Subject: [dane] Postero DANE UI

From: Paul Wouters <[email-masked]>
Date: Tue, 23 Aug 2016 18:09:42 -0400 (EDT)

https://posteo.de/en/blog/new-webmail-interface-displays-servers-with-the-highest-sending-security

 	We have just released a new feature for you: Our webmail interface now
 	shows you which of your contacts you can send to with the optimal
 	security of DANE technology. This can be recognised by a small, green
 	DANE symbol above an email address.

 	For us, the new DANE display is something very special. When we
 	introduced this new piece of security technology in May 2014, Posteo was
 	according to heise.de the first provider worldwide to support DANE. Many
 	IT experts were unsure at that time whether the new technology would
 	become established. In the meantime, this has changed – it is now
 	worthwhile displaying whether another server supports DANE: We now
 	transfer emails to many email servers worldwide using DANE as standard,
 	including large email providers such as 1&1 (as well as mail.com, GMX
 	and web.de) and Comcast.

[...]

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 24 Aug 2016 04:50:57 +0000

> 	DANE symbol above an email address.

Good to hear.  In the mean time, my survey has 40k DANE TLSA domains,
and 69 that have at some been sufficiently high volume to have been
listed on Google's email transparency report (32 listed in the most
report I checked).

I have good reason to expect that the 40k domains will be closer
to 500k domains around the end of this year, but these will be
predominantly small hosted domains, not provider or enterprise
domains that a few exceptions (some of the ones showing up the
Google list) are taking longer to adopt DNSSEC and DANE.

Still, 500k deployed domains by the end of the year will be decent
progress I think.  The top 20 "parent domains" that delegate the
various DANE domains are:

   17927 com
    7414 nl
    3507 de
    2879 net
    2033 org
    1620 eu
     942 be
     719 nu
     354 info
     294 se
     224 amsterdam
     204 at
     190 cz
     176 ch
     171 fr
     154 biz
     134 co.uk
     116 email
      97 xyz
      80 com.br

The top 20 MX providers are:

   24416 transip.nl
    6489 udmedia.de
    1149 nederhost.net
     701 ec-elements.com
     658 bhosted.nl
     222 core-networks.de
     141 frobbit.se
     122 mailbox.org
     115 omc-mail.com
      97 hot-chilli.net
      96 monshouwer.eu
      67 networking4all.net
      59 numeezy.com
      58 vipprodutora.net.br
      54 fyn.nl
      52 mediaweb-it.net
      51 dotplex.com
      43 tutanota.de
      43 sandwich.net
      42 wk-serv.net

The 40k domains are handled by MX hosts with 2049 distinct
certificates.  The top 10 CAs that issued DANE leaf certificates
(by certificate count) are:

 711 O=Let's Encrypt,C=US
 416 O=StartCom Ltd.,C=IL
 185 O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 102 O=GeoTrust Inc.,C=US
  70 O=Gandi,L=Paris,ST=Paris,C=FR
  58 O=Interspire Email Marketing,L=Sao Paulo,ST=SP,C=BR
  43 O=WoSign CA Limited,C=CN
  40 O=GlobalSign nv-sa,C=BE
  31 CN=CAcert Class 3 Root,OU=http://www.CAcert.org,O=CAcert Inc.
  23 CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA

So around 1/3rd of DANE MX host certs are issued by Let's Encrypt.
Some Let's Encrypt users are still struggling with key rotation,
and need some prodding to keep their TLSA records accurate. :-(

-- 
	Viktor.