Update on stats 2017-08

[Viktor Dukhovni]

Summary:  Mostly the same as last month, but new code made possible more
	  comprehensive coverage of domains with DNS issues.  As a result,
	  the number of reported DNS issues has increased by almost 75%.
	  This is not an actual surge in DNS problems, rather just better
	  reporting of the existing (still improving) landscape.

	  The number of DANE-enabled domains that have also been sighted
	  on Google's email transparency report has increased from 114 to
	  115, while the number of DNS zones with TLSA-enabled primary MX
	  hosts has increased from 2668 to 2708.  The domain count has
	  increased from 171738 to 172205.

	  A new type of TLSA record mismatch is starting to show up, so
	  far on just two MX hosts.  Their RSA certificate chains match
	  their TLSA records, but their ECDSA certificate chains do not:

	  https://mail.sys4.de/pipermail/dane-users/2017-August/000416.html
	  https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html

As of today I count 172205 domains with correct DANE TLSA records for
SMTP.  As expected the bulk of the DANE domains are hosted by the handful
of DNS/hosting providers who've enabled DANE support in bulk for the
domains they host.  The top 10 MX host providers by domain count are:

   68968 domeneshop.no
   60617 transip.nl
   18365 udmedia.de
    6576 bhosted.nl
    1809 nederhost.net
    1331 yourdomainprovider.net
    1003 ec-elements.com
     517 core-networks.de
     378 omc-mail.com
     326 bit.nl

The real numbers are surely larger, because I don't have access to the
full zone data for most ccTLDs, especially .no/.nl/.de.

There are 2708 unique zones in which the underlying MX hosts are found,
this counts each of the above providers as just one zone, so is a measure
of the breadth of adoption in terms of servers deployed.  Alternatively,
a similar number is seen in the count (2933) of distinct MX host server
certificates that support the same ~172000 domains.

A related number is 3585 matching TLSA RRsets found SMTP MX hosts.  These
cover 3708 distinct MX hosts (some of which clearly employ a shared
certificate).

The number of domains that at some point were listed in Gmail's email
transparency report is 115 (this is my ad-hoc criterion for a domain being
a large-enough actively used email domain).  Of these, 59 are in recent
reports:

  gmx.at                   jpberlin.de              ouderportaal.nl
  travelbirdbelgie.be      lrz.de                   overheid.nl
  nic.br                   mail.de                  pathe.nl
  registro.br              posteo.de                xs4all.nl
  gmx.ch                   ruhr-uni-bochum.de       domeneshop.no
  open.ch                  tum.de                   webcruitermail.no
  switch.ch                uni-erlangen.de          debian.org
  anubisnetworks.com       unitymedia.de            freebsd.org
  gmx.com                  web.de                   gentoo.org
  mail.com                 egmontpublishing.dk      ietf.org
  solvinity.com            enron.email              isc.org
  trashmail.com            octopuce.fr              netbsd.org
  xfinity.com              comcast.net              openssl.org
  xfinityhomesecurity.com  dd24.net                 samba.org
  bayern.de                gmx.net                  torproject.org
  bund.de                  hr-manager.net           asf.com.pt
  elster.de                mpssec.net               minmyndighetspost.se
  fau.de                   t-2.net                  skatteverket.se
  freenet.de               xs4all.net               t-2.si
  gmx.de                   asp4all.nl

Of the ~172000 domains, 811 have "partial" TLSA records, that cover only
a subset of the MX hosts.  While this protects traffic to some of the MX
hosts, such domains are still vulnerable to the usual active attacks via
the remaining MX hosts.

The number of domains with incorrect TLSA records or failure to advertise
STARTTLS (even though TLSA records are published) stands today at 111.
Below is a list of the 69 underlying MX hosts that serve these domains
and whose TLSA records don't match reality:

  Hall of Shame:

  mail.dipietro.id.au          mutt.lsexperts.de     wfbrace.net
  eumembers.stansoft.bg        mail.manima.de        mx2.wfbrace.net
  mail.gna.ch                  mx1.spamsponge.de     mx2.cbrace.nl
  andbraiz.com                 mx.thorko.de          mx3.cbrace.nl
  mail.digitalwebpros.com      mail.0pc.eu           cinnamon.nl
  mail.itsmine.com             webmail.kassoft.eu    smtp1.gblt.nl
  demo.liveconfig.com          mx.quentindavid.fr    mail.initfour.nl
  mx04.mykolab.com             servmail.fr           smtp1.lococensus.nl
  intranet.nctechcenter.com    upc.dircon.hu         mail.myzt.nl
  ny-do.pieterpottie.com       mail.demongeot.info   nuj-netherlands.nl
  ma.qbitnet.com               mail.nonoserver.info  mx2.nuj-netherlands.nl
  diablo.sgt.com               kd2.io                mail.solarisinternetgroep.nl
  tusk.sgt.com                 node2.mxbackup.io     bounder.steelyard.nl
  stmics01.smia-automotive.com mail.laukas.lt        vanderbijlict.nl
  stmics02.smia-automotive.com mx.datenknoten.me     mail.abanto-zierbena.org
  erg.verweg.com               mx.giesen.me          beerstra.org
  mx.bels.cz                   rootbox.me            smtp.copi.org
  gaia.nfx.cz                  lima.ahrain.net       eumembers.datacentrix.org
  mail.seslost.cz              mail.castleturing.net smtp3.amadigi.ovh
  mail.3c7.de                  horse.cherrypet.net   mail.pasion.ro
  mail.afaul.de                mail.efflam.net       mail.familie-sander.rocks
  awesome-mail.de              hs.kuzenkov.net       mail.rostit.se
  mail.denniseffing.de         oostergo.net          protector.rajmax.si

The number of domains with bad DNSSEC support is 649.  Most of the increase
is from accenture.com domains, almost all likely parked, so the actual
impact on email delivery is probably small to none.  The top 10 name server
operators with problem domains are:

 145 accenture.com
  61 jsr-it.nl
  26 tiscomhosting.nl
  26 active24.cz
  21 firstfind.nl
  18 bradesco.com.br
  17 usda.gov
  10 rotterdam.nl
  10 loopia.se
  10 fde.dk

Around 79 of the broken domains have at least one working nameserver,
and so are email-reachable, given enough retries.  Only 5 of the
DNS-broken domains appear in historical Google Email transparency
reports:

  tiviths.com.br
  tre-ce.jus.br
  tre-sp.jus.br
  tse.jus.br
  nsysu.edu.tw

The associated DNS lookup issues are:

  _25._tcp.mailhost.bncr.fi.cr. IN TLSA ? ; ServFail
  _25._tcp.barracuda.nsysu.edu.tw. IN TLSA ? ; ServFail
  _25._tcp.lalavava.tse.jus.br. IN TLSA ? ; timeout
  _25._tcp.mx.tiviths.com.br. IN TLSA ? ; timeout
  _25._tcp.mandark.tse.jus.br. IN TLSA ? ; timeout
  _25._tcp.dexter.tse.jus.br. IN TLSA ? ; timeout

  [ See <https://tools.ietf.org/html/draft-ietf-dnsop-no-response-issue-08>,
    Much of the TLSA non-response issue seems to be related to a
    "feature" of Arbor Networks firewalls, that enables droping of
    DNS requests for all but the most common RRtypes.  Do not make
    the mistake of enabling this firewall "feature". ]

The oldest outstanding DNS issue is another SOA signature issue
at truman.edu dating back to Nov/2014:

  http://dnsviz.net/d/_25._tcp.barracuda.truman.edu/VGzORw/dnssec/

I hope some day soon they'll start missing email they care about
and take the time to resolve the problem.

-- 
	Viktor.