what's wrong?

[Viktor Dukhovni]

On Tue, Jul 14, 2015 at 01:31:16PM +0200, Andreas Schulze wrote:

> Hello,
> 
> messages to *@ewnederland.nl are deferred by postfix-3.0.x here.
> 
> https://dane.sys4.de/smtp/ewnederland.nl say "No TLSA records."
> in contrast:
> # posttls-finger ewnederland.nl
> posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.remote.meulen.nl type=TLSA: Host not found, try again
> posttls-finger: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.remote.meulen.nl type=TLSA: Host not found, try again
> posttls-finger: Failed to establish session to ewnederland.nl via remote.meulen.nl: TLSA lookup error for remote.meulen.nl:25
> 
> as a workaround I configure "ewnederland.nl may" in smtp_tls_policy_map.
> are there better ways?

Try again, the domain is returning validated NXDOMAIN responses
for that qname now.  Perhaps meulen.nl had a brief DNSSEC outage
(failed to sign the zone promptly).  Right now all's well:

    http://dnsviz.net/d/_25._tcp.remote.meulen.nl/dnssec/

You should not see any problems after flushing your resolver's
cache (for at least meulen.nl and is.nl).

As for "better ways", in principle, the right response is to flush
resolver caches first, to see whether any DNS problems are fixed
on the receiving end.  Also check the TLSA base domain via dnsviz.net
and the email domain via https://dane.sys4.de.

If everybody agrees its broken, and you've urgent mail to send,
yes, you can change the Postfix policy to "encrypt" or "may".
Drop their postmaster a note to let them know about the problem,
and ask them to notify you when it is resolved.

You don't want to get stuck with long-term manual overrides in your
policy table.

My list of persistently broken (wrong TLSA RRset) domains is:

    0x20.eu
    1post.de
    cutspin.com
    dilruacs.nl
    fonsecu.de
    fromix.de
    joworld.net
    secufon.de
    tsimnet.eu
    yu.am
    yuam.net

the owners of these domains did not respond to my email alerting
them to the problem.  

I know of another ~90 domains with persistently inaccessible TLSA
RRsets due to misconfigured firewalls or buggy nameservers (compare
with >1500 with a working DANE configuration).

    bb.b.br
    enfam.jus.br
    justicaeleitoral.jus.br
    stj.jus.br
    tre-al.jus.br
    tre-ba.jus.br
    tre-ce.jus.br
    tre-go.jus.br
    tre-ma.jus.br
    tre-mg.jus.br
    tre-ms.jus.br
    tre-mt.jus.br
    tre-pb.jus.br
    tre-pe.jus.br
    tre-pr.jus.br
    tre-rn.jus.br
    tre-rs.jus.br
    tre-sp.jus.br
    ea5dfv.cat
    autorelaxed.com
    convoglio.com
    edsi-tech.com
    gleez.com
    nmihi.com
    pilotnordic.com
    1000listku.cz
    ceskearchivy.cz
    fermontplus.cz
    fosfa.cz
    linuxdays.cz
    palat.cz
    pozorkliste.cz
    thosting.cz
    vetclinic.cz
    vkh.cz
    pe82.de
    truman.edu
    64bitswebhosting.eu
    exceed-it.eu
    studienportal.eu
    kepa.fi
    africanamericanhistorymonth.gov
    americaslibrary.gov
    asianpacificheritage.gov
    congress.gov
    copyright.gov
    crs.gov
    digitalpreservation.gov
    digitizationguidelines.gov
    lis.gov
    nativeamericanheritagemonth.gov
    read.gov
    techtrack.gov
    womenshistorymonth.gov
    dnet.net.id
    asis.io
    192.jp
    dw.centcom.mil
    pasla.net
    kas.eabo.nl
    famklijsen.nl
    freshned.nl
    gmahengelo.nl
    h0st.nl
    lewins.nl
    lgms.nl
    maartenburie.nl
    main.mc-creative.nl
    tvk.nl
    vrijeuitgevers.nl
    xnyhps.nl
    zenger.nl
    flashmedia.no
    gustavsenas.no
    jfcns.net.nz
    patriotguard.org
    alltforhundar.se
    ap2.se
    cloud.ekenberg.se
    fokau.se
    ludl.se
    manc.se
    minhyresvard.se
    nllplus.se
    ostebro.se
    rafel.se
    statskontoret.se
    mof.gov.tw

-- 
	Viktor.