Resolved TLSA DANE in Plesk

[mmhospedagem]

Hello forum guys, how are you? Nothing well here! This week I received a security alert from nic.br more precisely from Teste para padrões técnicos modernos de Internet, como IPv6, DNSSEC, HTTPS, TLS, HSTS, DMARC, DKIM, SPF, STARTTLS e DANE. where in analysis we found that our plesk servers are insecure because they do not have DANE. Does anyone know any alternative or solution for this functionality?

Note that we need in DANE without it we can't get the seal of reliability.

 

[IgorG]

https://support.plesk.com/hc/en-us/articles/360013424159-Does-Plesk-support-DANE-and-TLSA-

 

[mmhospedagem]

Hi @IgorG how are you?

Any forecast for DANE release in plesk? Note that there has been a vote since 2016 where there is more than 5 years of waiting, asking to vote and not developing the function is complicated.

 

[IgorG]

@mmhospedagem

For five years of existence of the request on UserVoice, it received only 226 votes, which is <4 votes per month. The request barely gets into the TOP-30.
According to the wiki, neither Chrome nor Firefox supports this out of the box.
From mail services - this is only postfix, and you still need to delve into in what cases. + you need DNSSEC for all this.
Also, TLSA records are not supported by external DNS services such as Amazon Route53, for instance.
The peak of discussion of this topic fell on 2011-2013, after the publication of the RFC, but now some new publications cannot be found.
I can't immediately find confirmation that named supports this, although I cannot find the opposite.
On the fly, I couldn't find an email client that is easy enough for the user to support it out of the box (even with the help of extensions). In addition, it requires DNSSEC, and in conjunction with mail, it dramatically increases the chances that the email will not be delivered.
The Office365 seems to have promised to support DANE to send an email at the end of 2020, to receive an email at the end of 2021, but I did not find the final announcement of this support.
Did one of the big hosters require this feature?
From the point of view of implementation and testing, this looks like a rather heavy feature.
From the end user's point of view, this is something that slows down the work with mail, and that also needs to be additionally configured on the mail client side.
Thus, the benefits are not very clear so far.
So, I can say that this implementation does not appear anywhere in our plans.

 

[Michiel Klaver]

@mmhospedagem

For five years of existence of the request on UserVoice, it received only 226 votes, which is <4 votes per month. The request barely gets into the TOP-30.
According to the wiki, neither Chrome nor Firefox supports this out of the box.
From mail services - this is only postfix, and you still need to delve into in what cases. + you need DNSSEC for all this.
Also, TLSA records are not supported by external DNS services such as Amazon Route53, for instance.
The peak of discussion of this topic fell on 2011-2013, after the publication of the RFC, but now some new publications cannot be found.
I can't immediately find confirmation that named supports this, although I cannot find the opposite.
On the fly, I couldn't find an email client that is easy enough for the user to support it out of the box (even with the help of extensions). In addition, it requires DNSSEC, and in conjunction with mail, it dramatically increases the chances that the email will not be delivered.
The Office365 seems to have promised to support DANE to send an email at the end of 2020, to receive an email at the end of 2021, but I did not find the final announcement of this support.
Did one of the big hosters require this feature?
From the point of view of implementation and testing, this looks like a rather heavy feature.
From the end user's point of view, this is something that slows down the work with mail, and that also needs to be additionally configured on the mail client side.
Thus, the benefits are not very clear so far.
So, I can say that this implementation does not appear anywhere in our plans.

Microsoft published an Office365 message center notification MC308285 on December 24, to say that a slow roll-out of DANE and DNSSEC for outbound email will start in mid-January 2022 and complete by late May.

 

[IgorG]

Microsoft published an Office365 message center notification MC308285 on December 24, to say that a slow roll-out of DANE and DNSSEC for outbound email will start in mid-January 2022 and complete by late May.

Microsoft promised DANE support in 2020 but now 2022...
https://techcommunity.microsoft.com/t5/exchange-team-blog/support-of-dane-and-dnssec-in-office-365-exchange-online/ba-p/1275494
Let's see.

At the same time, Google still does not support DANE as a browser.

Some stats: SecSpider

DANE Summary

389,198 DANE enabled zones with TLSA records

304 PKIX based Trust Anchor TLSA records (Cert Usage 0)

1,083 PKIX based End Entity TLSA records (Cert Usage 1)

6,788 DANE based Trust Anchor TLSA records (Cert Usage 2)

167,992 DANE based End Entity TLSA records (Cert Usage 3)

1,635 Zones have deployed TLSA for Secure IMAP (Port 993)

1,812 Zones have deployed TLSA for Secure SMTP (Port 465)

1,109 Zones have deployed TLSA for Secure POP3 (Port 995)

1,227 Zones have deployed TLSA for IMAP (Port 143)

2,248 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)

862 Zones have deployed TLSA for POP3 (Port 110)

79,674 Zones have deployed TLSA for SMTP (Port 25)

264 Zones have deployed TLSA for Alternate SMTP (Port 2525)

87,337 Zones have deployed TLSA for HTTPS (Port 443)

At the same time some data for DNSSEC

DNSSEC Summary

8,437,343 Zones

7,392,519 DNSSEC enabled zones

6,513,810 Zones use both KSKs and ZSKs

94 Zones are serving revoked keys

4,795,635 DNSSEC verified zones

6,199,399 Production DNSSEC-enabled zones

4,795,635 zones with DNSSEC vs. 79,674 Zones have deployed TLSA for SMTP (or 87,337 Zones have deployed TLSA for HTTPS).
We do not have lots of DNSSEC customers but DNSSEC is required for DANE.
Only 3.5% of zones with DNSSEC use DANE.

 

[Viktor Dukhovni]

• The Microsoft rollout is actually under way now, and some receiving systems are reporting increased TLSA query rates from MIcrosoft IPs. So the delay is finally behind us.
• The SecSpider tool is woefully out of date and not actively maintained with comprehensive upstream data feeds
• Much better data is available at DNSSEC-DANE-Deployment-Statistics
• There are now over 3.1 million domains with DANE TLSA records for their MX hosts (10x the number you quote above)
• There are now over 17.5 million DNSSEC-signed eTLD+1 zones.
• Roughly 18% of DNSSEC-signed zones have DANE for their MX hosts (not 3.5% as reported above)
• Significant new adoption is planned by at least one major registrar, and we should see additional growth in DNSSEC adoption soon, beyond the ~3–4 million / yr observed recently.

If you don't have the cycles or inclination to implement DANE at present, fair enough, but there's no need to use low-quality numbers to make the point...

 

[Viktor Dukhovni]

• The Microsoft rollout is actually under way now, and some receiving systems are reporting increased TLSA query rates from MIcrosoft IPs. So the delay is finally behind us.
• The SecSpider tool is woefully out of date and not actively maintained with comprehensive upstream data feeds
• Much better data is available at DNSSEC-DANE-Deployment-Statistics
• There are now over 3.1 million domains with DANE TLSA records for their MX hosts (10x the number you quote above)
• There are now over 17.5 million DNSSEC-signed eTLD+1 zones.
• Roughly 18% of DNSSEC-signed zones have DANE for their MX hosts (not 3.5% as reported above)
• Significant new adoption is planned by at least one major registrar, and we should see additional growth in DNSSEC adoption soon, beyond the ~3–4 million / yr observed recently.

If you don't have the cycles or inclination to implement DANE at present, fair enough, but there's no need to use low-quality numbers to make the point...

For the most recent "state of DANE" post to the dane-users mailing list, see: <Update on stats 2021-12>. There'll be another update on Monday night showing an uptick in growth in January.

 

[Viktor Dukhovni]

• The Microsoft rollout is actually under way now, and some receiving systems are reporting increased TLSA query rates from MIcrosoft IPs. So the delay is finally behind us.
• The SecSpider tool is woefully out of date and not actively maintained with comprehensive upstream data feeds
• Much better data is available at DNSSEC-DANE-Deployment-Statistics
• There are now over 3.1 million domains with DANE TLSA records for their MX hosts (10x the number you quote above)
• There are now over 17.5 million DNSSEC-signed eTLD+1 zones.
• Roughly 18% of DNSSEC-signed zones have DANE for their MX hosts (not 3.5% as reported above)
• Significant new adoption is planned by at least one major registrar, and we should see additional growth in DNSSEC adoption soon, beyond the ~3–4 million / yr observed recently.

If you don't have the cycles or inclination to implement DANE at present, fair enough, but there's no need to use low-quality numbers to make the point...

Also in terms of MTA support, DANE is supported by many more than just Postfix: Exim, PowerMTA, Halon MTA, Cisco ESA, CloudMark, Exchange Online, ...

 

[AYamshanov]

Hi everyone,

We have been working on adding DANE support in Plesk. With the last Plesk Obsidian release (18.0.54), as the first step, it possible to add TLSA records manually or via CLI.
Let me know if you have any feedback regarding adding TLSA records feature in Plesk.

Victor, thank you for the link to the statistics! Now we are using this source of information as well.

 

[Achim Drees]

Hi everyone,

We have been working on adding DANE support in Plesk. With the last Plesk Obsidian release (18.0.54), as the first step, it possible to add TLSA records manually or via CLI.
Let me know if you have any feedback regarding adding TLSA records feature in Plesk.

Victor, thank you for the link to the statistics! Now we are using this source of information as well.

Hi,
thank you for adding DANE to Plesk.
Now I have 100% result on internet.nl.