6 ms·

A few recent DANE deployments: * infomaniak.ch - Swiss hosting provider * triodos.com - Bank in Spain * startupstack.tech - California hosting company

A few recent DANE deployments: * infomaniak.ch - Swiss hosting provider * triodos.com - Bank in Spain * startupstack.tech - California hosting company * elbiahosting.sk - Slovak hosting company * isu.net.sa - Saudi research centre * statens-it.dk - Multiple Denmark government domains * startmail․com - Email provider in Germany * webreus.nl - hosting provider in the Netherlands * mailfence.com - Email provider in Belgium * velocir.co.uk - UK hosting and email provider In the last 90 days 108k new domains via 828 new providers, plus more domains via existing providers, now 1.88 million domains total. Microsoft has a titanic-sized infrastructure to turn around, so it won't happen overnight, but they and more will deploy as time marches on, and in the mean-time it is MTA-STS that's moribund...

tptacek 7y ago
Well. As goes elbiahosting.sk, so goes the Internet.
- ietf-dane 7y ago
  Yes, precisely, they and many, many others. The Internet I want to nurture is the decentralized Internet that links millions of independent actors, rather than the walled-garden Internet of 3 cloud platforms. I am of course pleased to see also the big players supporting open technologies. Here's a longer list of providers MX-hosting over 1k domains for customers with DNSSEC and DANE: 1033606 one.com 136407 transip.nl 100893 domeneshop.no 88794 loopia.se 72402 infomaniak.ch 38424 active24.com 30972 vevida.com 30549 antagonist.nl 27595 webreus.nl 26928 web4u.cz 26122 zxcs.nl 25001 udmedia.de 17389 bhosted.nl 15135 flexfilter.nl 13863 onebit.cz 9925 protonmail.ch 5798 netzone.ch 5597 previder.nl 5461 soverin.net 5058 zonemx.eu 4803 mailplatform.eu 3406 ips.nl 3072 interconnect.nl 2568 provalue.nl 2084 nederhost.nl 1932 spamcluster.nl 1836 mailbox.org 1673 nmugroup.com 1445 yourdomainprovider.net 1348 mijnspamfilter.nl 1326 hi7.de 1297 tutanota.de 1255 spamfilterserver.com 1219 surfmailfilter.nl 1151 prolocation.net 1009 xcellerate.nl It is more difficult to measure the scale of deployments by individual domains with large numbers of users, as the numbers are not apparent in DNS, but these include comcast.net, web.de, gmx.de, ... The inertia to overcome is enormous, and the deployment time scale will be comparable to IPv6, which is just starting to gain ground after 3 decades. No need to tighten your seatbelt, it's a long ride, but adoption is growing and even accelerating. It would be nice and not too surprising, to get from the current ~2.5% (11 million signed domains out of ~400 million overall) to >5% in the next few years.
  - tptacek 7y ago
    See, you go into this thinking maybe "elbiahosting.sk" is a fluke, but no, "flexfilter.nl" and "tkservers.com" (whose home page redirects straight to a Roundcube login) are right there with them. Mailplatform.eu is DNSSEC-signed? Can Google Mail be far behind? Essentially, you're going to be able to demonstrate that DNSSEC is widespread in Europe. I concede that readily. I absolutely believe DNSSEC has a long future as an idiosyncratic thing only European companies do.
    - ietf-dane 7y ago
      Well, there's also a significant rate of adoption in Brazil. US domains await support from Godaddy et. al., with Godaddy recently announcing that DNSSEC will be available as a standard offering, not just a premium option. Adoption barriers still exist, but are falling. I am not expecting miracles overnight, but I'm patiently playing the long game, and not too worried about the past or the status quo.
      - tptacek 7y ago
        When it's like, a couple months, or even a year or so, sure, the past might not have much to tell you. But it's been twenty -five years. Even if you start at DNSSECbis, it's been almost 20 years since the typecode roll. At some point, ignoring the past stops being such a prudent strategy.
        ietf-dane 7y ago
        The timescales that matter are: 2010 - Root zone signed 2012 - Base DANE specification 2013 - First DANE SMTP draft, Snowden 2015 - SMTP DANE TLS RFC 2015 - DANE live at udmedia.de, mailbox.org, posteo.de, xs4all.nl, comcast.net, debian.org, freebsd.org, ... 2016 - DANE live at web.de, gmx.de, transip.nl, domeneshop.no, ... 2018 - one.com, ... Along the way, support for DANE in SMTP for Postfix, Exim, Halon, PowerMTA, MailChannels, ... Also OpenSSL and GnuTLS and now 1.88 million domains with DANE MX hosts. It has taken me seven years to get real momentum behind DANE for SMTP, and will likely take another seven to see how it plays out... You may not have the patience, but I am prepared to play the tortoise racing the sleeping hare.

tptacek 7y ago

Well. As goes elbiahosting.sk, so goes the Internet.

ietf-dane 7y ago
Yes, precisely, they and many, many others. The Internet I want to nurture is the decentralized Internet that links millions of independent actors, rather than the walled-garden Internet of 3 cloud platforms. I am of course pleased to see also the big players supporting open technologies. Here's a longer list of providers MX-hosting over 1k domains for customers with DNSSEC and DANE: 1033606 one.com 136407 transip.nl 100893 domeneshop.no 88794 loopia.se 72402 infomaniak.ch 38424 active24.com 30972 vevida.com 30549 antagonist.nl 27595 webreus.nl 26928 web4u.cz 26122 zxcs.nl 25001 udmedia.de 17389 bhosted.nl 15135 flexfilter.nl 13863 onebit.cz 9925 protonmail.ch 5798 netzone.ch 5597 previder.nl 5461 soverin.net 5058 zonemx.eu 4803 mailplatform.eu 3406 ips.nl 3072 interconnect.nl 2568 provalue.nl 2084 nederhost.nl 1932 spamcluster.nl 1836 mailbox.org 1673 nmugroup.com 1445 yourdomainprovider.net 1348 mijnspamfilter.nl 1326 hi7.de 1297 tutanota.de 1255 spamfilterserver.com 1219 surfmailfilter.nl 1151 prolocation.net 1009 xcellerate.nl It is more difficult to measure the scale of deployments by individual domains with large numbers of users, as the numbers are not apparent in DNS, but these include comcast.net, web.de, gmx.de, ... The inertia to overcome is enormous, and the deployment time scale will be comparable to IPv6, which is just starting to gain ground after 3 decades. No need to tighten your seatbelt, it's a long ride, but adoption is growing and even accelerating. It would be nice and not too surprising, to get from the current ~2.5% (11 million signed domains out of ~400 million overall) to >5% in the next few years.
- tptacek 7y ago
  See, you go into this thinking maybe "elbiahosting.sk" is a fluke, but no, "flexfilter.nl" and "tkservers.com" (whose home page redirects straight to a Roundcube login) are right there with them. Mailplatform.eu is DNSSEC-signed? Can Google Mail be far behind? Essentially, you're going to be able to demonstrate that DNSSEC is widespread in Europe. I concede that readily. I absolutely believe DNSSEC has a long future as an idiosyncratic thing only European companies do.
  - ietf-dane 7y ago
    Well, there's also a significant rate of adoption in Brazil. US domains await support from Godaddy et. al., with Godaddy recently announcing that DNSSEC will be available as a standard offering, not just a premium option. Adoption barriers still exist, but are falling. I am not expecting miracles overnight, but I'm patiently playing the long game, and not too worried about the past or the status quo.
    - tptacek 7y ago
      When it's like, a couple months, or even a year or so, sure, the past might not have much to tell you. But it's been twenty -five years. Even if you start at DNSSECbis, it's been almost 20 years since the typecode roll. At some point, ignoring the past stops being such a prudent strategy.
      - ietf-dane 7y ago
        The timescales that matter are: 2010 - Root zone signed 2012 - Base DANE specification 2013 - First DANE SMTP draft, Snowden 2015 - SMTP DANE TLS RFC 2015 - DANE live at udmedia.de, mailbox.org, posteo.de, xs4all.nl, comcast.net, debian.org, freebsd.org, ... 2016 - DANE live at web.de, gmx.de, transip.nl, domeneshop.no, ... 2018 - one.com, ... Along the way, support for DANE in SMTP for Postfix, Exim, Halon, PowerMTA, MailChannels, ... Also OpenSSL and GnuTLS and now 1.88 million domains with DANE MX hosts. It has taken me seven years to get real momentum behind DANE for SMTP, and will likely take another seven to see how it plays out... You may not have the patience, but I am prepared to play the tortoise racing the sleeping hare.