Summary: The DANE domain count is now 4,069,697 (4,022,036 last month).
The number of domains that return DNSSEC-validated replies in
response to MX queries is 23,199,861 (23,122,328 last month).
Thus DANE TLSA is deployed on ~17.54% of domains with DNSSEC.
For more stats, see <https://stats.dnssec-tools.org/>.
[ The credits[0] list is below my signature. ]
Reminder: If you're relying on trust-anchor (usage DANE-TA(2)) TLSA records
matching a Let's Encrypt issuing CA, please note important recent
and upcoming changes in Let's Encrypt certificate issuance:
https://list.sys4.de/hyperkitty/list/[email protected]/message/HESAY65XEKEW52UXYFELODTD44P25VIW/
https://list.sys4.de/hyperkitty/list/[email protected]/message/GLRVY2CRHYLTBNXOBRKPG7LFZKYWF7BS/
https://list.sys4.de/hyperkitty/list/[email protected]/message/X4SS2EEDGIYVQOHI2ZX65PIBYR652DPR/
[ This month there's a stready trickle of domains whose DANE
authentication
fails because the DST cross certificate for the ISRG X1 root is no
longer
included in Let's Encrypt certificate chains. ]
As of today, I count ~4.07 million domains with correct SMTP DANE TLSA
records at every primary MX host that accepts connections[1]. As
expected, the bulk of the DANE domains are hosted by the DNS/email
hosting providers who've enabled DANE support for the customer domains
they host. The top 20 MX host providers by domain count are below.
This month Last Month
---------- ----------
1305272 one.com 1305552 one.com
310345 hostpoint.ch 308177 hostpoint.ch
228070 infomaniak.ch 223679 infomaniak.ch
191647 jouwweb.nl 181030 jouwweb.nl
173391 transip.nl 173116 transip.nl
171433 mijndomein.nl 170668 mijndomein.nl
161671 simply.com 135204 argewebhosting.nl
133508 argewebhosting.nl 129324 simply.com
112176 hostnet.nl 111973 hostnet.nl
110331 domeneshop.no 110214 domeneshop.no
106740 loopia.se 106668 loopia.se
87960 webhostingserver.nl 88592 webhostingserver.nl
83860 zxcs.nl 83114 zxcs.nl
83010 forpsi.com 82996 forpsi.com
49979 protonmail.ch 48550 protonmail.ch
41335 antagonist.nl 41346 antagonist.nl
37883 active24.com 37932 active24.com
35476 webreus.nl 35799 webreus.nl
27833 xel.nl 28089 pcextreme.nl
27552 pcextreme.nl 27964 xel.nl
The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .br, .cz, .eu, .no, .be, .pl,
.de and .uk. Speaking of countries, the IPv4 GeoIP distribution of
DANE-enabled MX hosts shows the below top 20 countries (each unique IP
address is counted, so multi-homed MX hosts are perhaps somewhat
over-represented).
This month Last month
----------- ----------
12348 TOTAL 12241 TOTAL
3958 DE, Germany 3906 DE, Germany
1962 NL, The Netherlands 1972 NL, The Netherlands
1929 US, United States 1912 US, United States
888 FR, France 871 FR, France
492 CZ, Czechia 486 CZ, Czechia
418 GB, United Kingdom 414 GB, United Kingdom
309 FI, Finland 290 FI, Finland
231 CH, Switzerland 245 CA, Canada
209 CA, Canada 221 CH, Switzerland
204 AT, Austria 193 AT, Austria
175 SE, Sweden 166 SE, Sweden
168 DK, Denmark 156 DK, Denmark
150 AU, Australia 152 AU, Australia
119 SG, Singapore 121 SG, Singapore
115 PL, Poland 121 PL, Poland
100 RU, Russia 103 RU, Russia
66 NO, Norway 66 NO, Norway
60 BR, Brazil 57 JP, Japan
57 JP, Japan 56 BR, Brazil
56 IT, Italy 53 IT, Italy
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by
DANE MX host IPv6 GeoIP are:
This month Last month
---------- ----------
9785 TOTAL 9761 TOTAL
4215 NL, The Netherlands 4263 NL, The Netherlands
2907 DE, Germany 2849 DE, Germany
906 US, United States 905 US, United States
398 FR, France 417 FR, France
213 CZ, Czechia 210 CZ, Czechia
185 GB, United Kingdom 180 GB, United Kingdom
116 FI, Finland 109 FI, Finland
88 CA, Canada 87 CA, Canada
83 SE, Sweden 80 CH, Switzerland
80 CH, Switzerland 78 SE, Sweden
76 AU, Australia 75 AU, Australia
56 AT, Austria 52 AT, Austria
43 SG, Singapore 46 SG, Singapore
40 JP, Japan 36 JP, Japan
32 RU, Russia 32 RO, Romania
31 RO, Romania 30 BR, Brazil
31 NO, Norway 29 RU, Russia
30 DK, Denmark 29 NO, Norway
30 BR, Brazil 28 DK, Denmark
17 LT, Lithuania 18 LT, Lithuania
There are 10,895 unique zones (10,719 last month) in which the underlying
MX hosts are found. This counts each of the above providers as just one
zone, so is a measure of the breadth of adoption in terms of organizations
deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 21,863 (24,636 last
month). These cover 22,163 distinct MX hosts (24,945 last month, some
MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's
email transparency report is 1,272 (1,199 last month, this is my ad-hoc
criterion for a domain being a large-enough actively used email domain).
Of these, 743 (683 last month) are in recent (last 90 days of) reports
(see [2] below my signature).
Of the ~4.07 million DANE domains, 14,334 (14,204 last month) have
"partial" TLSA records, that cover only a subset of the (secondary) MX
hosts. While this protects traffic to some of the MX hosts, such
domains are still vulnerable to the usual active attacks via the
remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer
STARTTLS (even though TLSA records are published) stands today at 2,344
(2,424 last month). Some of these have additional MX hosts that don't
have broken TLSA records, so mail can still arrive via the remaining MX
hosts. The affected domain counts for the top 10 problem MX hosts are:
547 mx2.xcellerate.nl
171 mx2.tkservers.com
25 mail.orionpanel.nl
23 semark.dk
22 web1.sys.ccs-baumann.de
22 smtp2.kruik-it.nl
15 mail.nationaalarchief.nl
15 mail.mostertman.com
15 artemis.strebsjig.net
14 mail.liebner-server.de
To avoid email outages, please make sure to monitor the validity of your
own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes
https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md
https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022/17
https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html
https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1
https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of
"real" email domains with bad DNSSEC support stands at 697 (838 last
month). The top 10 name server operators with problem domains are:
This Month Last month
---------- ----------
463 neostrada.nl 490 neostrada.nl
54 worldnic.com 58 worldnic.com
21 active24.cz 21 openprovider.nl
17 openprovider.nl 21 active24.cz
14 sectigoweb.com 14 sectigoweb.com
12 register.com 13 register.com
7 dnssrv.nl 7 dnssrv.nl
6 vultr.com 6 vultr.com
6 ispapi.net 6 ispapi.net
6 forpsi.net 6 forpsi.net
If anyone has good contacts at some of these providers, please encourage
them to remediate not only the broken domains (I can send them a list),
but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of
existence appears in the last 120 days of Google transparency reports:
mailazy.net
--
Viktor.
[0] Credits:
Hosting for the DANE/DNSSEC project is donated by isi.edu (Wes Hardaker and
team). Wes also hosts and maintains the https://stats.dnssec-tools.org
website. Thanks go to ICANN for sponsoring acquisition of the server hardware.
Coverage of DNSSEC domains continues to improve with ongoing data
support from Chris Mikkelson from domaintools.com. Credits also due to
ICANN providing gTLD data via CZDS, and to the ccTLD registries for .CH,
.DK, .FI, .FR, .IS, .LI, .NL, .NU and .SE. More data sources of ccTLD
signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down,
presumably as a hurdle to botnet SMTP code that gives up where real MTAs
might persist. I am not a fan of this type of defence (it can also
impose undue latency on legitimate email). However, provided the dead
hosts still have TLSA records, (which don't need to match anything, just
need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency
reports:
freshstore.app sifjakobs.de kadaster.nl
univie.ac.at sillysanta.de kiesrijk.nl
gmx.at smartwatcharmbaender.de klassiekemuziek.nl
vbv.at sys4.de liveatamsterdamsebos.nl
boozyshop.be taures.de maastrichtuniversity.nl
eos-contentia.be tu-darmstadt.de mailmore.nl
shopping-nivelles.be tum.de mailon.nl
triodos.be tutanota.de mailplus.nl
nra.bg uni-augsburg.de managementboek.nl
register.bg uni-bielefeld.de markteffectmail.nl
dwvmail.com.br uni-erlangen.de mcmta.nl
e-negociacao.com.br uni-muenchen.de merkmeisjeskleding.nl
e-renegocie.com.br vicinityclo.de mijndomein.nl
zaaztelecom.com.br web.de mijnmagazines.nl
aneel.gov.br westlotto.de minbzk.nl
nic.br sanchezadv.digital mindef.nl
mst.org.br aeldresagen.dk minvenj.nl
registro.br allbuy.dk mm1.nl
activfitness-news.ch annebrauner.dk mulderretail.nl
blackout-bonusclub.ch anodyne.dk nefkens.nl
escalade.ch athleticstudio.dk netpoint.nl
gmx.ch attode.dk netpointfactoring.nl
handy-abovergleich.ch avabeauty.dk nieuwsservice-rvo.nl
hostpoint.ch barons.dk nmnhevents.nl
infomaniak.ch bigsaver.dk notbranded.nl
kalender-win.ch bisgaardshoes.dk ns.nl
msochrono.ch blandselvfroe.dk nuudcare.nl
open.ch boblberg.dk nuwegexclusief.nl
protonmail.ch bog.dk okki.nl
sherlockhomes.ch borgerforslag.dk oomverzekeringen.nl
sms-gagnant.ch bymelanie.dk opnaarwonderland.nl
switch.ch bystinewinther.dk ouderenfonds.nl
votreopinion.ch camillakroeyer.dk ouderportaal.nl
biolinky.co champagneklubben.dk outlawevents.nl
bionoble.co cillouettes.dk overheid.nl
simplelogin.co computerworld.dk oxilionhosted.nl
aim-care.com damask.dk ozsw.nl
albourne.com danskebank.dk partijvoordedieren.nl
alcanside.com densidsteflaske.dk partnermail.nl
also.com dfi.dk podiumcadeaukaart.nl
anonaddy.com dressforsuccess.dk politie.nl
ansigtsyogaonline.com ejvinds.dk pp-prd.nl
aotax.com fibianet.dk previder.nl
autogespot.com foraeldresparring.dk proefdiervrij.nl
azizbekkaoui.com frisorenogbaronen.dk prorun-mail.nl
barasportswear.com fvst.dk protislank.nl
beyondmedals.com gasolinegrill.dk puurfiguur.nl
boozyshop.com gastrotools.dk quicknet.nl
buroventures.com globestudios.dk ranzijn.nl
byic.com hook-up.dk rdw.nl
cainte.com hostedsepo.dk rebirth-festival.nl
canva-facile.com idelig.dk rechtspraak.nl
caskcartel.com inkpro.dk restaurant-sparkling.nl
cm.com kagegrisen.dk rijksoverheid.nl
collarofsweden.com kk.dk rivm.nl
connectsb.com kodbilen.dk rotterdam.nl
cornerstoneplatform.com konkurspriser.dk rvo.nl
danskebank.com kystfisken.dk sans-mail.nl
datev.com lacabra.dk schuurman-schoenen.nl
denhaag.com lammeskindet.dk shampoobars.nl
detectiveforaday.com lederstof.dk shapeit.nl
eliteincomesociety.com legekammeraten.dk shoesme.nl
enoksenwatches.com littleluux.dk sizzthebrand.nl
europesnus.com mastri.dk smartwatchbanden.nl
explorer-hotels.com memery.dk sportrusten.nl
fabfilter.com mobilcovers.dk ssonet.nl
farmergracy.com modstroem.dk stage-app.nl
fastware-hosting.com musclehouse.dk stater.nl
flaneurhomme.com naturhandel.dk steunactie.nl
fromanteel-watches.com netic.dk supportervanschoon.nl
gearboxdigital.com nexsmart.dk technicus.nl
giarite.com nfinitybeauty.dk teeshoppen.nl
gmx.com nimara.dk telefoonglaasje.nl
gohoeorgohome.com no1shop.dk thealphamen.nl
goodforme.com nordd.dk thefightcompany.nl
gosoaky.com nordelegastro.dk transip.nl
grimfrost.com nordicsheep.dk triodos.nl
habitamat.com nota.dk truetickets.nl
habr.com online-mode.dk u-mailer.nl
hannahbarrettyoga.com opdagverden.dk uitgeverijpica.nl
headachecalendar.com perfectjeans.dk upcmail.nl
hedon.com sengefabrikken.dk upfront.nl
highcharts.com seniornews.dk uvt.nl
hwigroup.com shapeit.dk uwv.nl
imcnig.com sillysanta.dk vacaturesonline.nl
infomaniak.com skjold-burne.dk valys.nl
ingthink.com smoon.dk vimexx.nl
intakt.com sneakerzone.dk vluchtelingenwerk.nl
johnbeerens.com stil.dk vpo.nl
joomlapolis.com stormfashion.dk vunzigedeuntjes.nl
jula.com sygeforsikring.dk vvv-venlo.nl
justpadel.com taenk.dk watchbandjes-shop.nl
kabayarefashion.com thenap.dk waternet.nl
kae-cosmetici.com thesneakerstore.dk werkzoeken.nl
kheaa.com trueliving.dk woongarantvolmacht.nl
leszexpertsfle.com trustfitness.dk ziggo.nl
librti.com venderbys.dk zorgmail.nl
lizamariefit.com viggo.dk ankerstjerne.no
luvrefranco.com vind.dk annabellstefanussen.no
mail.com yuaiahaircare.dk babybanden.no
maileroo.com tilburguniversity.edu bull-ski-kajakk.no
mailzerver.com biotheka.ee chillout.no
marsblade.com holt.ee day-et.no
medicaskinpro.com maarahvapood.ee dinholdning.no
meriamecouture.com minuvalik.ee domeneshop.no
mplbeauty.com pesapuuperekeskus.ee dressmykid.no
mydrivingacademy.com sirena.ee gjormer.no
naillak.com surveyturtle.ee guttelus.no
nanolearning.com turunduslabor.ee handelsbanken.no
nautisme-pratique.com myownconference.email hoppin.no
neonfilter.com spam-filter.email hypopressivtrening.no
nine-pine.com spotler.email hyttefeber.no
nomadeyewear.com talentech.email idrettenonline.no
nordicbasketball.com triodos.es jule-genser.no
nordicdogtrainer.com egu.eu kristinetghardeberg.no
novashops.com finesoftware.eu lagerpriser.no
number-nineshop.com qard.eu lillepr.no
oenling.com rybarik.eu marikrogshus.no
offshorecorptalk.com zone.eu metaburn.no
one.com zonevs.eu mystuff.no
orsys.com danskebank.fi nordiskbylien.no
ottobredesign.com f-solutions.fi norisma.no
pageloot.com handelsbanken.fi norskgrammatikk.no
planetnusa.com hersecret.fi raskebriller.no
polyas.com io-tech.fi rushtrampoline.no
pompomlondon.com metaburn.fi smaaungene.no
ppcpcv.com raumanteatteri.fi spillfabrikken.no
protonmail.com sillysanta.fi stilshoppen.no
recwatches.com swiftbanker.fi strikkia.no
remy-jupille.com traficom.fi tickettothemoon.no
run-motion.com ac-strasbourg.fr veronicalill.no
runbox.com boozyshop.fr atelkamera.nu
sankakucomplex.com braceletsmartwatch.fr goget.nu
schizinfo.com compagnie-des-sens.fr happydays.nu
scienceshepherd.com edtm-actu.fr lenhud.nu
scorecloud.com oo2.fr skjutsgruppen.nu
serverclienti.com passefranceallemagne.fr calyxinstitute.org
sisuknitwear.com printique.fr debian.org
solvinity.com privea.fr freebsd.org
stasdock.com fvap.gov fridaysforfuture.org
stater.com aklub.hu gentoo.org
stellarequipment.com fidesz.hu ietf.org
tcs.com italiamail.hu mailbox.org
techvisiongames.com marathonlife.hu mailop.org
theintercept.com nyirbatorvaroskartya.hu netbsd.org
thelabelmachine.com pulowear.hu openssl.org
thepcw.com zsibvasar.hu ozlabs.org
thepcwholesale.com bluebiz.info postfix.org
tibush.com j360.info rfc-editor.org
trainwithlov.com eurocontrol.int samba.org
triodos.com simplelogin.io torproject.org
tuftingshop.com nuudcare.it un-ihe.org
tutanota.com hoj.life loopia.rs
ugritone.com neolink.link pinnbet.rs
up2staff.com education.lu mobily.com.sa
vivaldi.com etat.lu advisamail.se
webcruiter.com restena.lu arbetsformedlingen.se
xfinity.com anonaddy.me bearbell.se
xfinityhomesecurity.com pm.me bearplayshop.se
xfinitymobile.com proton.me bilprovningen.se
ymeuniverse.com army.mil dingolfshop.se
zangra.com dla.mil ellevio.se
bncr.fi.cr health.mil epochtimes-mejl.se
airbank.cz jten.mil fotproffsen.se
akce-incomputer.cz mail.mil getthegallop.se
amenit.cz navy.mil getvibes.se
balikovna.cz nga.mil glowid.se
bewooden.cz osd.mil handelsbanken.se
cinemax.cz socom.mil hellomantle.se
cokoladovnajanek.cz spaceforce.mil inkrebel.se
cpost.cz uscg.mil innebandy24.se
creammy.cz usmc.mil jaramba.se
csob.cz aifi.net jul-troja.se
csobstavebni.cz comcast.net koreanbeauty.se
cuni.cz ewetel.net kth.se
dashofer.cz ficbook.net kulturaktiebolaget.se
dedra.cz fivem.net livlyclothing.se
e-kondomy.cz forwardemail.net lnu.se
ekokoza.cz gmx.net lomervarde.se
fio.cz graphistepro.net loopia.se
gov.cz habramail.net merchsweden.se
hobynaradi.cz hr-manager.net metaburn.se
hypotecnibanka.cz institutocultivo.net mikaelapuranen.se
innogy.cz intares.net minmyndighetspost.se
itesco.cz mailanyone.net naprapatlandslaget.se
kb.cz masterinter.net naturligtsnygg.se
klenotyaurum.cz mijngezondheid.net nordd.se
klubpevnehozdravi.cz mpssec.net nordicsheep.se
ksporting.cz procurios.net polisen.se
manymail.cz ripe.net redaktionen.se
mbank.cz riseup.net samblamail.se
mfcr.cz s-qrc.net sillysanta.se
mindsoft.cz soverin.net silverdotter.se
mkluzkoviny.cz space.net skatteverket.se
mojedatovaschranka.cz t-2.net skolverket.se
mojemincovna.cz transip.net snbostader.se
mrakyhracek.cz alexstory.nl soleplus.se
muni.cz amsterdam.nl spelfabrik.se
nic.cz aquastorexl.nl svenskhusman.se
o2.cz arthouse-online.nl teeshoppen.se
opravdovezlociny.cz balanzs.nl teknikdelar.se
optimail.cz bankhoesdiscounter.nl teknikhallen.se
outlet-alpine.cz belastingdienst.nl theletter.se
p-info.cz bellobox.nl websupport.se
pivoteka.cz beterspellen.nl agatinsvet.sk
poptavej.cz bewustpuur.nl coopka.sk
scrptd.cz bhosted.nl edirect.sk
server4u.cz blushfashionstore.nl fio.sk
shopex.cz bobo.nl gravirovane.sk
smtp.cz body-supplies.nl hecht.sk
sparkys.cz bolerolimonadewinkel.nl mamaaja.sk
stoklasa.cz boozyshop.nl meditec.sk
tefal.cz box.nl mklozkoviny.sk
thinline.cz bruut.nl mnforce-panel.sk
vas-server.cz carre.nl nakupujzdravo.sk
vitalpoint.cz casema.nl nameserver.sk
vshosting.cz cateringdekorenbloem.nl nlp-akademia.sk
zafido.cz cbr.nl partner.sk
zdravestravovani.cz chello.nl penzionmara.sk
zonky.cz citotoetsgroep4.nl poziadavka.sk
bayern.de clubplanner.nl primatravel.sk
bisgaardshoes.de commithappiness.nl rondogo.sk
brandenburg.de cornemarchand.nl travelmail.sk
bund.de debrandaris.nl zapardrobnych.sk
datev.de degros.nl exercere.store
dbtg.de deonlinetandarts.nl zeit-des-wandels.tv
denic.de derooijfotografie.nl afinepairofshoes.co.uk
dfn.de desan.nl clientnews3.co.uk
elster.de dictu.nl handelsbanken.co.uk
ewetel.de digid.nl honeybalm.co.uk
fau.de dimehouse.nl millieandblake.co.uk
freenet.de dorcas.nl nuudcare.co.uk
gmx.de duo.nl teeshoppen.co.uk
huellen-shop.de esuals.nl thecalzonekitchen.co.uk
iks-jena.de extinctionrebellion.nl thewordman.co.uk
jawliner.de ezorg.nl triodos.co.uk
jpberlin.de fitnesskoerier.nl nuudcare.us
knauermann.de fivecityspa.nl quantum-services.us
lmu.de floathouse.nl ru.ac.za
lrz.de glamouryourhair.nl swiftbanker.co.za
mail.de hobbygigant.nl benzakdenimdevelopers.com
mail2many.de home.nl conscience-et-realites.com
mensa.de hostnet.nl thingsilikethingsilove.com
mpg.de huurexpert.nl agirpourlenvironnement.org
oberstdorf.de ikdeburger.nl allevakantiehuizeninbelgie.nl
posteo.de interim-netwerk.nl hoogenboezem-nieuwsbrieven.nl
ruhr-uni-bochum.de jointherebellion.nl
deutsch-franzoesischer-freundschaftspass.de
secumail.de josephinajewelry.nl
