IETF Logo Mail Archive

Re: [ietf-smtp] MTA-STS scale (was: why are we reinventing mta-sts?)

Viktor Dukhovni <ietf-dane@dukhovni.org> Tue, 08 October 2019 23:03 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: ietf-smtp@ietfa.amsl.com
Delivered-To: ietf-smtp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E68C1200D6 for <ietf-smtp@ietfa.amsl.com>; Tue, 8 Oct 2019 16:03:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.199
X-Spam-Level:
X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NnM2sIL92Owr for <ietf-smtp@ietfa.amsl.com>; Tue, 8 Oct 2019 16:03:19 -0700 (PDT)
Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2C181200BA for <ietf-smtp@ietf.org>; Tue, 8 Oct 2019 16:03:19 -0700 (PDT)
Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id 33BE02B3807 for <ietf-smtp@ietf.org>; Tue, 8 Oct 2019 19:03:19 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <alpine.OSX.2.21.99999.368.1910062009420.35480@ary.qy>
Date: Tue, 08 Oct 2019 19:03:18 -0400
Content-Transfer-Encoding: 7bit
Reply-To: ietf-smtp@ietf.org
Message-Id: <162239C1-F06E-4624-A70B-43D6614DF2F4@dukhovni.org>
References: <alpine.OSX.2.21.99999.368.1910062009420.35480@ary.qy>
To: ietf-smtp@ietf.org
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-smtp/WJNCnbjYEElKrRgBzERKN15659A>
Subject: Re: [ietf-smtp] MTA-STS scale (was: why are we reinventing mta-sts?)
X-BeenThere: ietf-smtp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Discussion of issues related to Simple Mail Transfer Protocol \(SMTP\) \[RFC 821, RFC 2821, RFC 5321\]" <ietf-smtp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-smtp>, <mailto:ietf-smtp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf-smtp/>
List-Post: <mailto:ietf-smtp@ietf.org>
List-Help: <mailto:ietf-smtp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-smtp>, <mailto:ietf-smtp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Oct 2019 23:03:22 -0000

> On Oct 6, 2019, at 8:10 PM, John R Levine <johnl@taugh.com> wrote:
> 
> What's wrong with MTS-STS defined in RFC 8461?
> 
> It's defined, it works, it's deployed at a lot of large mail systems.

Small correction.  MTA-STS is defined and works a *small* number of
*very* large mail systems.  There are best I can measure only a few
hundred domains covered by MTA-STS, but they include gmail.com, and
outlook.com (enforce) and yahoo.com (still testing).

By contrast DANE is defined and works for a very large number (~1.3
million) domains that are small to medium mail systems.  These
include comcast.net, web.de, gmx.de, protonmail.ch, and some large
domain hosting providers.

Only some in-house certificate management automation appears to stand
between Google and DANE for SMTP, they already have DNSSEC-signed MX
hosts:

	mx[1-4].smtp.goog.

that are live and listed jointly in the Google MX certificates with
the existing better known names.  Once these have TLSA records, any
of the O(600k) signed domains that presently use Google's various
MX hosts could change their MX RRs to mx[1-4].smtp.goog, and have
DANE for their Google hosted domains.

I would not be surprised to see DANE for Google become available in
the next 12 months, but can only speculate, it could happen sooner,
or not at all...

-- 
	Viktor.

v2.23.0 | Report a Bug | By Email