Re: [dane] [OT] Deployment news (Germany is plowing ahead)

[Viktor Dukhovni <[e-mail]>]

On Wed, Aug 19, 2015 at 11:13:21AM +0200, [e-mail] wrote:

> FYI : According to the news today the next big deployment in germany is
> on the way (german only, sorry)
> 
> http://www.heise.de/newsticker/meldung/Kehrtwende-bei-Mail-Sicherheit-Web-de-und-GMX-fuehren-DANE-ein-2782473.html
> 
> The two brands GMX and web.de affected do around half of the german freemail
> traffic.

Great news, thanks!  Google's "translate" with minor fixes yields
in part:

    At the time United Internet thought DANE "not yet fully mature"
    by comparison the "E-mail Made in Germany" initiative with
    Telekom and Strato, founded in August 2013.  Therefore, the
    Emig partners decided to develop their own procedures, explains
    United Internet now. Since then DANE has attained "sufficient
    maturity".  The launch is scheduled for completion by year end.

    In response to Heise Networks a company spokesperson explained
    that the DANE technology will be extended to other domains of
    the group, including the mail service 1und1.de which uses the
    same backend as Web.de and GMX.

    The hosting customers of United Internet are however on Exchange
    Technology, so DANE is not to be expected in the foreseeable
    future.  The company starts with various additional domains
    with GMX and will then gradually upgrade the major domains as
    gmx.de, web.de, gmx.net. So it was easier to deal with any load
    or quality problems before they come in to customer constraints.

I should note that one can publish TLSA records even for Exchange
servers, SMTP servers don't need new software to support DANE
inbound.

Also, just because the mailboxes are on Exchange, does not mean
the edge servers sending mail to the rest of the world need to be
Exchange.  And of course deployment on this scale should help to
convince Microsoft to add the required outbound (SMTP client) DANE
support.

Existing DANE implementors (mostly hobbyists) will soon more quickly
notice if they don't do key rollover correctly when they get no
inbound mail from these (and I hope soon other similar or larger)
providers.

-- 
	Viktor.