Subject: [Uta] List of domains supporting mta-sts?

From: Alberto Bertogli <[email-masked]>
Date: Sun, 1 Jul 2018 23:18:51 +0100

Hi!

In order to do interoperability testing of an mta-sts implementation, I 
was wondering: does anyone have a list of domains currently supporting 
mta-sts?

I don't expect anything canonical or formal of course, but maybe someone 
knows or has already collected something like this.

I'm already testing against gmail.com (which currently has an invalid 
policy, though) and I'm curious if there are other domains that I can 
test email sending and/or receiving against.

Thanks!
		Alberto

---

From: "Brotman, Alexander" <[email-masked]>
Date: Mon, 2 Jul 2018 13:37:27 +0000

Alberto,

"comcast.net" also has an MTA-STS record, as well as a TLSRPT record.

--
Alex Brotman
Sr. Engineer, Anti-Abuse
Comcast

-----Original Message-----
From: Uta [mailto:[email-masked]] On Behalf Of Alberto Bertogli
Sent: Sunday, July 01, 2018 6:19 PM
To: [email-masked]
Subject: [Uta] List of domains supporting mta-sts?

Hi!

In order to do interoperability testing of an mta-sts implementation, I was wondering: does anyone have a list of domains currently supporting mta-sts?

I don't expect anything canonical or formal of course, but maybe someone knows or has already collected something like this.

I'm already testing against gmail.com (which currently has an invalid policy, though) and I'm curious if there are other domains that I can test email sending and/or receiving against.

Thanks!
		Alberto

_______________________________________________
Uta mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/uta

---

From: Daniel Margolis <[email-masked]>
Date: Tue, 3 Jul 2018 19:23:41 +0200

I think the Gmail.com record should be fixed, if you were referring to the
use of '.aspmx.l.google.com' without the leading '*'.

I don't know of a canonical list. It seems reasonable to me that someone
who has implemented MTA-STS at send-time should publish a list of the top
domains they see with a record.

One other, hackish, approach would be to find a list of domains with mail
enabled and just scrape for the existance of mta-sts records. I seem to
recall recently seeing a source of "domains that exist" from one of the big
public DNS providers, but I don't recall where.

https://github.com/opendns/public-domain-lists would maybe work, but it's
not the one I was thinking of.

$ for d in `cat domains.txt`; do dig  txt _mta-sts.$d|grep v=STSv1 >>
sts_domains.txt; done;

$ cat sts_domains.txt
_mta-sts.google.com.    273     IN      TXT     "v=STSv1; id=20171114T070707;"
_mta-sts.yahoo.com.     1681    IN      TXT     "v=STSv1; id=20161109010200Z;"
_mta-sts.gmail.com.     299     IN      TXT     "v=STSv1; id=20171114T070707;"
_mta-sts.office365.com. 299     IN      TXT     "v=STSv1; id=20180321T030303;"
_mta-sts.outlook.com.   299     IN      TXT     "v=STSv1; id=20180321T030303;"
_mta-sts.office.com.    299     IN      TXT     "v=STSv1; id=20180321T030303;"
_mta-sts.comcast.net.   7199    IN      TXT     "v=STSv1; id=1468426233;"
_mta-sts.googlemail.com. 299    IN      TXT     "v=STSv1; id=20171114T070707;"
_mta-sts.gmx.com.       21599   IN      TXT     "v=STSv1;id=20170124175100Z;"
_mta-sts.web.de.        21599   IN      TXT     "v=STSv1;id=20170124174800Z;"
_mta-sts.gmx.net.       21599   IN      TXT     "v=STSv1;id=20170124174800Z;"
_mta-sts.mail.com.      21599   IN      TXT     "v=STSv1;id=20170124173500Z;"

I know a bunch of these are not valid per the current form of the spec, but
it gives you a sense of what hypothetical adoption might be.

Dan

On Mon, Jul 2, 2018 at 3:37 PM Brotman, Alexander <
[email-masked]> wrote:

> policy, though) and I'm curious if there are other domains that I can test
> email sending and/or receiving against.
>
> Thanks!
>                 Alberto
>

---

From: Ayke van Laethem <[email-masked]>
Date: Thu, 5 Jul 2018 00:48:40 +0200

I've needed domains to test my own validator[1] over the last year.
Currently valid domains are:
  google.com
  gmail.com
  comcast.net
  aykevl.nl (my own domain)

Some currently invalid ones:
  yahoo.com
  outlook.com
  mail.com

Note: this isn't meant to name-and-shame, just to test these domains. They
usually simply implement an older version of the spec.
Also, I've received a few reports of issues in the validator with some
domains (mostly smaller ones), and of course there is the HTTP log, but I
don't think I can just share those domains here.

[1]: https://aykevl.nl/apps/mta-sts/

-- Ayke

Op di 3 jul. 2018 om 19:24 schreef Daniel Margolis <dmargolis=
[email-masked]>:

> use of '.aspmx.l..google.com <http://aspmx.l.google.com>' without the
> leading '*'.
>
> $ for d in `cat domains.txt`; do dig  txt _mta-sts.$d|grep v=STSv1 >> sts_domains.txt; done;
>
> $ cat sts_domains.txt
> I know a bunch of these are not valid per the current form of the spec,
> but it gives you a sense of what hypothetical adoption might be.
>
> Dan
>
>> "comcast.net" also has an MTA-STS record, as well as a TLSRPT record..
>>
>> --
>> Alex Brotman
>> Sr. Engineer, Anti-Abuse
>> Comcast
>>
>>