Subject: [Uta] NEWSFLASH: DANE TLSA records published for web.de!

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 14 Apr 2016 18:38:56 +0000

The web.de domain has just published DANE TLSA records for its MX
hosts.  This follows earlier "pilot" deployments with the smaller
mail.com and mail.de domains.

    web.de. IN MX 100 mx-ha02.web.de. ; AD=1
    _25._tcp.mx-ha02.web.de. IN TLSA 3 1 1 409c9e91a2a9f4d7881dbf0094b3839d4343a4a57d9bf559fdeb0c1f4c5b8b3e ; passed

    Subject = CN=mx-ha02.web.de,emailAddress=[email-masked],L=Montabaur,ST=Rhineland-Palatinate,O=1&1 Mail & Media GmbH,C=DE
    Issuer = CN=TeleSec ServerPass DE-2,street=Untere Industriestr. 20,L=Netphen,postalCode=57250,ST=Nordrhein Westfalen,OU=T-Systems Trust Center,O=T-Systems International GmbH,C=DE
    Inception = 2014-07-22T11:21:46Z
    Expiration = 2017-07-27T23:59:59Z

    web.de. IN MX 100 mx-ha03.web.de. ; AD=1
    _25._tcp.mx-ha03.web.de. IN TLSA 3 1 1 33fccf0e82584b6133cf18d24ae592cc6cbc9cfcab13291a5585a2b20a30eb19 ; passed

    Subject = CN=mx-ha03.web.de,emailAddress=[email-masked],L=Montabaur,ST=Rhineland-Palatinate,O=1&1 Mail & Media GmbH,C=DE
    Issuer = CN=TeleSec ServerPass DE-2,street=Untere Industriestr. 20,L=Netphen,postalCode=57250,ST=Nordrhein Westfalen,OU=T-Systems Trust Center,O=T-Systems International GmbH,C=DE
    Inception = 2014-07-22T11:22:46Z
    Expiration = 2017-07-27T23:59:59Z

This is a major milestone in DANE adoption.  [ IIRC they host
mailboxes for a substantial fraction of the population of Germany. ]

One approach to making sure that DANE TLSA records are less likely
to fail that should work well for sites using CA-issued certificates
is to publish both "3 1 1" and "2 1 1" TLSA records:

    mx.example. IN TLSA 3 1 1 <digest of server public key>
    mx.example. IN TLSA 2 1 1 <digest of immediate issuer public key>

    * The "3 1 1" record protects against "expiration" accidents, and
      unexpected changes in the issuer's public key (if new certificate
      chain deployment is automated).

    * The "2 1 1" record protects against key rotation errors should a
      a new server private key be deployed without updating the TLSA
      RRs.  Provided the new certificate is issued by the same CA
      is unexpired, ... the "2 1 1" record will match.

With a bit of monitoring to ensure that both records match,
simultaneous failures of both is much less likely.

This even makes it possible to avoid pre-deployment DNS TLSA records
updates when rotating certificates, provided at least one of the
issuer public key or the server public key is unchanged in the new
chain.

In particular, this is the best practice with Let's Encrypt
issued SMTP server certificates, as explained in:

    https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certificates-for-mail-servers-and-dane-part-2-of-2/

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 21 Apr 2016 16:17:35 +0000

On Thu, Apr 14, 2016 at 06:38:56PM +0000, Viktor Dukhovni wrote:

> hosts.

And today also the rest of the major 1&1 (Mail&Media) email domains:

    gmx.de
    gmx.net
    gmx.com
    gmx.ch
    gmx.at

> mailboxes for a substantial fraction of the population of Germany. ]

    https://icannwiki.com/.gmx

    With over 32 million customers Mail&Media covers nearly 50% of
    the German Webmail market. With its brands, Mail&Media is the
    largest free email provider in the German speaking countries
    of Germany, Switzerland, Austria, Luxembourg and Liechtenstein.

Together with web.de this likely makes over 30 million recently
added mailboxes with DANE TLSA records.  DANE is now supported by
the below home internet / email / hosting  providers.

    gmx.at
    gmx.ch
    gmx.com
    mail.com
    gmx.de
    posteo.de
    unitymedia.de
    web.de
    comcast.net
    gmx.net
    t-2.net
    xs4all.net
    xs4all.nl
    transip.nl
    udmedia.de
    nederhost.net

DANE is no longer just at hobbyist domains and a few smaller early
adopters like Posteo and Unitymedia.  This is starting to get
interesting.

While the even larger Gmail, Outlook.com/Hotmail, Yahoo ... are
not in the near term in a position to deploy DNSSEC, I expect that
doing so is simpler for outlook.com, because this domain does not
overlap with major web properties whose scale makes the transition
considerably more difficult.  So it would be great to add Microsoft
to the above list some time in 2017 (or sooner).

DANE for gmail.com is also plausible without impacting all of
Google, but requires moving the MX hosts out of the present
google.com.

-- 
	Viktor.

---

From: Anders Berggren <[email-masked]>
Date: Sat, 23 Apr 2016 01:39:54 +0200

> On 21 Apr 2016, at 18:17, Viktor Dukhovni <[email-masked]> wrote:

Am I correct in assuming that none of the very big (Gmail, et al) do DANE verification when sending email? Given that Google’s public DNS resolvers have supported DNSSEC since many years, I think it would make sense for Google to start delivering email with DANE, regardless of what they decide to do for inbound email.

> Google, but requires moving the MX hosts out of the present

The domain googlemail.com used to be part of the Google Apps MX. Speaking of which; it would also make DANE available to the millions of domains[1] using Google Apps, as a bonus.

[1] http://research.domaintools.com/statistics/mailservers/

---

From: Daniel Margolis <[email-masked]>
Date: Mon, 25 Apr 2016 10:06:54 +0200

That's correct. We'd like to do DANE validation on sends, but I can't
guarantee if or when it will happen right now. But it's on our radar.

I agree with Viktor that moving the MXs to a different domain might
mitigate some of the common concerns here. Of course, hosted domains will
still have to be able to host DNSSEC to secure their MX records, but this
is getting a bit more commonplace.

Dan

On Sat, Apr 23, 2016 at 1:39 AM, Anders Berggren <[email-masked]> wrote:

> Am I correct in assuming that none of the very big (Gmail, et al) do DANE
> verification when sending email? Given that Google’s public DNS resolvers
> have supported DNSSEC since many years, I think it would make sense for
> Google to start delivering email with DANE, regardless of what they decide
> to do for inbound email.
>
> The domain googlemail.com used to be part of the Google Apps MX. Speaking
> of which; it would also make DANE available to the millions of domains[1]
> using Google Apps, as a bonus.
>
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>