Subject: [dane] Nudge DANE SMTP adoption at DNSSEC-signed MX hosting providers

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 26 Aug 2016 01:35:52 +0000

Many domain hosting providers that also host the email for the
customer domains.  For a bunch of these providers the MX hosts are
in a DNSSEC-signed zone, and a non-trivial number of customer MX
RRsets are also in signed zones.  Consequently, they can easily
enable DANE SMTP for all the domains in question, just by publishing
a small set of TLSA records.

I've reached out to a couple of the providers with the largest
count of DNSSEC-signed customer domains, but don't have the cycles
to reach out to the rest.

Therefore, I am posting below a list of the provider domains that
house MX hosts that would DANE-enable 100+ domains by publishing
and monitoring appropriate TLSA records.

Any providers that get wind of this posting might find the links
below useful:

    https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certificates-for-mail-servers-and-dane-part-2-of-2/
    https://www.ietf.org/mail-archive/web/uta/current/msg01498.html
    http://tools.ietf.org/html/rfc7672#section-1.3
    http://tools.ietf.org/html/rfc7671#section-8.1
    http://tools.ietf.org/html/rfc7671#section-8.4
    https://dane.sys4.de/common_mistakes

To whit, below my signature is a list of providers that should be
encouraged to deploy TLSA records having already gone to all the
trouble of doing the hard part and deploying DNSSEC:

If anyone on this list knows the appropriate technical contacts at
one or more of these providers, please feel free to reach out and
give them a gentle nudge in the right direction.  Collectively,
these 58 providers can DANE-enable at least 72 thousand domains.

-- 
	Viktor.

protonmail.ch
1024degres.com
gransy.com
intility.com
networking4all.com
procolix.com
senta.com
shoptrader.com
tornado-mail.com
aerohosting.cz
banan.cz
dc3.cz
globe.cz
ignum.cz
onebit.cz
seolight.cz
smtp.cz
webcloud.cz
hosting.eu
mail-scanner.eu
mailplatform.eu
anonymail.hu
dns1.hu
integrity.hu
microware.hu
webtar.hu
servicios-nic.com.mx
netvibeshosting.net
networking4all.net
ubm-us.net
2is.nl
argewebhosting.nl
atention.nl
bit.nl
blackhole.nl
box.nl
datacon.nl
flexfilter.nl
greenhost.nl
hostingdiscounter.nl
hostplan.nl
iaf.nl
is.nl
jouwweb.nl
mach3builders.nl
openprovider.nl
pcextreme.nl
prolocation.nl
spamservice.nl
swathosting.nl
uvt.nl
webguru.nl
domeneshop.no
fastname.no
uniweb.no
entos.se
paranormal.se
ine.co.th

---

From: "Rene \"Renne\" Bartsch ([email-masked])" <[email-masked]>
Date: Fri, 26 Aug 2016 09:07:28 +0000

BSI TR-03108-1 Secure E-Mail Transport
Requirements for E-Mail Service Providers (EMSP)
regarding a secure Transport of E-Mails
Version: 1.0
Date:
05/12/2016
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR03108/TR03
08-1.pdf;jsessionid=BD19BA2EBEEB22AFE1A8310E1666148E.2_cid286?__blob=publicationFile&v=3

defines DANE-SMTP mandatory in section 2.2.1 for all certified german e-mail providers.

BSI = Federal Office for Information Security (Germany)

I suggest to refer to this document to show e-mail providers DANE-SMTP is already in active use and
even mandatory by governmemnts.

Best regards,

Renne

26. August 2016 03:36, "Viktor Dukhovni" <[email-masked]> schrieb:

> https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certificates-for-mail-servers-an
> -dane-part-2-of-2
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: "Rene \"Renne\" Bartsch ([email-masked])" <[email-masked]>
Date: Fri, 26 Aug 2016 09:21:56 +0000

Sorry, The link contained a session-ID. Here' the correct one:

https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR03108/TR03108-1.pdf?__blob=publicationFile&v=3

---

From: Casper Gielen <[email-masked]>
Date: Mon, 29 Aug 2016 15:27:38 +0200

Hi there,

uvt.nl here, we are working towards deploying DANE on all our zones and
have most of the pieces in place. There's an issue with monitoring that
needs to be fixed before we can go live. We expect to deploy before the
end of the year, probably much sooner.

-- 
Casper Gielen <[email-masked]> | LIS UNIX
PGP fingerprint = 16BD 2C9F 8156 C242 F981  63B8 2214 083C F80E 4AF7

Universiteit van Tilburg | Postbus 90153, 5000 LE
Warandelaan 2 | Telefoon 013 466 4100 | G 236 | http://www.uvt.nl