Subject: [dane] Problem with transip.{eu, net, nl} nameservers and DANE TLSA

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 23 Nov 2014 20:23:45 +0000

As previously noted transip.nl domains emit incorrect denial of
existence NSEC3 records for DANE TLSA queries.  This will cause
email delivery problems to your customers' domains if not resolved
by fixing the nameserver software.  My new (and surely incomplete)
list of affected domains is below.

The newly updated (thanks Casey!) dnsviz.net site now gives a very
clear picture of the problem (just "mouse over" the NSEC3 record
box).  The NODATA response is not accompanied by any NSEC3 records
that match the hash of the Qname:

    http://dnsviz.net/d/_25._tcp.mail.tekoopjes.be/dnssec/?rr=52&ds=all&a=all&doe=on&ta=.

Queries for the TLSA records of all the MX hosts below similarly
fail validation.  What and when might be done to fully address this
issue?

Domain                             _25._tcp.mx-host. TLSA ?
---------------------------------  ---------------------------
tekoopjes.be.                      _25._tcp.mail.tekoopjes.be TLSA ?
gryla.biz.                         _25._tcp.mail.gryla.biz TLSA ?
aimyapp.com.                       _25._tcp.mail.aimyapp.com TLSA ?
allofutopia.com.                   _25._tcp.mail.allofutopia.com TLSA ?
bagatyou.com.                      _25._tcp.mail.bagatyou.com TLSA ?
brunolinux.com.                    _25._tcp.mail.brunolinux.com TLSA ?
chapterthemes.com.                 _25._tcp.mail.chapterthemes.com TLSA ?
code-shop.com.                     _25._tcp.mail.code-shop.com TLSA ?
codingunit.com.                    _25._tcp.mail.codingunit.com TLSA ?
connections-it.com.                _25._tcp.mail01.connections-it.com TLSA ?
cultjer.com.                       _25._tcp.mail.cultjer.com TLSA ?
cvgadget.com.                      _25._tcp.mail.cvgadget.com TLSA ?
eminent-online.com.                _25._tcp.mail.eminent-online.com TLSA ?
gipsyfortuneteller.com.            _25._tcp.mail.gipsyfortuneteller.com TLSA ?
grasscompany.com.                  _25._tcp.mail.grasscompany.com TLSA ?
inspirationalshops.com.            _25._tcp.mail.inspirationalshops.com TLSA ?
jolioriginals.com.                 _25._tcp.mail.jolioriginals.com TLSA ?
kiiroo.com.                        _25._tcp.mail.kiiroo.com TLSA ?
kivits.com.                        _25._tcp.mail.kivits.com TLSA ?
mafiacontrol.com.                  _25._tcp.mail.mafiacontrol.com TLSA ?
mtimpex.com.                       _25._tcp.mail.mtimpex.com TLSA ?
onlinephpfunctions.com.            _25._tcp.mail.onlinephpfunctions.com TLSA ?
regularbolditalic.com.             _25._tcp.mail.regularbolditalic.com TLSA ?
sneltoetsen.com.                   _25._tcp.mail.sneltoetsen.com TLSA ?
startupjuncture.com.               _25._tcp.mail.startupjuncture.com TLSA ?
statfetch.com.                     _25._tcp.mail.statfetch.com TLSA ?
superfoodsi.com.                   _25._tcp.mail.superfoodsi.com TLSA ?
toolshero.com.                     _25._tcp.mail.toolshero.com TLSA ?
trentt.com.                        _25._tcp.mail.trentt.com TLSA ?
villaxl.com.                       _25._tcp.mail.villaxl.com TLSA ?
webshopapp.com.                    _25._tcp.mail.webshopapp.com TLSA ?
zorgverzekering2015.com.           _25._tcp.mail.zorgverzekering2015.com TLSA ?
kinderspiele.de.                   _25._tcp.mail.kinderspiele.de TLSA ?
makeupaktion.de.                   _25._tcp.mail.makeupaktion.de TLSA ?
notprovided.eu.                    _25._tcp.mail.notprovided.eu TLSA ?
cathair.net.                       _25._tcp.mail.cathair.net TLSA ?
whatdoestheinternetthink.net.      _25._tcp.mail.whatdoestheinternetthink.net TLSA ?
12gobiking.nl.                     _25._tcp.mail.12gobiking.nl TLSA ?
80db.nl.                           _25._tcp.office.80db.nl TLSA ?
aanbodpagina.nl.                   _25._tcp.mail.aanbodpagina.nl TLSA ?
alainotjens.nl.                    _25._tcp.mail.alainotjens.nl TLSA ?
androidworld.nl.                   _25._tcp.old.androidworld.nl TLSA ?
baby-slofje.nl.                    _25._tcp.mail.baby-slofje.nl TLSA ?
beginspot.nl.                      _25._tcp.mail.beginspot.nl TLSA ?
benchwarmers.nl.                   _25._tcp.mail.benchwarmers.nl TLSA ?
besteld.nl.                        _25._tcp.mail.besteld.nl TLSA ?
bitlabs.nl.                        _25._tcp.mail.bitlabs.nl TLSA ?
bmwforum.nl.                       _25._tcp.mail.bmwforum.nl TLSA ?
boatcruisesamsterdam.nl.           _25._tcp.mail.boatcruisesamsterdam.nl TLSA ?
boetiek.nl.                        _25._tcp.mail.boetiek.nl TLSA ?
casade.nl.                         _25._tcp.mail.casade.nl TLSA ?
celdomy.nl.                        _25._tcp.mx.celdomy.nl TLSA ?
consentido.nl.                     _25._tcp.mail.consentido.nl TLSA ?
creativegeeks.nl.                  _25._tcp.mail.creativegeeks.nl TLSA ?
cybercell.nl.                      _25._tcp.mail.cybercell.nl TLSA ?
debrugkrant.nl.                    _25._tcp.mail.debrugkrant.nl TLSA ?
diannetemebel.nl.                  _25._tcp.mail.diannetemebel.nl TLSA ?
discountoffice.nl.                 _25._tcp.mail.discountoffice.nl TLSA ?
dresscode.nl.                      _25._tcp.mail.dresscode.nl TLSA ?
droominfo.nl.                      _25._tcp.mail.droominfo.nl TLSA ?
e-matching.nl.                     _25._tcp.mail.e-matching.nl TLSA ?
energy4all.nl.                     _25._tcp.mail.energy4all.nl TLSA ?
erdee.nl.                          _25._tcp.mx01.erdee.nl TLSA ?
ervaringenreview.nl.               _25._tcp.mail.ervaringenreview.nl TLSA ?
etiquette.nl.                      _25._tcp.mail.etiquette.nl TLSA ?
fonq.nl.                           _25._tcp.mail.fonq.nl TLSA ?
g-vloeren.nl.                      _25._tcp.mail.g-vloeren.nl TLSA ?
gamersnet.nl.                      _25._tcp.mail.gamersnet.nl TLSA ?
gamesync.nl.                       _25._tcp.mail.gamesync.nl TLSA ?
gfkintomart.nl.                    _25._tcp.mail.gfkintomart.nl TLSA ?
google-plus-marketing.nl.          _25._tcp.mail.google-plus-marketing.nl TLSA ?
harmonieorkestamstelveen.nl.       _25._tcp.mail.harmonieorkestamstelveen.nl TLSA ?
headlines.nl.                      _25._tcp.mail.headlines.nl TLSA ?
hvzeeland.nl.                      _25._tcp.mail.hvzeeland.nl TLSA ?
hypoconcern.nl.                    _25._tcp.exchange.hypoconcern.nl TLSA ?
indextra.nl.                       _25._tcp.mercurius.indextra.nl TLSA ?
infonu.nl.                         _25._tcp.mail.infonu.nl TLSA ?
interhouse.nl.                     _25._tcp.mail.interhouse.nl TLSA ?
jasperalblas.nl.                   _25._tcp.mail.jasperalblas.nl TLSA ?
koopjegedicht.nl.                  _25._tcp.mail.koopjegedicht.nl TLSA ?
lansolutions.nl.                   _25._tcp.barracuda1.lansolutions.nl TLSA ?
livewall.nl.                       _25._tcp.mail.livewall.nl TLSA ?
managementgoeroes.nl.              _25._tcp.mail.managementgoeroes.nl TLSA ?
marcobax.nl.                       _25._tcp.mail.marcobax.nl TLSA ?
marketingmed.nl.                   _25._tcp.mail.marketingmed.nl TLSA ?
mediumchat.nl.                     _25._tcp.mail.mediumchat.nl TLSA ?
mijnsportwinkels.nl.               _25._tcp.mail.mijnsportwinkels.nl TLSA ?
muziekgebouw.nl.                   _25._tcp.mail.muziekgebouw.nl TLSA ?
nrccarriere.nl.                    _25._tcp.mail.nrccarriere.nl TLSA ?
ohfashion.nl.                      _25._tcp.mail.ohfashion.nl TLSA ?
oldwood.nl.                        _25._tcp.mail.oldwood.nl TLSA ?
ooshopping.nl.                     _25._tcp.mail.ooshopping.nl TLSA ?
oplaadpalen.nl.                    _25._tcp.mail.oplaadpalen.nl TLSA ?
optimusad.nl.                      _25._tcp.mail.optimusad.nl TLSA ?
otjensa.nl.                        _25._tcp.mail.otjensa.nl TLSA ?
partycorner.nl.                    _25._tcp.mail.partycorner.nl TLSA ?
pastoorkingma.nl.                  _25._tcp.mail.pastoorkingma.nl TLSA ?
peekaas.nl.                        _25._tcp.mail.peekaas.nl TLSA ?
penninkhofmode.nl.                 _25._tcp.mail.penninkhofmode.nl TLSA ?
performance.nl.                    _25._tcp.mail.performance.nl TLSA ?
poort3.nl.                         _25._tcp.cs03.poort3.nl TLSA ?
proud2bme.nl.                      _25._tcp.mail.proud2bme.nl TLSA ?
puurweb.nl.                        _25._tcp.mail.puurweb.nl TLSA ?
radiocorp.nl.                      _25._tcp.mail.radiocorp.nl TLSA ?
receptenvandaag.nl.                _25._tcp.mail.receptenvandaag.nl TLSA ?
redskillz.nl.                      _25._tcp.mail.redskillz.nl TLSA ?
reviewspot.nl.                     _25._tcp.mail.reviewspot.nl TLSA ?
sail-2015.nl.                      _25._tcp.mail.sail-2015.nl TLSA ?
seoshop.nl.                        _25._tcp.mail.seoshop.nl TLSA ?
shoeline.nl.                       _25._tcp.mail.shoeline.nl TLSA ?
shopvilla.nl.                      _25._tcp.mail.shopvilla.nl TLSA ?
showhome.nl.                       _25._tcp.mail.showhome.nl TLSA ?
singerlaren.nl.                    _25._tcp.mail.singerlaren.nl TLSA ?
sitepreview.nl.                    _25._tcp.mail.sitepreview.nl TLSA ?
splendense.nl.                     _25._tcp.mailhost.splendense.nl TLSA ?
sportnext.nl.                      _25._tcp.mail.sportnext.nl TLSA ?
studio-donder.nl.                  _25._tcp.mail.studio-donder.nl TLSA ?
tarwegraskoning.nl.                _25._tcp.mail.tarwegraskoning.nl TLSA ?
thatsgaming.nl.                    _25._tcp.mail.thatsgaming.nl TLSA ?
thuiswerkvacatures.nl.             _25._tcp.mail.thuiswerkvacatures.nl TLSA ?
topprice24.nl.                     _25._tcp.mail.topprice24.nl TLSA ?
trendstats.nl.                     _25._tcp.mail.trendstats.nl TLSA ?
vindhetviahier.nl.                 _25._tcp.mail.vindhetviahier.nl TLSA ?
webwinkelsoftware.nl.              _25._tcp.mail.webwinkelsoftware.nl TLSA ?
weeghals.nl.                       _25._tcp.mail.weeghals.nl TLSA ?
why.nl.                            _25._tcp.mail.why.nl TLSA ?
wordfeudpro.nl.                    _25._tcp.mail.wordfeudpro.nl TLSA ?
wouterhol.nl.                      _25._tcp.mail.wouterhol.nl TLSA ?
wrts.nl.                           _25._tcp.mail.wrts.nl TLSA ?
wux.nl.                            _25._tcp.mailoud.wux.nl TLSA ?
wymefa.nl.                         _25._tcp.mail.wymefa.nl TLSA ?
xsarus.nl.                         _25._tcp.mail.xsarus.nl TLSA ?
zipzoo.nl.                         _25._tcp.mail.zipzoo.nl TLSA ?
cpkb.org.                          _25._tcp.mail.cpkb.org TLSA ?
developmentaid.org.                _25._tcp.mail-s01.developmentaid.org TLSA ?
zim-wiki.org.                      _25._tcp.mail.zim-wiki.org TLSA ?
consultancy.uk.                    _25._tcp.mail.consultancy.uk TLSA ?

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 23 Nov 2014 20:35:15 +0000

Many hostnet.nl domains emit incorrect denial of existence NSEC3
records for DANE TLSA queries.  This will cause email delivery
problems to your customers' domains if not resolved by fixing the
nameserver software.  My (surely incomplete) list of affected
domains is below.

The newly updated (thanks Casey!) dnsviz.net site now gives a very
clear picture of the problem (just "mouse over" the NSEC3 record
box).  The NODATA response is not accompanied by any NSEC3 records
that match the hash of the Qname, rather the NSEC3 records prove
NXDOMAIN, but the RCODE is incorrectly NOERROR:

    http://dnsviz.net/d/_25._tcp.banoshop.eu/dnssec/?rr=52&ds=all&a=all&doe=on&ta=.

Domain                             _25._tcp.mx-host. IN TLSA ?
---------------------------------  ---------------------------
banoshop.eu.                       _25._tcp.banoshop.eu. IN TLSA ?
cyclewear.eu.                      _25._tcp.mail.cyclewear.eu. IN TLSA ?
motorcyclespareparts.eu.           _25._tcp.mail.motorcyclespareparts.eu. IN TLSA ?
24uurshop.nl.                      _25._tcp.mail.24uurshop.nl. IN TLSA ?
androididee.nl.                    _25._tcp.androididee.nl. IN TLSA ?
astroblogs.nl.                     _25._tcp.astroblogs.nl. IN TLSA ?
bedrijvenenwinkels.nl.             _25._tcp.mail.bedrijvenenwinkels.nl. IN TLSA ?
bergsalaenigma.nl.                 _25._tcp.mail.bergsalaenigma.nl. IN TLSA ?
bijleszaanstad.nl.                 _25._tcp.mail.bijleszaanstad.nl. IN TLSA ?
bitmagazine.nl.                    _25._tcp.bitmagazine.nl. IN TLSA ?
bouwproducten.nl.                  _25._tcp.mail.bouwproducten.nl. IN TLSA ?
brandsupply.nl.                    _25._tcp.mail.brandsupply.nl. IN TLSA ?
completebeveiliging.nl.            _25._tcp.mail.completebeveiliging.nl. IN TLSA ?
content-hoster.nl.                 _25._tcp.content-hoster.nl. IN TLSA ?
expert.nl.                         _25._tcp.mail.expert.nl. IN TLSA ?
florijnmobiliteit.nl.              _25._tcp.mail.florijnmobiliteit.nl. IN TLSA ?
foodness.nl.                       _25._tcp.mail.foodness.nl. IN TLSA ?
fotoklein.nl.                      _25._tcp.exchange.fotoklein.nl. IN TLSA ?
gangbangstars.nl.                  _25._tcp.gangbangstars.nl. IN TLSA ?
halloprisma.nl.                    _25._tcp.halloprisma.nl. IN TLSA ?
hrdlpn.nl.                         _25._tcp.mail.hrdlpn.nl. IN TLSA ?
ikkijkonline.nl.                   _25._tcp.ikkijkonline.nl. IN TLSA ?
ikwoonfijn.nl.                     _25._tcp.ikwoonfijn.nl. IN TLSA ?
inshared.nl.                       _25._tcp.mail5.inshared.nl. IN TLSA ?
insomnia247.nl.                    _25._tcp.mail.insomnia247.nl. IN TLSA ?
jacquelinelaats.nl.                _25._tcp.jacquelinelaats.nl. IN TLSA ?
jeffreyappel.nl.                   _25._tcp.jeffreyappel.nl. IN TLSA ?
jobbsquare.nl.                     _25._tcp.jobbsquare.nl. IN TLSA ?
joof.nl.                           _25._tcp.mail.joof.nl. IN TLSA ?
kredietspotter.nl.                 _25._tcp.mail.kredietspotter.nl. IN TLSA ?
leestrainer.nl.                    _25._tcp.mail.leestrainer.nl. IN TLSA ?
minimumloon.nl.                    _25._tcp.minimumloon.nl. IN TLSA ?
myshipper.nl.                      _25._tcp.mx.myshipper.nl. IN TLSA ?
nrdbv.nl.                          _25._tcp.mail.nrdbv.nl. IN TLSA ?
oilcontrolsystems.nl.              _25._tcp.mail.oilcontrolsystems.nl. IN TLSA ?
preferenso.nl.                     _25._tcp.mail.preferenso.nl. IN TLSA ?
premiummotors.nl.                  _25._tcp.mail.premiummotors.nl. IN TLSA ?
punkypet.nl.                       _25._tcp.mail.punkypet.nl. IN TLSA ?
rotomdev.nl.                       _25._tcp.rotomdev.nl. IN TLSA ?
sanisale.nl.                       _25._tcp.mail-1.sanisale.nl. IN TLSA ?
showbiznewz.nl.                    _25._tcp.mail.showbiznewz.nl. IN TLSA ?
skipiste-nieuwegein.nl.            _25._tcp.skipiste-nieuwegein.nl. IN TLSA ?
smokinbarrels.nl.                  _25._tcp.mail.smokinbarrels.nl. IN TLSA ?
studeersnel.nl.                    _25._tcp.mail.studeersnel.nl. IN TLSA ?
telefoondetective.nl.              _25._tcp.mail.telefoondetective.nl. IN TLSA ?
teocho.nl.                         _25._tcp.mail.teocho.nl. IN TLSA ?
tijdvooralcoholvrij.nl.            _25._tcp.mail.tijdvooralcoholvrij.nl. IN TLSA ?
toilet-webshop.nl.                 _25._tcp.toilet-webshop.nl. IN TLSA ?
topvitamins.nl.                    _25._tcp.topvitamins.nl. IN TLSA ?
utopiagekte.nl.                    _25._tcp.utopiagekte.nl. IN TLSA ?
vakantie-frankrijk.nl.             _25._tcp.vakantie-frankrijk.nl. IN TLSA ?
venduevoir.nl.                     _25._tcp.venduevoir.nl. IN TLSA ?
werkenbijinventiv.nl.              _25._tcp.mail.werkenbijinventiv.nl. IN TLSA ?
xco-unlimited.nl.                  _25._tcp.mail.xco-unlimited.nl. IN TLSA ?
zonnemarkt.nl.                     _25._tcp.newmail.zonnemarkt.nl. IN TLSA ?
zwokbor.nl.                        _25._tcp.zwokbor.nl. IN TLSA ?

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 23 Nov 2014 22:02:57 +0000

[ Cc: to the dane WG list, in the hope that some here might be
  able to assist, if they have direct contacts at the provider.
  Please don't Cc: any follow-up list discussion to the ISP contact
  address. ]

Many hosting2go.nl domains emit incorrect denial of existence NSEC
records for DANE TLSA queries.  This will cause email delivery
problems to your customers' domains if not resolved by fixing the
nameserver software.  My (surely incomplete) list of affected
domains is below.

For example, the nameservers for albertplatje.nl return NODATA
instead of NXDMAIN for the query below:

    $ dig +cd +dnssec -t tlsa _25._tcp.albertplatje.nl. +nocl +nottl |
	pcregrep 'status:|^;; flags|\.\s+NSEC'
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20796
    ;; flags: qr rd ra cd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
    *.albertplatje.nl.      NSEC    _autodiscover._tcp.albertplatje.nl. A RRSIG NSEC

The NSEC record proves the presence of "_tcp.albertplatje.nl", and
the absence of both "_25._tcp.albertplatje.nl" and "*._tcp.albertplatje.nl"
which lie between the NSEC pair endpoints.  Therefore, this record should
be an NXDOMAIN, not NOERROR (aka NODATA when the answer count is 0).

In this case I believe we have a bug in dnsviz, which fails to note
that NSEC the record proves the existence of the empty non-terminal
"_tcp", and thus the relevant closest encloser is "_tcp" and so
the wildcard RRset is out of scope, and hence the RCODE should be
NXDOMAIN.

    http://dnsviz.net/d/_25._tcp.albertplatje.nl/dnssec/?rr=52&ds=all&a=all&doe=on&ta=.

Domain                             _25._tcp.mx-host. IN TLSA ?
---------------------------------  ---------------------------
albertplatje.nl.                   _25._tcp.albertplatje.nl. IN TLSA ?
azie4y.nl.                         _25._tcp.azie4y.nl. IN TLSA ?
delta-hardware.nl.                 _25._tcp.delta-hardware.nl. IN TLSA ?
digistrip.nl.                      _25._tcp.digistrip.nl. IN TLSA ?
edwords.nl.                        _25._tcp.edwords.nl. IN TLSA ?
flashpatterns.nl.                  _25._tcp.flashpatterns.nl. IN TLSA ?
informatieplatform.nl.             _25._tcp.informatieplatform.nl. IN TLSA ?
kenney.nl.                         _25._tcp.kenney.nl. IN TLSA ?
locdepot.nl.                       _25._tcp.locdepot.nl. IN TLSA ?
mc4e.nl.                           _25._tcp.mc4e.nl. IN TLSA ?
mega-save.nl.                      _25._tcp.mega-save.nl. IN TLSA ?
netspecialist.nl.                  _25._tcp.netspecialist.nl. IN TLSA ?
parfumsector.nl.                   _25._tcp.parfumsector.nl. IN TLSA ?
portraitsbyrhalda.nl.              _25._tcp.portraitsbyrhalda.nl. IN TLSA ?
premiumsecurity.nl.                _25._tcp.premiumsecurity.nl. IN TLSA ?
rijschoolnaz.nl.                   _25._tcp.rijschoolnaz.nl. IN TLSA ?
schaakzone.nl.                     _25._tcp.schaakzone.nl. IN TLSA ?
straxlive.nl.                      _25._tcp.straxlive.nl. IN TLSA ?
we12travel.nl.                     _25._tcp.we12travel.nl. IN TLSA ?
winkelsector.nl.                   _25._tcp.winkelsector.nl. IN TLSA ?

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 23 Nov 2014 22:20:08 +0000

[ Cc: to the dane WG list, in the hope that some here might be
  able to assist, if they have direct contacts at the provider.
  Please don't Cc: any follow-up list discussion to the ISP contact
  address.  This is the final report!  Just 5 DNS hosting providers
  appear to account for all the non-sporadic failures of TLSA
  lookups. ]

Many ns0.nl domains emit incorrect denial of existence NSEC3 records
for DANE TLSA queries.  This will cause email delivery problems to
your customers' domains if not resolved by fixing the nameserver
software.  My (surely incomplete) list of affected domains is below.

    http://dnsviz.net/d/_25._tcp.mail.photoshoplayerstyle.com/dnssec/?rr=52&a=all&ds=all&doe=on&ta=.&tk=

The closest encloser is "mail.photoshoplayerstyle.com", and the
NSEC3 records return exclude the presence of "*mail.photoshoplayerstyle.com":

    $ dig +cd +dnssec -t tlsa _25._tcp.mail.photoshoplayerstyle.com. +nocl +nottl |
	pcregrep 'status:|^;; flags|\.\s+NSEC'
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43917
    ;; flags: qr rd ra cd; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 1
    s65rgcpqslu0ftooro2f1su7nd7ve67b.photoshoplayerstyle.com. NSEC3 1 0 100 57AE8C5E617F9173 40EEHCT3600L9LLE0HTHM25UKF4AKVPJ A NS SOA MX RRSIG DNSKEY NSEC3PARAM
    40eehct3600l9lle0hthm25ukf4akvpj.photoshoplayerstyle.com. NSEC3 1 0 100 57AE8C5E617F9173 5DKJRL27ESVU3IV4EJR83HBJPPURER2K A RRSIG
    qn0r3962bhci2jsktqa29urqefoql1jk.photoshoplayerstyle.com. NSEC3 1 0 100 57AE8C5E617F9173 S65RGCPQSLU0FTOORO2F1SU7ND7VE67B A RRSIG

    $ ldns-nsec3-hash -t 100 -s 57AE8C5E617F9173 _25._tcp.mail.photoshoplayerstyle.com
    dr1og56r60uhgn6l1o81nmr1q71inas6.
    $ ldns-nsec3-hash -t 100 -s 57AE8C5E617F9173 _tcp.mail.photoshoplayerstyle.com
    3launk5llo6614jm12c5si3fbq6td7uh.
    $ ldns-nsec3-hash -t 100 -s 57AE8C5E617F9173 mail.photoshoplayerstyle.com
    40eehct3600l9lle0hthm25ukf4akvpj.
    $ ldns-nsec3-hash -t 100 -s 57AE8C5E617F9173 '*mail.photoshoplayerstyle.com'
    4bkj4e34gpijvjbdfhn6t6urpj4gsb85.
    $ ldns-nsec3-hash -t 100 -s 57AE8C5E617F9173 '*.photoshoplayerstyle.com'
    qn0r3962bhci2jsktqa29urqefoql1jk.

They do however prove the wildcard "*.photoshoplayerstyle.com" A
record, so it seems this is erroneasly reported here despite the
fact that mail.photoshoplayerstyle.com exists.

Domain                             _25._tcp.mx-host. IN TLSA ?
---------------------------------  ---------------------------
photoshoplayerstyle.com.           _25._tcp.mail.photoshoplayerstyle.com. IN TLSA ?
badpunt.nl.                        _25._tcp.mail.badpunt.nl. IN TLSA ?
emij.nl.                           _25._tcp.emijx1.emij.nl. IN TLSA ?
getinteractive.nl.                 _25._tcp.x9.getinteractive.nl. IN TLSA ?
go4camp.nl.                        _25._tcp.mail.go4camp.nl. IN TLSA ?
imageserve.nl.                     _25._tcp.mail.imageserve.nl. IN TLSA ?
internet123.nl.                    _25._tcp.mail.internet123.nl. IN TLSA ?
orionvolleybal.nl.                 _25._tcp.mail.orionvolleybal.nl. IN TLSA ?
sollicitatiedokter.nl.             _25._tcp.mail.sollicitatiedokter.nl. IN TLSA ?
wpnet.nl.                          _25._tcp.mail01.wpnet.nl. IN TLSA ?

-- 
	Viktor.

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Sun, 23 Nov 2014 16:59:40 -0700

Viktor, I appreciate that you are passionate about this topic, but the 
DANE WG is (IMHO) for discussion about developing standards for DANE, 
not complaints about poor implementation or deployment. I for one would 
appreciate it if you would cease copying [email-masked] on these messages.

Peter

-- 
Peter Saint-Andre
https://andyet.com/

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 24 Nov 2014 00:46:21 +0000

On Sun, Nov 23, 2014 at 04:59:40PM -0700, Peter Saint-Andre - &yet wrote:

> Viktor, I appreciate that you are passionate about this topic, but the DANE
> WG is (IMHO) for discussion about developing standards for DANE, not
> complaints about poor implementation or deployment. I for one would

Understood.  No more such messages are planned.  As a brief summary,
we have some deployment hurdles to clear.  If Dan York is willing,
I'll keep him and anyone else who's interested on any progress
reports from the ISPs.  Just drop me a note if you want to stay
in the loop.

-- 
	Viktor.