Update on stats

[Viktor Dukhovni]

As of today I count 110505 domains with correct DANE TLSA records
for SMTP.  As expected the bulk of the DANE domains are hosted the
handful of DNS/hosting providers who've enabled DANE support in
bulk for the domains they host.  The top 10 MX host providers by
domain count are:

    43813 domeneshop.no
    35704 transip.nl
    15495 udmedia.de
     2022 bhosted.nl
     1332 nederhost.net
      896 ec-elements.com
      409 core-networks.de
      307 uvt.nl
      282 bit.nl
      275 omc-mail.com

The real numbers are surely larger, because I don't have access to
the full zone data for most ccTLDs, and in particular .de and .nl.

There are 2401 unique zones in which the underlying MX hosts are
found, this counts each of the above providers as just one zone,
so is a measure of the breadth of adoption in terms of servers
deployed.  Alternatively, a similar number is seen in the count
(2522) of distinct MX host server certificates that support the
same ~110000 domains.

Of the ~110000 domains, 565 have "partial" TLSA records, that cover
only a subset of the MX hosts.  While this protects traffic to some
of the MX hosts, such domains are still vulnerable to the usual
active attacks via the remaining MX hosts.

The number of domains with incorrect TLSA records or failure to
advertise STARTTLS (even though TLSA records are published) stands
today at 64 (~4 are recent additions that will likely be resolved
soon, the remaining ~60 are the for now stable population of broken
domains).  This month I'm posting the top 50 entries, these are
domains that have been on that list for the longest time.

    Hall of Shame:

    castleturing.net        goldenhairdafo.net      dexalo.de
    nonoserver.info         inu.nl                  dexalo.eu
    wm.net.nz               dnsmadefree.com         digitalwebpros.com
    apachedemo.de           z0z0.me                 jeremyness.com
    oostergo.net            pksvice.cz              maximilian-greger.com
    thothnet.org            ttygap.net              copi.org
    wipedivision.cz         bels.cz                 delphij.net
    rajmax.si               baobrien.org            poderdoalimento.com.br
    acsemb.org              baobrien.guru           rnrfunco.net
    dhautefeuille.eu        pieterpottie.com        sgt.com
    dinepont.fr             sylvieandpieter.com     rnrfunco.com
    hlfh.space              sylviesfollies.com      puz.de
    12xu.info               flatcap.org             zencrypt.de
    warunek.net             russon.org              freeservices.net
    giesen.me               amadigi.ovh             kuzenkov.net
    kamikazekippetjes.nl    duffau.net              obninsk.biz
    myzt.nl                 daallexx.eu

The number of domains with bad DNSSEC support is 434. The top 10
DNS providers (by broken domain count) are:

    62 axc.nl		 - Slated to be resolved
    37 infracom.nl	 - Slated to be resolved
    18 loopia.se
    18 active24.cz
    16 domaincontrol.com - notified
    14 jsr-it.nl
    12 rdw.nl
    12 cas-com.net
    11 dootall.com	 - notified
    10 ignum.com

Around 100 of the broken domains have at least one working nameserver,
and so are email-reachable, given enough retries.

The number of domains that at some point were listed in Gmail's
transparency report is 99 (this is my ad-hoc criterion for a domain
being a large-enough actively used email domain).  Of these 44 are
in recent reports (February 2017):

    Hall of Fame:

    gmx.at                  mail.de                 asp4all.nl
    nic.br                  posteo.de               ouderportaal.nl
    registro.br             ruhr-uni-bochum.de      overheid.nl
    gmx.ch                  tum.de                  xs4all.nl
    open.ch                 uni-erlangen.de         domeneshop.no
    gmx.com                 unitymedia.de           webcruitermail.no
    mail.com                web.de                  debian.org
    trashmail.com           enron.email             freebsd.org
    xfinity.com             octopuce.fr             gentoo.org
    bayern.de               comcast.net             ietf.org
    bund.de                 dd24.net                isc.org
    fau.de                  gmx.net                 netbsd.org
    gmx.de                  hr-manager.net          samba.org
    jpberlin.de             t-2.net                 torproject.org
    lrz.de                  xs4all.net

A recent addition that is not listed above is "exim.org".  It seems
that "exim.org" mailing lists don't process enough email to land
on Google transparency reports.  Similarly, "openssl.org" used to
be on this list, and still has working TLSA records, but it seems
no longer generates enough email traffic to be on Google's reports.

I don't have any way to measure how many domains enable DANE outbound
but aren't using DNSSEC for their own domain or are not publishing
TLSA records.  It is easy to do, just fire up a local validating
resolver, adjust /etc/resolv.conf to list only 127.0.0.1 and/or
::1, and add a couple of lines to main.cf.  So the stats I am
reporting reflects only DANE adoption for inbound email.

-- 
	Viktor.