Summary: The DANE domain count is now 4,022,036 (3,988,988 last month)
The number of domains that return DNSSEC-validated replies in
response to MX queries is 23,122,328 (23,098,096 last month).
Thus DANE TLSA is deployed on ~17.39% of domains with DNSSEC.
For more stats, see <https://stats.dnssec-tools.org/>.
[ The credits[0] list is below my signature. ]
Reminder: If you're relying on trust-anchor (usage DANE-TA(2)) TLSA records
matching a Let's Encrypt issuing CA, please note important upcoming
changes in Let's Encrypt certificate issuance:
https://list.sys4.de/hyperkitty/list/[email protected]/message/HESAY65XEKEW52UXYFELODTD44P25VIW/
https://list.sys4.de/hyperkitty/list/[email protected]/message/GLRVY2CRHYLTBNXOBRKPG7LFZKYWF7BS/
https://list.sys4.de/hyperkitty/list/[email protected]/message/X4SS2EEDGIYVQOHI2ZX65PIBYR652DPR/
As of today, I count ~4.02 million domains with correct SMTP DANE TLSA
records at every primary MX host that accepts connections[1]. As
expected, the bulk of the DANE domains are hosted by the DNS/email
hosting providers who've enabled DANE support for the customer domains
they host. The top 20 MX host providers by domain count are below.
This month Last Month
---------- ----------
1305552 one.com 1306568 one.com
308177 hostpoint.ch 306621 hostpoint.ch
223679 infomaniak.ch 219246 infomaniak.ch
181030 jouwweb.nl 172777 transip.nl
173116 transip.nl 172069 jouwweb.nl
170668 mijndomein.nl 170317 mijndomein.nl
135204 argewebhosting.nl 137375 argewebhosting.nl
129324 simply.com 130652 simply.com
111973 hostnet.nl 111485 hostnet.nl
110214 domeneshop.no 109779 domeneshop.no
106668 loopia.se 106544 loopia.se
88592 webhostingserver.nl 89264 webhostingserver.nl
83114 zxcs.nl 82634 forpsi.com
82996 forpsi.com 81475 zxcs.nl
48550 protonmail.ch 47296 protonmail.ch
41346 antagonist.nl 41179 antagonist.nl
37932 active24.com 38161 active24.com
35799 webreus.nl 36259 webreus.nl
28089 pcextreme.nl 28643 pcextreme.nl
27964 xel.nl 28102 xel.nl
The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl,
.de and .uk. Speaking of countries, the IPv4 GeoIP distribution of
DANE-enabled MX hosts shows the below top 20 countries (each unique IP
address is counted, so multi-homed MX hosts are perhaps somewhat
over-represented).
This month Last month
----------- ----------
12241 TOTAL 12019 TOTAL
3906 DE, Germany 3819 DE, Germany
1972 NL, The Netherlands 1948 NL, The Netherlands
1912 US, United States 1929 US, United States
871 FR, France 905 FR, France
486 CZ, Czechia 481 CZ, Czechia
414 GB, United Kingdom 380 GB, United Kingdom
290 FI, Finland 287 FI, Finland
245 CA, Canada 212 CA, Canada
221 CH, Switzerland 199 CH, Switzerland
193 AT, Austria 186 AT, Austria
166 SE, Sweden 176 SE, Sweden
156 DK, Denmark 160 DK, Denmark
152 AU, Australia 148 AU, Australia
121 SG, Singapore 117 SG, Singapore
121 PL, Poland 103 RU, Russia
103 RU, Russia 93 PL, Poland
66 NO, Norway 67 NO, Norway
57 JP, Japan 57 JP, Japan
56 BR, Brazil 49 IT, Italy
53 IT, Italy 49 BR, Brazil
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by
DANE MX host IPv6 GeoIP are:
This month Last month
---------- ----------
9761 TOTAL 9592 TOTAL
4263 NL, The Netherlands 4210 NL, The Netherlands
2849 DE, Germany 2791 DE, Germany
905 US, United States 888 US, United States
417 FR, France 390 FR, France
210 CZ, Czechia 202 CZ, Czechia
180 GB, United Kingdom 185 GB, United Kingdom
109 FI, Finland 113 FI, Finland
87 CA, Canada 86 CA, Canada
80 CH, Switzerland 80 SE, Sweden
78 SE, Sweden 75 AU, Australia
75 AU, Australia 72 CH, Switzerland
52 AT, Austria 50 AT, Austria
46 SG, Singapore 44 SG, Singapore
36 JP, Japan 39 JP, Japan
32 RO, Romania 31 RU, Russia
30 BR, Brazil 31 NO, Norway
29 RU, Russia 29 RO, Romania
29 NO, Norway 29 BR, Brazil
28 DK, Denmark 26 DK, Denmark
18 LT, Lithuania 16 IE, Ireland
There are 10,719 unique zones (10,449 last month) in which the underlying
MX hosts are found. This counts each of the above providers as just one
zone, so is a measure of the breadth of adoption in terms of organizations
deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 24,636 (21,169 last
month). These cover 24,945 distinct MX hosts (21,466 last month, some
MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's
email transparency report is 1,199 (1,173 last month, this is my ad-hoc
criterion for a domain being a large-enough actively used email domain).
Of these, 683 (674 last month) are in recent (last 90 days of) reports
(see [2] below my signature).
Of the ~4.02 million DANE domains, 14,204 (14,456 last month) have
"partial" TLSA records, that cover only a subset of the (secondary) MX
hosts. While this protects traffic to some of the MX hosts, such
domains are still vulnerable to the usual active attacks via the
remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer
STARTTLS (even though TLSA records are published) stands today at 2,424
(1,862 last month). Some of these have additional MX hosts that don't
have broken TLSA records, so mail can still arrive via the remaining MX
hosts. The affected domain counts for the top 10 problem MX hosts are:
550 mx2.xcellerate.nl
172 mx2.tkservers.com
123 mx2.dotxs.net
106 mx.xobit.nl
35 mx1.mdbraber.com
26 mail.orionpanel.nl
23 semark.dk
22 smtp2.kruik-it.nl
15 mail.nationaalarchief.nl
15 artemis.strebsjig.net
To avoid email outages, please make sure to monitor the validity of your
own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes
https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md
https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022/17
https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html
https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1
https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of
"real" email domains with bad DNSSEC support stands at 697 (838 last
month). The top 10 name server operators with problem domains are:
This Month Last month
---------- ----------
490 neostrada.nl 528 neostrada.nl
58 worldnic.com 60 worldnic.com
21 openprovider.nl 22 openprovider.nl
21 active24.cz 21 active24.cz
14 sectigoweb.com 14 sectigoweb.com
13 register.com 13 register.com
7 dnssrv.nl 7 vultr.com
6 vultr.com 7 dnssrv.nl
6 ispapi.net 6 resolver.domains
6 forpsi.net 6 ispapi.net
If anyone has good contacts at some of these providers, please encourage
them to remediate not only the broken domains (I can send them a list),
but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of
existence appears in the last 120 days of Google transparency reports:
mailazy.net
--
Viktor.
[0] Credits:
Hosting for the DANE/DNSSEC project is donated by isi.edu (Wes Hardaker and
team). Wes also hosts and maintains the https://stats.dnssec-tools.org
website. Thanks go to ICANN for sponsoring acquisition of the server hardware.
Coverage of DNSSEC domains continues to improve with ongoing data
support from Chris Mikkelson from domaintools.com. Credits also due to
ICANN providing gTLD data via CZDS, and to the ccTLD registries for .CH,
.DK, .FI, .FR, .IS, .LI, .NL, .NU and .SE. More data sources of ccTLD
signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down,
presumably as a hurdle to botnet SMTP code that gives up where real MTAs
might persist. I am not a fan of this type of defence (it can also
impose undue latency on legitimate email). However, provided the dead
hosts still have TLSA records, (which don't need to match anything, just
need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency
reports:
vbv.ag uni-augsburg.de
maastrichtuniversity.nl
univie.ac.at uni-bielefeld.de
mailmore.nl
gmx.at uni-erlangen.de
mailon.nl
boozyshop.be uni-muenchen.de
mailplus.nl
eos-contentia.be vicinityclo.de
managementboek.nl
triodos.be web.de
markteffectmail.nl
nra.bg westlotto.de
mcmta.nl
register.bg sanchezadv.digital
mijndomein.nl
dwvmail.com.br aeldresagen.dk
mijnmagazines.nl
e-negociacao.com.br allbuy.dk
minbzk.nl
e-renegocie.com.br annebrauner.dk
mindef.nl
pn1.com.br anodyne.dk
minvenj.nl
zaaztelecom.com.br avabeauty.dk
mm1.nl
defesa.gov.br barons.dk
mulderretail.nl
nic.br bigsaver.dk
nefkens.nl
registro.br bisgaardshoes.dk
netpoint.nl
activfitness-news.ch blandselvfroe.dk
netpointfactoring.nl
blackout-bonusclub.ch boblberg.dk
nieuwsservice-rvo.nl
creditum.ch bog.dk
notbranded.nl
escalade.ch borgerforslag.dk
noties.nl
gmx.ch bymelanie.dk
ns.nl
handy-abovergleich.ch bystinewinther.dk
nuudcare.nl
hostpoint.ch camillakroeyer.dk
nuwegexclusief.nl
infomaniak.ch casanova.dk
okki.nl
jobsmore.ch champagneklubben.dk
oomverzekeringen.nl
kalender-win.ch cillouettes.dk
opnaarwonderland.nl
msochrono.ch computerworld.dk
otys.nl
open.ch damask.dk
ouderenfonds.nl
protonmail.ch danskebank.dk
ouderportaal.nl
sherlockhomes.ch densidsteflaske.dk
outlawevents.nl
sms-gagnant.ch dfi.dk
overheid.nl
votreopinion.ch dressforsuccess.dk
oxilionhosted.nl
bionoble.co ejvinds.dk
ozsw.nl
simplelogin.co fibianet.dk
partijvoordedieren.nl
aim-care.com finesmile.dk
partnermail.nl
albourne.com fletkurven.dk
podiumcadeaukaart.nl
also.com foraeldresparring.dk
politie.nl
anonaddy.com frisorenogbaronen.dk
pp-prd.nl
ansigtsyogaonline.com gasolinegrill.dk
previder.nl
aotax.com gastrotools.dk
proefdiervrij.nl
boozyshop.com globestudios.dk
prorun-mail.nl
buroventures.com hook-up.dk
pvv.nl
canva-facile.com hostedsepo.dk
quicknet.nl
cm.com idelig.dk
ranzijn.nl
collarofsweden.com inkpro.dk
rdw.nl
connectsb.com iphoneopladere.dk
rebirth-festival.nl
conscience-et-realites.com ixstudioscph.dk
rechtspraak.nl
cornerstoneplatform.com kagegrisen.dk
restaurant-sparkling.nl
danskebank.com kisserpaludan.dk
rijksoverheid.nl
datev.com kk.dk
rivm.nl
denhaag.com kodbilen.dk
rotterdam.nl
detectiveforaday.com konkurspriser.dk
rvig.nl
eliteincomesociety.com kystfisken.dk
rvo.nl
explorer-hotels.com lacabra.dk
sans-mail.nl
fabfilter.com lammeskindet.dk
schuurman-schoenen.nl
farmergracy.com lederstof.dk
scorion.nl
fastware-hosting.com legekammeraten.dk
shampoobars.nl
flaneurhomme.com memery.dk
shapeit.nl
fromanteel-watches.com mobilcovers.dk
shoesme.nl
gearboxdigital.com modstroem.dk
sizzthebrand.nl
getpaidopportunities.com musclehouse.dk
smartwatchbanden.nl
gmx.com naturhandel.dk
snowbass.nl
goodforme.com netic.dk
spamservice.nl
grimfrost.com nexsmart.dk
sportrusten.nl
habitamat.com nfinitybeauty.dk
ssonet.nl
habr.com nimara.dk
stage-app.nl
hannahbarrettyoga.com nordd.dk
stater.nl
headachecalendar.com nordicsheep.dk
steunactie.nl
hedon.com nota.dk
svr.nl
highcharts.com online-mode.dk
technicus.nl
hwigroup.com perfectjeans.dk
telefoonglaasje.nl
imcnig.com qookware.dk
thealphamen.nl
infomaniak.com sengefabrikken.dk
thefightcompany.nl
ingthink.com seniornews.dk
triodos.nl
intakt.com shapeit.dk
truetickets.nl
johnbeerens.com sillysanta.dk
tudelft.nl
joomlapolis.com skjold-burne.dk
u-mailer.nl
jula.com smoon.dk
uitgeverijpica.nl
justpadel.com sneakerzone.dk
upcmail.nl
kabayarefashion.com stil.dk
uvt.nl
kae-cosmetici.com sygeforsikring.dk
uwv.nl
kheaa.com thenap.dk
vacaturesonline.nl
leszexpertsfle.com thesneakerstore.dk
valys.nl
librti.com trueliving.dk
vandale.nl
luvrefranco.com trustfitness.dk
vimexx.nl
mail.com viggo.dk
vluchtelingenwerk.nl
maileroo.com vind.dk
vpo.nl
mailzerver.com yuaiahaircare.dk
vunzigedeuntjes.nl
marsblade.com tilburguniversity.edu
vvv-venlo.nl
meriamecouture.com biotheka.ee
watchbandjes-shop.nl
mplbeauty.com holt.ee
waternet.nl
nanolearning.com maarahvapood.ee
werkzoeken.nl
nautisme-pratique.com minuvalik.ee
woongarantvolmacht.nl
nine-pine.com surveyturtle.ee
ziggo.nl
novashops.com turunduslabor.ee
zorgmail.nl
offshorecorptalk.com myownconference.email
ankerstjerne.no
one.com spam-filter.email
annabellstefanussen.no
orsys.com spotler.email
babybanden.no
ottobredesign.com talentech.email
bull-ski-kajakk.no
pieter-pot.com triodos.es
chillout.no
polyas.com egu.eu
day-et.no
pompomlondon.com finesoftware.eu
dinholdning.no
ppcpcv.com mailplatform.eu
domeneshop.no
protonmail.com qard.eu
dressmykid.no
run-motion.com rybarik.eu
guttelus.no
runbox.com zone.eu
handelsbanken.no
sankakucomplex.com zonevs.eu
hoppin.no
scienceshepherd.com danskebank.fi
hypopressivtrening.no
scorecloud.com f-solutions.fi
hyttefeber.no
serverclienti.com fsol.fi
idrettenonline.no
sisuknitwear.com handelsbanken.fi
kashmina.no
sneakerdistrict.com io-tech.fi
lagerpriser.no
solvinity.com metaburn.fi
lillepr.no
stasdock.com raumanteatteri.fi
marikrogshus.no
stater.com sillysanta.fi
metaburn.no
stellarequipment.com traficom.fi
mystuff.no
tcs.com ac-strasbourg.fr
nordiskbylien.no
theintercept.com boozyshop.fr
norisma.no
thelabelmachine.com braceletsmartwatch.fr
norskgrammatikk.no
thepcw.com compagnie-des-sens.fr
raskebriller.no
thepcwholesale.com edtm-actu.fr
rushtrampoline.no
thingsilikethingsilove.com oo2.fr
smaaungene.no
tibush.com passefranceallemagne.fr
spillfabrikken.no
trainwithlov.com privea.fr
stilshoppen.no
triodos.com fvap.gov
strikkia.no
tuftingshop.com fidesz.hu
svippr.no
tutanota.com italiamail.hu
tickettothemoon.no
up2staff.com marathonlife.hu
veronicalill.no
vivaldi.com nyirbatorvaroskartya.hu
atelkamera.nu
webcruiter.com zsibvasar.hu
goget.nu
xfinity.com bluebiz.info
lenhud.nu
xfinityhomesecurity.com j360.info
skjutsgruppen.nu
xfinitymobile.com eurocontrol.int
agirpourlenvironnement.org
zangra.com infinex.io
calyxinstitute.org
bncr.fi.cr simplelogin.io
debian.org
airbank.cz nuudcare.it
freebsd.org
akce-incomputer.cz neolink.link
fridaysforfuture.org
amenit.cz education.lu
gentoo.org
balikovna.cz etat.lu
ietf.org
bewooden.cz restena.lu
isc.org
cd.cz anonaddy.me
mailbox.org
cinemax.cz pm.me
mailop.org
cokoladovnajanek.cz proton.me
netbsd.org
cpost.cz army.mil
openssl.org
creammy.cz dla.mil
ozlabs.org
csob.cz dma.mil
postfix.org
csobstavebni.cz health.mil
rfc-editor.org
cuni.cz jten.mil
samba.org
dashofer.cz mail.mil
torproject.org
e-kondomy.cz navy.mil
biotechnologia.com.pl
ecps.cz nga.mil
asf.com.pt
ekokoza.cz osd.mil
loopia.rs
fio.cz socom.mil
pinnbet.rs
gov.cz spaceforce.mil
mobily.com.sa
hobynaradi.cz uscg.mil
advisamail.se
hypotecnibanka.cz usmc.mil
arbetsformedlingen.se
innogy.cz aifi.net
bearplay.se
itesco.cz comcast.net
bearplayshop.se
jumpfamily.cz ewetel.net
bilprovningen.se
kb.cz ficbook.net
dingolfshop.se
klenotyaurum.cz fivem.net
ellevio.se
klubpevnehozdravi.cz forwardemail.net
epochtimes-mejl.se
ksporting.cz gmx.net
fotproffsen.se
manymail.cz graphistepro.net
getvibes.se
mbank.cz habramail.net
handelsbanken.se
mfcr.cz hr-manager.net
hellomantle.se
mindsoft.cz intares.net
inkrebel.se
mkluzkoviny.cz mailanyone.net
innebandy24.se
mojedatovaschranka.cz masterinter.net
jaramba.se
mojemincovna.cz mijngezondheid.net
jul-troja.se
mrakyhracek.cz mpssec.net
koreanbeauty.se
muni.cz procurios.net
kth.se
nic.cz ripe.net
kulturaktiebolaget.se
o2.cz riseup.net
livlyclothing.se
opravdovezlociny.cz s-qrc.net
lnu.se
optimail.cz soverin.net
lomervarde.se
outlet-alpine.cz space.net
loopia.se
p-info.cz t-2.net
merchsweden.se
pivoteka.cz alexstory.nl
metaburn.se
poptavej.cz allevakantiehuizeninbelgie.nl
minmyndighetspost.se
scrptd.cz amsterdam.nl
naprapatlandslaget.se
server4u.cz aquastorexl.nl
naturligtsnygg.se
shopex.cz bankhoesdiscounter.nl
nordd.se
smtp.cz belastingdienst.nl
nordicsheep.se
sparkys.cz beterinbeleggen.nl
polisen.se
stoklasa.cz beterspellen.nl
samblamail.se
tefal.cz bewustpuur.nl
sillysanta.se
thinline.cz bhosted.nl
silverdotter.se
vas-server.cz blushfashionstore.nl
skatteverket.se
vitalpoint.cz bobo.nl
skolverket.se
vshosting.cz body-supplies.nl
snbostader.se
zafido.cz bolerolimonadewinkel.nl
soleplus.se
zdravestravovani.cz boozyshop.nl
spelfabrik.se
zonky.cz box.nl
svenskhusman.se
bayern.de bruut.nl
teeshoppen.se
brandenburg.de burgernet.nl
teknikdelar.se
bund.de carre.nl
theletter.se
datev.de casema.nl
websupport.se
dbtg.de cbr.nl
agatinsvet.sk
denic.de chello.nl
bewooden.sk
deutsch-franzoesischer-freundschaftspass.de citotoetsgroep4.nl
coopka.sk
dfn.de clubplanner.nl
edirect.sk
elster.de degros.nl
fio.sk
ewetel.de deonlinetandarts.nl
gravirovane.sk
fau.de derooijfotografie.nl
hecht.sk
freenet.de desan.nl
mamaaja.sk
gmx.de dewebmakers.nl
mklozkoviny.sk
hi7.de dictu.nl
mnforce-panel.sk
huellen-shop.de digid.nl
nakupujzdravo.sk
iks-jena.de dimehouse.nl
nameserver.sk
jpberlin.de dorcas.nl
nlp-akademia.sk
knauermann.de duo.nl
partner.sk
lmu.de esuals.nl
penzionmara.sk
lrz.de extinctionrebellion.nl
poziadavka.sk
mail.de ezorg.nl
rondogo.sk
mail2many.de fivecityspa.nl
travelmail.sk
mensa.de glamouryourhair.nl
zapardrobnych.sk
mpg.de hobbygigant.nl
afinepairofshoes.co.uk
posteo.de home.nl
clientnews3.co.uk
ruhr-uni-bochum.de hostnet.nl
handelsbanken.co.uk
sifjakobs.de huurexpert.nl
millieandblake.co.uk
sillysanta.de ikdeburger.nl
nuudcare.co.uk
smartwatcharmbaender.de inspirerendleven.nl
thewordman.co.uk
sys4.de interim-netwerk.nl
triodos.co.uk
taures.de jointherebellion.nl
nuudcare.us
tu-darmstadt.de josephinajewelry.nl
quantum-services.us
tum.de kiesrijk.nl
ru.ac.za
tutanota.de liveatamsterdamsebos.nl
