Subject: Re: [dane] Nudge DANE SMTP adoption at DNSSEC-signed MX hosting providers

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 11 Oct 2016 19:22:04 +0000

On Fri, Aug 26, 2016 at 01:35:52AM +0000, Viktor Dukhovni wrote:

> Many domain hosting providers that also host the email for the
> customer domains.  For a bunch of these providers the MX hosts are
> in a DNSSEC-signed zone, and a non-trivial number of customer MX
> RRsets are also in signed zones.  Consequently, they can easily
> enable DANE SMTP for all the domains in question, just by publishing
> a small set of TLSA records.
> 
> I've reached out to a couple of the providers with the largest
> count of DNSSEC-signed customer domains, but don't have the cycles
> to reach out to the rest.

Two of the MX providers from the original "nudge" list are now
live:

    domeneshop.no	        -- ~42000 domains
    uvt.nl			-- ~290 domains

The first hosts domains for paying customers, the second hosts a
handful of their own domains.  The total number of domains with
TLSA records for SMTP is now greater than 102,000.  These are served
by ~2200 MX hosts (distinct DANE-validated server certificates).

The number of DANE-validated domains that have appeared in Google's
email transparency report (which it seems exludes domains that
don't send a sufficiently high volume of email) was 24 when I
reported that number at M3AAWG last October, it is now 81.  Of
these 43 appear in today's (not just some past) report:

    gmx.at                  mail.de                 otvi.nl
    conjur.com.br           posteo.de               overheid.nl
    nic.br                  ruhr-uni-bochum.de      xs4all.nl
    registro.br             tum.de                  domeneshop.no
    gmx.ch                  uni-erlangen.de         webcruitermail.no
    open.ch                 web.de                  debian.org
    gmx.com                 octopuce.fr             freebsd.org
    mail.com                comcast.net             gentoo.org
    xfinity.com             dd24.net                ietf.org
    bund.de                 gmx.net                 netbsd.org
    fau.de                  hr-manager.net          openssl.org
    gmx.de                  t-2.net                 samba.org
    jpberlin.de             xs4all.net              torproject.org
    kabelmail.de            asp4all.nl
    lrz.de                  bhosted.nl

Which leaves the below for ongoing nudging:

    protonmail.ch
    1024degres.com
    gransy.com
    intility.com
    networking4all.com
    procolix.com
    senta.com
    shoptrader.com
    tornado-mail.com
    aerohosting.cz
    banan.cz
    dc3.cz
    globe.cz
    ignum.cz
    onebit.cz
    seolight.cz
    smtp.cz
    webcloud.cz
    hosting.eu
    mail-scanner.eu
    mailplatform.eu
    anonymail.hu
    dns1.hu
    integrity.hu
    microware.hu
    webtar.hu
    servicios-nic.com.mx
    netvibeshosting.net
    networking4all.net
    ubm-us.net
    2is.nl
    argewebhosting.nl
    atention.nl
    bit.nl
    box.nl
    datacon.nl
    flexfilter.nl
    greenhost.nl
    hostingdiscounter.nl
    hostplan.nl
    iaf.nl
    is.nl
    jouwweb.nl
    mach3builders.nl
    openprovider.nl
    pcextreme.nl
    prolocation.nl
    spamservice.nl
    swathosting.nl
    webguru.nl
    fastname.no
    uniweb.no
    entos.se
    paranormal.se
    ine.co.th

-- 
	Viktor.