Summary: The DANE domain count is now 3,812,790 (c.f. 3,764,298 last
month). This is in good measure thanks to one.com, who've
recently DNSSEC-signed nearly 40,000 new domains.
The number of domains that return DNSSEC-validated replies in
response to MX queries is 22,203,497 (up from 21,920,074 last
month). Thus DANE TLSA is deployed on ~17.17% of domains with
DNSSEC. For more stats, see <https://stats.dnssec-tools.org/>.
[ See the Credits[0] list below my signature. ]
As of today, I count ~3.81 million domains with correct SMTP DANE TLSA records
at every primary MX host that accepts connections[1]. As expected, the bulk of
the DANE domains are hosted by the DNS/email hosting providers who've enabled
DANE support for the customer domains they host. The top 20 MX host providers
by domain count are below.
This month Last Month
---------- ----------
1248752 one.com 1214014 one.com
294782 hostpoint.ch 293253 hostpoint.ch
200314 infomaniak.ch 199295 infomaniak.ch
170011 transip.nl 170621 mijndomein.nl
169976 mijndomein.nl 169316 transip.nl
147502 argewebhosting.nl 149043 argewebhosting.nl
139123 jouwweb.nl 136880 simply.com
135347 simply.com 135485 jouwweb.nl
110750 hostnet.nl 111153 hostnet.nl
109742 domeneshop.no 109739 domeneshop.no
105546 loopia.se 105386 loopia.se
92424 webhostingserver.nl 92908 webhostingserver.nl
82448 forpsi.com 82361 forpsi.com
71985 zxcs.nl 71933 zxcs.nl
40359 protonmail.ch 41575 active24.com
40321 active24.com 40197 antagonist.nl
40309 antagonist.nl 39401 protonmail.ch
38217 webreus.nl 38308 webreus.nl
31292 pcextreme.nl 31629 pcextreme.nl
28743 xel.nl 28965 xel.nl
The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .br, .cz, .fr, .eu, .no, .be,
.pl, .de and .uk. Speaking of countries, the IPv4 GeoIP distribution of
DANE-enabled MX hosts shows the below top 20 countries (each unique IP
address is counted, so multi-homed MX hosts are perhaps somewhat
over-represented).
This month Last month
----------- ----------
11161 TOTAL 11001 TOTAL
3471 DE, Germany 3398 DE, Germany
1882 US, United States 1908 NL, Netherlands
1879 NL, Netherlands 1835 US, United States
810 FR, France 776 FR, France
431 CZ, Czechia 431 CZ, Czechia
373 GB, United Kingdom 364 GB, United Kingdom
254 FI, Finland 245 FI, Finland
215 CA, Canada 214 CA, Canada
192 AT, Austria 193 AT, Austria
152 SE, Sweden 149 SE, Sweden
143 CH, Switzerland 138 DK, Denmark
140 AU, Australia 138 CH, Switzerland
136 DK, Denmark 136 AU, Australia
114 SG, Singapore 118 SG, Singapore
85 RU, Russia 86 PL, Poland
84 PL, Poland 76 RU, Russia
64 JP, Japan 59 JP, Japan
50 NO, Norway 51 NO, Norway
44 BR, Brazil 45 BR, Brazil
41 IT, Italy 42 IT, Italy
IPv6 is less common than IPv4 for MX hosts, and the top 20 countries by
DANE MX host IPv6 GeoIP are:
This month Last month
---------- ----------
8691 TOTAL 8613 TOTAL
3709 NL, Netherlands 3736 NL, Netherlands
2510 DE, Germany 2472 DE, Germany
879 US, United States 855 US, United States
374 FR, France 364 FR, France
188 CZ, Czechia 186 CZ, Czechia
179 GB, United Kingdom 175 GB, United Kingdom
110 FI, Finland 106 FI, Finland
81 CA, Canada 78 CA, Canada
71 SE, Sweden 72 AU, Australia
69 AU, Australia 66 SE, Sweden
61 CH, Switzerland 59 CH, Switzerland
44 AT, Austria 52 AT, Austria
43 JP, Japan 42 SG, Singapore
41 RU, Russia 37 JP, Japan
39 SG, Singapore 25 NO, Norway
25 DK, Denmark 23 DK, Denmark
24 NO, Norway 22 RO, Romania
21 RO, Romania 21 RU, Russia
19 IE, Ireland 20 IE, Ireland
17 BR, Brazil 18 UA, Ukraine
There are 9,220 unique zones (9,124 last month) in which the underlying
MX hosts are found. This counts each of the above providers as just one
zone, so is a measure of the breadth of adoption in terms of
organizations deploying DANE SMTP.
The number of published MX host TLSA RRsets found is 19,823 (19,650 last
month). These cover 20,113 distinct MX hosts (19,940 last month, some
MX hosts share the same TLSA records through CNAMEs).
The number of DANE domains that at some point were listed in Gmail's
email transparency report is 965 (this is my ad-hoc criterion for a
domain being a large-enough actively used email domain). Of these, 586
are in recent (last 90 days of) reports (see [2] below my signature).
Of the ~3.81 million DANE domains, 12,922 (12,942 last month) have
"partial" TLSA records, that cover only a subset of the (secondary) MX
hosts. While this protects traffic to some of the MX hosts, such
domains are still vulnerable to the usual active attacks via the
remaining MX hosts.
The number of domains with incorrect TLSA records or failure to offer
STARTTLS (even though TLSA records are published) stands today at 1660
(3,354 last month). Some of these have additional MX hosts that don't
have broken TLSA records, so mail can still arrive via the remaining MX
hosts. The affected domain counts for the top 10 problem MX hosts are:
141 mx2.solutive.nl
139 mx1.dotxs.net
110 mail.blueconsulting.cz
35 mx1.mdbraber.com
30 mx2.synetcon.net
23 mx7.constabel-it.de
22 semark.dk
18 web2.sys.ccs-baumann.de
16 snoopy.xs4arabia.com
15 mx1.digi.nl
To avoid email outages, please make sure to monitor the validity of your
own TLSA records, and implement a reliable key rotation procedure. See:
https://dane.sys4.de/common_mistakes
https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md
https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022/17
https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html
https://github.com/baknu/DANE-for-SMTP/wiki/2.-Implementation-resources
https://datatracker.ietf.org/doc/html/rfc7671#section-8.1
https://datatracker.ietf.org/doc/html/rfc7671#section-8.4
After eliminating parked domains that do not accept email, the number of
"real" email domains with bad DNSSEC support stands at 2,018 (2,137 last
month). The top 10 name server operators with problem domains are:
This Month Last month
---------- ----------
1500 neostrada.nl 1633 neostrada.nl
99 worldnic.com 101 worldnic.com
67 ebola.cz 82 epik.com
47 epik.com 71 ebola.cz
40 openprovider.nl 52 dnssrv.nl
40 dnssrv.nl 43 openprovider.nl
15 sectigoweb.com 17 register.com
15 register.com 16 sectigoweb.com
14 std-service.de 11 ispapi.net
11 ispapi.net 10 axc.nl
If anyone has good contacts at some of these providers, please encourage
them to remediate not only the broken domains (I can send them a list),
but also the root cause that makes the breakage possible.
Just one of the domains whose nameservers have broken denial of
existence appears in the last 120 days of Google transparency reports:
mailazy.net
--
Viktor.
[0] Credits: The coverage of DNSSEC domains continues to improve with
ongoing data support from Paul Vixie of Farsight Security. Credits also
due to ICANN for gTLD data via CZDS, and to the TLD registries for .CH,
.COM, .DK, .FI, .FR, .INFO, .IS, .LI, .NL, .NU, .ORG and .SE. More data
sources of ccTLD signed delegations welcome.
[1] Some domains deliberately include MX hosts that are always down,
presumably as a hurdle to botnet SMTP code that gives up where real MTAs
might persist. I am not a fan of this type of defence (it can also
impose undue latency on legitimate email). However, provided the dead
hosts still have TLSA records, (which don't need to match anything, just
need to exist and be well-formed) there's no loss of security.
[2] DANE domains appearing in last 90 days of Google Email transparency
reports:
univie.ac.at barons.dk
kralingsebosfestival.nl
gmx.at bigsaver.dk ledlichtstunter.nl
vbv.at borgerforslag.dk ledstripxl.nl
vorsorgekasse.at byravn.dk lico.nl
boozyshop.be calisweats.dk luxiez.nl
vanbreda.be camillakroeyer.dk mail-studio.nl
digsys.bg computerworld.dk mailmore.nl
tbibank.bg damask.dk mailon.nl
cetelemnegocie.com.br danielspengetips.dk mailplus.nl
dwvmail.com.br densidsteflaske.dk managementboek.nl
e-negociacao.com.br dfi.dk markteffectmail.nl
e-renegocie.com.br digst.dk marktnet.nl
informativoclicksophia.com.br dk-hostmaster.dk mcmta.nl
nic.br eftcentret.dk messen.nl
registro.br ens.dk mijndomein.nl
20km.ch fibianet.dk minbzk.nl
activfitness-news.ch foraeldresparring.dk mindef.nl
blackout-bonusclub.ch fvst.dk mm1.nl
cbd420.ch gastrotools.dk nederweert.nl
coronavirusensuisse.ch gibbu.dk
nieuwsservice-rvo.nl
creditum.ch globestudios.dk nmnhevents.nl
gmx.ch idelig.dk ns.nl
hostpoint.ch incover.dk nubeterengels.nl
infomaniak.ch iphoneopladere.dk nuudcare.nl
msochrono.ch kfst.dk nuwegexclusief.nl
open.ch kodbilen.dk orangebag.nl
protonmail.ch konkurspriser.dk otys.nl
sms-gagnant.ch kystfisken.dk ouderenfonds.nl
switch.ch labelking.dk ouderportaal.nl
santeglobale.club lacabra.dk overheid.nl
simplelogin.co localfitness.dk oxilionhosted.nl
albourne.com lysetikloster.dk
partijvoordedieren.nl
anonaddy.com mobilcovers.dk partnermail.nl
ansigtsyogaonline.com musclehouse.dk paypro.nl
aotax.com netic.dk
podiumcadeaukaart.nl
beaconx.com nickolinecamille.dk politie.nl
boozyshop.com nimara.dk pp-prd.nl
cm.com nordd.dk previder.nl
colourfulrebel.com nota.dk prorun-mail.nl
connectsb.com npkhosting.dk pvv.nl
cryptowallet.com opdagverden.dk quicknet.nl
datev.com punktum.dk rdw.nl
denhaag.com rmc.dk revolt.nl
exegy.com seniornews.dk rijksoverheid.nl
fabfilter.com shapeit.dk rivm.nl
farmergracy.com sitnet.dk rvo.nl
fastware-hosting.com skjold-burne.dk sans-mail.nl
gmx.com smoon.dk schoudercom.nl
groed.com sneakerzone.dk
schuurman-schoenen.nl
habr.com soelvstein.dk shampoobars.nl
highcharts.com stil.dk shapeit.nl
infomaniak.com sundhedspolitisktidsskrift.dk shirtbyhand.nl
ingthink.com themeatclub.dk shoesme.nl
intakt.com thenap.dk sidn.nl
johnbeerens.com thesneakerstore.dk sizzthebrand.nl
joomlapolis.com tricommerce.dk
smartwatchbanden.nl
jula.com trueliving.dk soclever.nl
kabayarefashion.com uni-c.dk spamservice.nl
leszexpertsfle.com uvm.dk sportrusten.nl
librti.com venderbys.dk ssonet.nl
mactabeauty.com vin-huset.dk stater.nl
mail.com yuaiahaircare.dk svb.nl
mplbeauty.com tilburguniversity.edu technishow.nl
nanolearning.com just.ee telefoonglaasje.nl
nine-pine.com kohus.ee thealphamen.nl
one.com mkm.ee transip.nl
orsys.com turunduslabor.ee triodos.nl
pieter-pot.com envie.email truetickets.nl
pompomlondon.com myownconference.email tudelft.nl
ppcpcv.com spam-filter.email uitgeverijpica.nl
protonmail.com spike.email upcmail.nl
protonvpn.com spotler.email uvt.nl
renworkshops.com nuudcare.es uwv.nl
run-motion.com triodos.es valys.nl
runbox.com egu.eu venauto.nl
sankakucomplex.com finesoftware.eu vimexx.nl
schizinfo.com litebit.eu vlissingen.nl
scorecloud.com qard.eu voorschoten.nl
serverclienti.com zonevs.eu vunzigedeuntjes.nl
solvinity.com handelsbanken.fi wassenaar.nl
speciale-offre.com metaburn.fi
watchbandjes-shop.nl
stasdock.com tarjousrinki.fi waternet.nl
stater.com traficom.fi webreus.nl
stellarequipment.com ac-strasbourg.fr xel.nl
t-2.com braceletsmartwatch.fr ziggo.nl
tcs.com compagnie-des-sens.fr zorgmail.nl
teamfdm.com edtm-actu.fr akt.no
thalesgroup.com nuudcare.fr
annabellstefanussen.no
theintercept.com oo2.fr babybanden.no
thepcw.com privea.fr bergengokart.no
thepcwholesale.com fidesz.hu bull-ski-kajakk.no
thesmmacademy.com italiamail.hu chillout.no
triodos.com mszp.hu domeneshop.no
tutanota.com bluebiz.info godvar.no
up2staff.com eurocontrol.int guttelus.no
veganallsorts.com nuudcare.it handelsbanken.no
veka.com neolink.link helsefysio.no
vivaldi.com anonaddy.me hoppin.no
webcruiter.com pm.me hyttefeber.no
webmailph.com proton.me idrettenonline.no
win-rar.com army.mil kashmina.no
xfinity.com dla.mil lagerpriser.no
xfinityhomesecurity.com health.mil marikrogshus.no
xfinitymobile.com jten.mil mystuff.no
bncr.fi.cr mail.mil nordicprint.no
airbank.cz navy.mil norskgrammatikk.no
akce-incomputer.cz nga.mil raskebriller.no
avatech.cz osd.mil rushtrampoline.no
balikovna.cz socom.mil sillysanta.no
bewooden.cz uscg.mil smaaungene.no
cokoladovnajanek.cz usmc.mil spillfabrikken.no
cpost.cz apnic.net storytravel.no
csob.cz benjaminfulford.net strikkia.no
cuni.cz bleucitron.net webcruitermail.no
dashofer.cz comcast.net atelkamera.nu
dedra.cz ewetel.net goget.nu
e-kondomy.cz ficbook.net lenhud.nu
fio.cz fivem.net aegee.org
fishmax.cz gmx.net
agirpourlenvironnement.org
fnusa.cz graphistepro.net debian.org
gov.cz habramail.net eduroam.org
hypotecnibanka.cz hr-manager.net freebsd.org
itesco.cz mailanyone.net gentoo.org
jcu.cz masterinter.net ietf.org
justice.cz mijngezondheid.net irtf.org
kb.cz mpssec.net isc.org
klenotyaurum.cz procurios.net mailbox.org
klubpevnehozdravi.cz relai-smtp.net mailop.org
ksporting.cz ripe.net netbsd.org
manymail.cz riseup.net openssl.org
mbank.cz soverin.net ozlabs.org
mfcr.cz t-2.net postfix.org
mkluzkoviny.cz webreus.net samba.org
mojedatovaschranka.cz yourdomainprovider.net torproject.org
muni.cz 123autoparts.nl
biotechnologia.com.pl
nic.cz 4ps.nl brebank.com.pl
o2.cz amsterdam.nl holandiajobs.pl
optimail.cz aquastorexl.nl anacom.pt
outlet-alpine.cz argeweb.nl cm-portimao.pt
p-info.cz bankhoesdiscounter.nl advania.se
pivoteka.cz beterinbeleggen.nl
arbetsformedlingen.se
poptavej.cz beterspellen.nl
australian-bodycare.se
pre.cz bewustpuur.nl bearplayshop.se
predplatit.cz bhosted.nl bilprovningen.se
scrptd.cz biblionetdrenthe.nl crtzoo.se
senat.cz blushfashionstore.nl ecster.se
server4u.cz bobo.nl ellevio.se
shopex.cz body-supplies.nl enkoping.se
smtp.cz boekwinkeltjes.nl
fashion-copenhagen.se
stoklasa.cz boksen.nl halmstad.se
tiscali.cz bolerolimonadewinkel.nl handelsbanken.se
vas-server.cz boozyshop.nl hellomantle.se
virusfree.cz box.nl jul-troja.se
vitalpoint.cz bronckhorst.nl klasspengar.se
vshosting.cz bruut.nl lnu.se
web4u.cz burgernet.nl lomervarde.se
zafido.cz camperexpo.nl loopia.se
zdravestravovani.cz caracamilla.nl merchsweden.se
zlate-mince.cz carre.nl
minmyndighetspost.se
bayern.de casema.nl nordicprint.se
brandenburg.de cbr.nl
performcollection.se
bund.de chello.nl polisen.se
bundesregierung.de clubplanner.nl refitness.se
datev.de degros.nl sillysanta.se
dfn.de derooijfotografie.nl silverdotter.se
elster.de desan.nl skatteverket.se
ewetel.de dictu.nl skolverket.se
fau.de digibtw.nl snbostader.se
fh-rosenheim.de digid.nl soleplus.se
freenet.de dimehouse.nl spelfabrik.se
gmx.de domain-registry.nl sunet.se
huellen-shop.de dorcas.nl teknikdelar.se
jpberlin.de duo.nl theletter.se
lrz.de eabstest.nl vaccinova.se
mail.de eduid.nl websupport.se
mensa.de efactuurdirect.nl fio.sk
mpg.de esuals.nl
kadernickyservis.sk
posteo.de expeditionfestival.nl mklozkoviny.sk
ruhr-uni-bochum.de extinctionrebellion.nl rondogo.sk
smartwatcharmbaender.de ezorg.nl satro.sk
sys4.de fivecityspa.nl toptop.sk
th-rosenheim.de glamouryourhair.nl vyvado.sk
tum.de hilversum.nl zapardrobnych.sk
tutanota.de hobbygigant.nl
ayolahdigaskeun.co.uk
uni-augsburg.de home.nl clientnews3.co.uk
uni-bielefeld.de hoogenboezem-nieuwsbrieven.nl clientnews4.co.uk
uni-erlangen.de hostingpeople.nl
handelsbanken.co.uk
uni-muenchen.de hostnet.nl
herantapimesra.co.uk
vicinityclo.de hr.nl nuudcare.co.uk
web.de hro.nl
sanjaya-courirs.co.uk
westlotto.de huurexpert.nl triodos.co.uk
allbuy.dk interconnect.nl nuudcare.us
annes-atelier.dk interim-netwerk.nl
quantum-services.us
australian-bodycare.dk kaagenbraassem.nl ru.ac.za
avabeauty.dk kiesrijk.nl stargaze.zone
bambustoej.dk
