Don't forget to add TLSA records for black-hole MX hosts

[Viktor Dukhovni]

Some domains with DANE-TLSA records for their primary MX hosts
neglect to publish DANE TLSA for secondary and/or "black-hole"
(spam magnet) MX hosts.

Consider nic.cz, until recently their "bh.nic.cz" host had no TLSA
records (and SMTP connections to that host would time out).  This
gives an active on-path MiTM attacker opportunity to block connections
to the working MX hosts, and accept unauthenticated connections to
the black-hole MX host.  After they were notified of the problem,
they made changes, and now we see TLSA records associated with
all the MX hosts, including "bh.nic.cz":

    nic.cz. IN MX 10 mail.nic.cz. ; NOERROR AD=1
    nic.cz. IN MX 20 mx.nic.cz. ; NOERROR AD=1
    nic.cz. IN MX 30 bh.nic.cz. ; NOERROR AD=1
    ;
    mail.nic.cz. IN A 217.31.204.67 ; NOERROR AD=1
    mail.nic.cz. IN AAAA 2001:1488:800:400::400 ; NOERROR AD=1
    _25._tcp.mail.nic.cz. IN TLSA 3 1 1 4f9736249ab586f37fc110856f6a3358adadbf99db03628866466194f5bb2e09 ; NOERROR AD=1
    ;
    mx.nic.cz. IN A 217.31.58.56 ; NOERROR AD=1
    mx.nic.cz. IN AAAA 2001:1ab0:7e1e:c574:7a2b:cbff:fe33:7019 ; NOERROR AD=1
    _25._tcp.mx.nic.cz. IN TLSA 3 1 1 aa7b93daab084536530bd3256e9ceff4557cb43512640f7ab64487dc9ca14fab ; NOERROR AD=1
    ;
    bh.nic.cz. IN A 217.31.204.252 ; NOERROR AD=1
    bh.nic.cz. IN AAAA ? ; NODATA AD=1
    _25._tcp.bh.nic.cz. IN TLSA 3 1 1 4f9736249ab586f37fc110856f6a3358adadbf99db03628866466194f5bb2e09 ; NOERROR AD=1

I've not yet nagged "iis.se" or "wia.cz", and there we see that
only one of the two MX hosts has a TLSA record:

    iis.se. IN MX 5 mx1.iis.se. ; NOERROR AD=1
    iis.se. IN MX 5 mx2.iis.se. ; NOERROR AD=1
    ;
    mx1.iis.se. IN A 91.226.36.35 ; NOERROR AD=1
    mx1.iis.se. IN AAAA 2a00:801:f0:106::35 ; NOERROR AD=1
    _25._tcp.mx1.iis.se. IN TLSA 3 1 1 0894a6827f435ccb7435552290ff13e704776e4568235bbc899f515de3314ce3 ; NOERROR AD=1
    ;
    mx2.iis.se. IN A 91.226.37.39 ; NOERROR AD=1
    mx2.iis.se. IN AAAA 2001:67c:124c:2007::39 ; NOERROR AD=1
    _25._tcp.mx2.iis.se. IN TLSA ? ; NXDOMAIN AD=1

    wia.cz. IN MX 10 antispam.wia.cz. ; NOERROR AD=1
    wia.cz. IN MX 20 bntispam.wia.cz. ; NOERROR AD=1
    ;
    antispam.wia.cz. IN A 80.250.3.18 ; NOERROR AD=1
    antispam.wia.cz. IN AAAA ? ; NODATA AD=1
    _25._tcp.antispam.wia.cz. IN TLSA 3 1 1 3b67e777e8a11d373fae958c3ea5a200bd791813c0e6e9be34e2965bcfcc071e ; NOERROR AD=1
    ;
    bntispam.wia.cz. IN A 31.7.247.78 ; NOERROR AD=1
    bntispam.wia.cz. IN AAAA ? ; NODATA AD=1
    _25._tcp.bntispam.wia.cz. IN TLSA ? ; NXDOMAIN AD=1

While during initial deployment it is natural to proceed incrementally
and add TLSA records to one MX host at a time, and test thoroughly
before moving on to the rest, the end-state should be to publish
TLSA records for all MX hosts, not a proper subset.

-- 
	Viktor.