoobars.nl
highcharts.com musclehouse.dk shapeit.nl
infomaniak.com netic.dk shoesme.nl
ingthink.com nfinitybeauty.dk sietskescholten.nl
intakt.com nimara.dk sizzthebrand.nl
itskaos.com nordd.dk smartwatchbanden.nl
johnbeerens.com nota.dk sportrusten.nl
joomlapolis.com opdagverden.dk ssonet.nl
jula.com pengeogfrihed.dk stater.nl
kabayarefashion.com perfectjeans.dk svb.nl
kae-cosmetici.com sengefabrikken.dk technicus.nl
kantarresearch.com seniornews.dk telefoonglaasje.nl
kheaa.com shapeit.dk teslin.nl
leszexpertsfle.com skjold-burne.dk thealphamen.nl
librti.com smoon.dk toms.nl
mail.com sneakerzone.dk transip.nl
mailzerver.com stil.dk triodos.nl
mixx.com stpt.dk truetickets.nl
mplbeauty.com strongcurves.dk tudelft.nl
nanolearning.com sygeforsikring.dk uitgeverijpica.nl
nine-pine.com thenap.dk upcmail.nl
novashops.com thesneakerstore.dk uvt.nl
one.com trueliving.dk uwv.nl
orsys.com venderbys.dk vacaturesonline.nl
ottobredesign.com vin-huset.dk vandale.nl
pieter-pot.com vind.dk vimexx.nl
polyas.com yuaiahaircare.dk vluchtelingenwerk.nl
pompomlondon.com tilburguniversity.edu vogeldagboek.nl
protonmail.com maarahvapood.ee voor14.nl
run-motion.com minuvalik.ee vunzigedeuntjes.nl
sankakucomplex.com surveyturtle.ee watchbandjes-shop.nl
scorecloud.com turunduslabor.ee waternet.nl
serverclienti.com zone.ee wehkampfinance.nl
sneakerjeans.com myownconference.email werkzoeken.nl
solvinity.com spam-filter.email wonenmetlef.nl
speciale-offre.com spotler.email ziggo.nl
sportnotch.com nuudcare.es zorgmail.nl
stasdock.com triodos.es zoweg-mail.nl
stater.com egu.eu annabellstefanussen.no
stellarequipment.com iaccept.eu babybanden.no
tcs.com litebit.eu bergengokart.no
the-vfl.com outletdelcalcio.eu bull-ski-kajakk.no
theintercept.com zerolime.eu chillout.no
thepcw.com zone.eu domeneshop.no
thepcwholesale.com zonevs.eu dressmykid.no
thesmmacademy.com danskebank.fi godvar.no
thingsilikethingsilove.com handelsbanken.fi guttelus.no
triodos.com metaburn.fi hyttefeber.no
tutanota.com rockdenim.fi idrettenonline.no
up2staff.com ac-strasbourg.fr lagerpriser.no
veganallsorts.com braceletsmartwatch.fr marikrogshus.no
vivaldi.com compagnie-des-sens.fr modostore.no
webcruiter.com edtm-actu.fr mystuff.no
win-rar.com nuudcare.fr nordicprint.no
xfinity.com oo2.fr norskgrammatikk.no
xfinityhomesecurity.com passefranceallemagne.fr raskebriller.no
xfinitymobile.com privea.fr rushtrampoline.no
bncr.fi.cr tid.gov.hk sillysanta.no
airbank.cz fidesz.hu smaaungene.no
akce-incomputer.cz italiamail.hu spillfabrikken.no
amenit.cz bluebiz.info strikkia.no
balikovna.cz eurocontrol.int suksessmednetthandel.no
bewooden.cz infinex.io analysedanmark.nu
cokoladovnajanek.cz nuudcare.it atelkamera.nu
cpost.cz neolink.link goget.nu
creammy.cz nic.lv hallbarhalsa.nu
cro.cz anonaddy.me lenhud.nu
csob.cz pm.me agirpourlenvironnement.org
cuni.cz proton.me checkmyads.org
dashofer.cz army.mil debian.org
dedra.cz dla.mil freebsd.org
e-kondomy.cz dma.mil fridaysforfuture.org
ecps.cz health.mil gentoo.org
fio.cz jten.mil ietf.org
hobynaradi.cz mail.mil mailbox.org
hypotecnibanka.cz navy.mil mailop.org
innogy.cz nga.mil netbsd.org
itesco.cz osd.mil openssl.org
kb.cz socom.mil ozlabs.org
klenotyaurum.cz uscg.mil postfix.org
klubpevnehozdravi.cz usmc.mil samba.org
ksporting.cz apnic.net torproject.org
manymail.cz comcast.net biotechnologia.com.pl
maxmax.cz ewetel.net mobily.com.sa
mbank.cz ficbook.net arbetsformedlingen.se
mfcr.cz fivem.net australian-bodycare.se
mkluzkoviny.cz gmx.net bearplay.se
mojedatovaschranka.cz habramail.net bearplayshop.se
mrakyhracek.cz hr-manager.net bidflow.se
muni.cz inexio.net bilprovningen.se
nic.cz intares.net crtzoo.se
nilia.cz mailanyone.net ecster.se
nku.cz masterinter.net egensajt.se
o2.cz mijngezondheid.net ellevio.se
opravdovezlociny.cz mpssec.net epochtimes-mejl.se
optimail.cz octopoos.net fashion-copenhagen.se
outlet-alpine.cz procurios.net handelsbanken.se
p-info.cz riseup.net hellomantle.se
pivoteka.cz s-qrc.net jaramba.se
poptavej.cz soverin.net klasspengar.se
pre.cz speedkom.net koreanbeauty.se
rozhlas.cz t-2.net kulturaktiebolaget.se
scrptd.cz amsterdam.nl livlyclothing.se
smtp.cz amsterdamwinefestival.nl lnu.se
sparkys.cz aquastorexl.nl lomervarde.se
stoklasa.cz bankhoesdiscounter.nl loopia.se
thinline.cz belastingdienst.nl malarfabriken.se
tiscali.cz beterinbeleggen.nl merchsweden.se
vas-server.cz beterspellen.nl minmyndighetspost.se
virusfree.cz bewustpuur.nl nordicprint.se
vitalpoint.cz bhosted.nl nordicsheep.se
vshosting.cz blushfashionstore.nl performcollection.se
zafido.cz bobo.nl polisen.se
zlocinozrouti.cz body-supplies.nl refitness.se
zonky.cz bolerolimonadewinkel.nl sillysanta.se
bayern.de boozyshop.nl silverdotter.se
brandenburg.de box.nl skatteverket.se
bund.de bruut.nl skolverket.se
bundesregierung.de caracamilla.nl snbostader.se
datev.de carre.nl soleplus.se
datronic.de casema.nl teeshoppen.se
dfn.de cbr.nl teknikdelar.se
elster.de chello.nl theletter.se
ewetel.de clubplanner.nl websupport.se
fau.de csvjongholland.nl agatinsvet.sk
freenet.de degros.nl fio.sk
gmx.de derooijfotografie.nl lenivakucharka.sk
hi7.de desan.nl mklozkoviny.sk
huellen-shop.de dictu.nl nakupujzdravo.sk
jpberlin.de digibtw.nl penzionmara.sk
lmu.de digid.nl rondogo.sk
lrz.de dimehouse.nl toptop.sk
mail.de domain-registry.nl zapardrobnych.sk
mensa.de dorcas.nl zeit-des-wandels.tv
mindline-analytics.de duo.nl clientnews3.co.uk
mpg.de eabstest.nl millieandblake.co.uk
posteo.de efactuurdirect.nl nuudcare.co.uk
ruhr-uni-bochum.de esuals.nl thewordman.co.uk
smartwatcharmbaender.de extinctionrebellion.nl triodos.co.uk
stwm.de ezorg.nl nuudcare.us
sys4.de frfc1908.nl quantum-services.us
taures.de hobbygigant.nl ru.ac.za
tu-darmstadt.de home.nl
