5 ms·

The timescales that matter are: 2010 - Root zone signed 2012 - Base DANE specification 2013 - First DANE SMTP draft, Snowden 2015 - SMTP DANE TLS RFC

The timescales that matter are: 2010 - Root zone signed 2012 - Base DANE specification 2013 - First DANE SMTP draft, Snowden 2015 - SMTP DANE TLS RFC 2015 - DANE live at udmedia.de, mailbox.org, posteo.de, xs4all.nl, comcast.net, debian.org, freebsd.org, ... 2016 - DANE live at web.de, gmx.de, transip.nl, domeneshop.no, ... 2018 - one.com, ... Along the way, support for DANE in SMTP for Postfix, Exim, Halon, PowerMTA, MailChannels, ... Also OpenSSL and GnuTLS and now 1.88 million domains with DANE MX hosts. It has taken me seven years to get real momentum behind DANE for SMTP, and will likely take another seven to see how it plays out... You may not have the patience, but I am prepared to play the tortoise racing the sleeping hare.

tptacek 7y ago
Even by the artificial timeline you provide, it's been 10 years since DNSSEC was rolled out in its current form in the root zone. That list of domains you've provided is almost the best you can do (you forgot Cloudflare). Open source software support for DANE doesn't mean anything. Open source software supported the TLS Heartbeat Extension, too.
- ietf-dane 7y ago
  Cloudflare does not MX-host customer domains, so is not in scope, they DNS-host signed domains, but that's not what the above is about. Google also DNS-hosts many signed domains (under the cloud.goog, .dev and .app TLDs). I was listing DANE adoption since 2015, which is really when the clock starts, the signing of the root zone in 2010 was just a prerequisite, but not enough by itself. The DNSSEC use-case in question is DANE for SMTP, which was not possible earlier. The Heartbeat example is absurd. DANE support is in MTAs that actually use it, and not just some landmine in an open-source library. Some of the larger providers use commercial SMTP stacks that support DANE, others use open-source, but any analogy with Heartbeat other than it was also open-source is much too weak to warrant consideration.
  - tptacek 7y ago
    The point is simply that implementation in open source projects doesn't imply user (or even operator) adoption. It's not really a metric of anything. People want to build features like these; it's fun.
    - ietf-dane 7y ago
      That's done and dusted, what's happening now for example is that today 7620 new .com domains got signed, ~73% of them by googledomains.com. And roughly the same thing is happening every day: https://stats.dnssec-tools.org/tld-graphs/com.png https://stats.dnssec-tools.org/tld-graphs/com.png Sure, if the pace stays the same it works out to about 2 million per year, which is cool, but there are over 140 million .com domains, so more than just Google would need to engage in large-scale signing. I am not denying that until recently things have been slow to moribund, but things have started to change, and where we part ways is that you've written off all possibility of change based on past stasis, but I'm ignoring it and having some real, if early, success at driving change. My take is that you're under no obligation to contribute or even admit that change is starting to happen, but I think it would be polite to back off on the negativity, just wait and see, you may be proved right without expending any energy being vocal about it. But if adoption picks up unexpectedly, allow yourself to be surprised...
      - tptacek 7y ago
        I'm overtly and deliberately negative about DNSSEC and DANE. I think they're bad protocols, and bad for the Internet. It would be impolite for me to pretend otherwise.
        ietf-dane 7y ago
        I've noticed, but this is well known, and it has perhaps been a while since you've said anything substantively new about them. Your views are well known, and easily found via any search engine. There's likely no compelling need to track down and attempt to refute each positive mention. This thread excepted, I've generally not engaged in the converse. I am looking for a truce, where we each get to post whatever new thing we have to report, without having to expend precious energy to deal with redundant rebuttals. If you like, I can append "[naturally tptacek disgrees]" whenever I report anything DANE related to this forum, and save you the trouble... :-)

tptacek 7y ago

Even by the artificial timeline you provide, it's been 10 years since DNSSEC was rolled out in its current form in the root zone. That list of domains you've provided is almost the best you can do (you forgot Cloudflare). Open source software support for DANE doesn't mean anything. Open source software supported the TLS Heartbeat Extension, too.

ietf-dane 7y ago
Cloudflare does not MX-host customer domains, so is not in scope, they DNS-host signed domains, but that's not what the above is about. Google also DNS-hosts many signed domains (under the cloud.goog, .dev and .app TLDs). I was listing DANE adoption since 2015, which is really when the clock starts, the signing of the root zone in 2010 was just a prerequisite, but not enough by itself. The DNSSEC use-case in question is DANE for SMTP, which was not possible earlier. The Heartbeat example is absurd. DANE support is in MTAs that actually use it, and not just some landmine in an open-source library. Some of the larger providers use commercial SMTP stacks that support DANE, others use open-source, but any analogy with Heartbeat other than it was also open-source is much too weak to warrant consideration.
- tptacek 7y ago
  The point is simply that implementation in open source projects doesn't imply user (or even operator) adoption. It's not really a metric of anything. People want to build features like these; it's fun.
  - ietf-dane 7y ago
    That's done and dusted, what's happening now for example is that today 7620 new .com domains got signed, ~73% of them by googledomains.com. And roughly the same thing is happening every day: https://stats.dnssec-tools.org/tld-graphs/com.png https://stats.dnssec-tools.org/tld-graphs/com.png Sure, if the pace stays the same it works out to about 2 million per year, which is cool, but there are over 140 million .com domains, so more than just Google would need to engage in large-scale signing. I am not denying that until recently things have been slow to moribund, but things have started to change, and where we part ways is that you've written off all possibility of change based on past stasis, but I'm ignoring it and having some real, if early, success at driving change. My take is that you're under no obligation to contribute or even admit that change is starting to happen, but I think it would be polite to back off on the negativity, just wait and see, you may be proved right without expending any energy being vocal about it. But if adoption picks up unexpectedly, allow yourself to be surprised...
    - tptacek 7y ago
      I'm overtly and deliberately negative about DNSSEC and DANE. I think they're bad protocols, and bad for the Internet. It would be impolite for me to pretend otherwise.
      - ietf-dane 7y ago
        I've noticed, but this is well known, and it has perhaps been a while since you've said anything substantively new about them. Your views are well known, and easily found via any search engine. There's likely no compelling need to track down and attempt to refute each positive mention. This thread excepted, I've generally not engaged in the converse. I am looking for a truce, where we each get to post whatever new thing we have to report, without having to expend precious energy to deal with redundant rebuttals. If you like, I can append "[naturally tptacek disgrees]" whenever I report anything DANE related to this forum, and save you the trouble... :-)