Subject: [dane] any statistics of deployment available?

From: Hosnieh Rafiee <[email-masked]>
Date: Wed, 6 Jan 2016 12:07:20 +0000

Hi,

Is there any statistics or a site that I can find regarding the deployment of DANE over the internet?

I would appreciate it if you send me such info.

Thanks,
Best,
Hosnieh 

------------------
Dr. Hosnieh Rafiee
Senior Security Researcher 
Security Compentence Center

---

From: Dan York <[email-masked]>
Date: Wed, 6 Jan 2016 12:33:48 +0000

Hosnieh,

On Jan 6, 2016, at 7:07 AM, Hosnieh Rafiee <[email-masked]<mailto:[email-masked]>> wrote:

We have a list of sites providing DNSSEC statistics at:

http://www.internetsociety.org/deploy360/dnssec/statistics/

but as I look at that I realized that we haven't listed any sites with DANE statistics.  One that I know of is:

https://xmpp.net/reports.php#dnssecdane

that lists the number of XMPP (Jabber) servers with DANE records.

It would be great if we had more statistics on DANE deployment.  If anyone else has such a site out there please let me know and I'll be glad to add it to the Deploy360 list.

Dan

P.S. We also have the list of DANE test sites at:

http://www.internetsociety.org/deploy360/resources/dane-test-sites/

but there aren't statistics associated with any of those sites that I can see.
--
Dan York
Senior Content Strategist, Internet Society
[email-masked]<mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked]<mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/

---

From: Hosnieh Rafiee <[email-masked]>
Date: Wed, 6 Jan 2016 12:45:48 +0000

Thanks a lot!
Really helpful.
Best,
Hosnieh

From: Dan York [mailto:[email-masked]]
Sent: 06 January, 2016 1:34 PM
To: Hosnieh Rafiee
Cc: IETF DANE Mailinglist
Subject: Re: [dane] any statistics of deployment available?

Hosnieh,

Dan

---

From: Patrick Ben Koetter <[email-masked]>
Date: Wed, 6 Jan 2016 14:11:06 +0100

> Is there any statistics or a site that I can find regarding the deployment of DANE over the internet?

We did a complete IPv4 scan two weeks ago. AFAIK Viktor is about to analyse
the data. But I don't know when he will be able to present results.

p@rick

-- 
[*] sys4 AG
 
https://sys4.de, +49 (89) 30 90 46 64
Franziskanerstraße 15, 81669 München
 
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

---

From: Shumon Huque <[email-masked]>
Date: Wed, 6 Jan 2016 09:16:34 -0500

> the data. But I don't know when he will be able to present results.

I did a targeted survey of DANE TLSA record deployment (of some key
application services: HTTPS, SMTP, and XMPP) at COM, NET, and the Alexa top
100K recently. See page 11 through 16 of the following presentation
(DNS-OARC, October 2015):

    https://speakerdeck.com/shuque/next-steps-in-dane-adoption

-- 
Shumon Huque

---

From: "Osterweil, Eric" <[email-masked]>
Date: Wed, 6 Jan 2016 14:39:50 +0000

There is also SecSpider.  It tracks deployment stats here:
	http://secspider.verisignlabs.com/stats.html
and deployment growth here:
	secspider.verisignlabs.com/growth.html

Both pages include DNSSEC and DANE stats.

Comments are very welcome.

Eric

> On Jan 6, 2016, at 9:16 AM, Shumon Huque <[email-masked]> wrote:
> 
> I did a targeted survey of DANE TLSA record deployment (of some key application services: HTTPS, SMTP, and XMPP) at COM, NET, and the Alexa top 100K recently. See page 11 through 16 of the following presentation (DNS-OARC, October 2015):
> 
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 6 Jan 2016 19:13:46 +0000

> the data. But I don't know when he will be able to present results.

I don't have the scan data yet, but I will look.  At present my
survey has found just over 10400 domains with working DANE TLSA
records for SMTP, a majority of these are from a three hosting
providers:

    5146 udmedia.de
    1199 mx.transip.email
     933 mx.nederhost.net

Based on email discussion with the top two, it seems I've captured
around 10% of their actual deployed numbers, so the number of SMTP
domains is around 100k, with over 95% of these hosted by the above
providers.

The number of SMTP DANE domains that are "large enough" by whatever
criteria Gmail uses to list a domain in its email transparency
report stands at 30 (was 24 in early October).

We're still early in the deployment process, but DANE support in
OpenSSL will be available soon, which I think will help.  Hard to
adopt a standard with no "running code".

Two of the six DANE patches scheduled for review have been reviewed
and are now part of OpenSSL 1.1.0-dev, the rest will join them soon
I hope.

-- 
	Viktor.

---

From: Hosnieh Rafiee <[email-masked]>
Date: Fri, 8 Jan 2016 20:17:45 +0000

-----Original Message-----
From: dane [mailto:[email-masked]] On Behalf Of Viktor Dukhovni
Sent: 06 January, 2016 8:14 PM
To: [email-masked]
Subject: Re: [dane] any statistics of deployment available?

On Wed, Jan 06, 2016 at 02:11:06PM +0100, Patrick Ben Koetter wrote:

> We did a complete IPv4 scan two weeks ago. AFAIK Viktor is about to 
> analyse the data. But I don't know when he will be able to present results.

I don't have the scan data yet, but I will look.  At present my survey has found just over 10400 domains with working DANE TLSA records for SMTP, a majority of these are from a three hosting
providers:

    5146 udmedia.de
    1199 mx.transip.email
     933 mx.nederhost.net

Based on email discussion with the top two, it seems I've captured around 10% of their actual deployed numbers, so the number of SMTP domains is around 100k, with over 95% of these hosted by the above providers.

The number of SMTP DANE domains that are "large enough" by whatever criteria Gmail uses to list a domain in its email transparency report stands at 30 (was 24 in early October).

We're still early in the deployment process, but DANE support in OpenSSL will be available soon, which I think will help.  Hard to adopt a standard with no "running code".

Two of the six DANE patches scheduled for review have been reviewed and are now part of OpenSSL 1.1.0-dev, the rest will join them soon I hope.

[Hosnieh] Thanks a lot Viktor. Is there any estimation on when this will be available?

Thanks,
Best,
Hosnieh

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 8 Jan 2016 20:26:16 +0000

On Fri, Jan 08, 2016 at 08:17:45PM +0000, Hosnieh Rafiee wrote:

> Two of the six DANE patches scheduled for review have been reviewed and
> are now part of OpenSSL 1.1.0-dev, the rest will join them soon I hope.
> 

    commit 59fd40d4e5030a7257edd11d758eab1dcebb3787
    Author: Viktor Dukhovni <[email-masked]>
    Date:   Thu Jan 7 22:00:14 2016 -0500

    DANE CHANGES

    Reviewed-by: Richard Levitte <[email-masked]>

-- 
	Viktor.

---

From: "Wiley, Glen" <[email-masked]>
Date: Wed, 13 Jan 2016 14:51:01 +0000

Comparable stats from SecSpider for a survey of 1056097 zones at
http://secspider.verisignlabs.com/stats.html

DANE Summary
16065 DANE enabled zones with TLSA records
65 PKIX based Trust Anchor TLSA records (Cert Usage 0)
541   PKIX based End Entity TLSA records (Cert Usage 1)
266   DANE based Trust Anchor TLSA records (Cert Usage 2)
5791  DANE based End Entity TLSA records (Cert Usage 3)
425   Zones have deployed TLSA for Secure SMTP (Port 465)
124   Zones have deployed TLSA for Secure POP3 (Port 995)
503   Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
24 Zones have deployed TLSA for Alternate SMTP (Port 2525)
3024  Zones have deployed TLSA for HTTPS (Port 443)
1996  Zones have deployed TLSA for SMTP (Port 25)
72 Zones have deployed TLSA for POP3 (Port 110)
294   Zones have deployed TLSA for Secure IMAP (Port 993)
201   Zones have deployed TLSA for IMAP (Port 143)

On 1/6/16, 2:13 PM, "Viktor Dukhovni" <[email-masked]> wrote:

>>analyse

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 13 Jan 2016 18:23:42 +0000

> 5791  DANE based End Entity TLSA records (Cert Usage 3)

6663

These numbers don't add up to 16065 (their sum is 6663).  Surely
there are not many zones (a majority?) with TLSA records with usage
other than 0/1/2/3?

> 201   Zones have deployed TLSA for IMAP (Port 143)

These numbers also add to 6663.  Where did the 16k number come
from?  

I have found 10.7k domains for DANE SMTP (port 25) in a sample of
4.8M domains of which 120k have DNSSEC for both the domain MX RRset
and for at least one best preference MX host and so can start
publishing TLSA records.

-- 
	Viktor.

---

From: "Osterweil, Eric" <[email-masked]>
Date: Thu, 14 Jan 2016 15:10:34 +0000

> On Jan 13, 2016, at 1:23 PM, Viktor Dukhovni <[email-masked]> wrote:
> 

A very good question.  The zone count is trying to show how many zones are protected by DANE.  So, if a zone has its MX record (which is protected by DANE) in another zone, we count the referring zone as DANE enabled.  The rationale was that DANE is an application-level protection so if you send email to someone at  given email address, and the SMTP server is under another zone, the users of the email domain are still protected.  That’s why it’s not a direct sum, but you can see we don’t multi-count the actual DANE records.  I’m open to ideas about other ways to express this, but the intuition was to capture how many zones’ users are protected.  Make sense?

> and for at least one best preference MX host and so can start

This sounds really great.  SecSpider has been monitoring as many DNSSEC-signed zones as I’ve been able to find for over 10 years.  We’ve taken user submissions, crawled search engines, etc. in order to study the long term evolution of DNSSEC and how people have managed their zones since pretty much the beginning (we started monitoring every zone we could find right after the DNSSEC RFCs were published).  We’ve found some really interesting things, but keeping abreast of the global deployment has become increasingly difficult.  Would you be amendable to sharing those zones with SecSpider?  I’d love to add them to its longitudinal study.

Thanks!

Eric

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 14 Jan 2016 16:01:31 +0000

> >> 5791  DANE based End Entity TLSA records (Cert Usage 3)

Ok, so that's 6663 TLSA RRsets, but a much larger number of protected
zones due to MX indirection.  So I would clearly separate the RRset
count from the "protected domain" count.

>> 1996  Zones have deployed TLSA for SMTP (Port 25)

So the missing ~10k "zones" (protected domains) are here, because
the other ports are rarely (RFC6186 notwithstanding) subject to
indirection.  

That is you've found 1996 MX hosts with TLSA RRsets?  Or 1996 zones
with 1 or more MX hosts with TLSA RRsets, or a total of 1996 TLSA
records for port 25?  I am guessing the latter, because that's what
makes the "certificate usage" total equal to the "by port" total.

In that case our numbers are similar, I have 10.7k email SMTP
domains covered by TLSA records of 1564 MX hosts with 2212 TLSA
RRs (at least, because there are cases where I don't look for any
TLSA RRs on worse priority MX hosts if a better priority MX hosts
have no TLSA records).  Of the 10.7k domains 200 have incomplete
TLSA record coverage in that some MX hosts are not protected, so
the "domain" is not secured against MITM by attackers who block
access to the protected MX hosts.

-- 
	Viktor.

---

From: "Osterweil, Eric" <[email-masked]>
Date: Thu, 14 Jan 2016 17:41:00 +0000

> On Jan 14, 2016, at 11:01 AM, Viktor Dukhovni <[email-masked]> wrote:
> 

Yep.  The RR counts are listed below the zone count.  I think this is precisely what led you to notice.  That is, all of the counts below the zone count are RR counts.

> the other ports are rarely (RFC6186 notwithstanding) subject to

Any of the mail protocols is subject to this indirection, as those DANE records are based off the MX record.

> makes the "certificate usage" total equal to the "by port" total.

There are 1996 TLSA Resource Records that have the domain name _25._tcp.<domain name>.  Each RR at every domain name gets counted separately.  So, if someone has two RRs at the same domain name, SecSpider counts two, not one.

> access to the protected MX hosts.

That’s very interesting!

Eric

---

From: Dan York <[email-masked]>
Date: Wed, 27 Jan 2016 22:08:34 +0000

Just to close the loop on the listing of DANE statistics, I've now added the sites and presentation shared on this list to the DNSSEC Statistics page on Deploy360:

http://www.internetsociety.org/deploy360/dnssec/statistics/#dane

If anyone has additional DANE-related statistics that I should enter there, please let me know.

Thanks,
Dan