On Thu, Oct 01, 2026 at 11:44:06PM +0900, Byunghee HWANG (황병희) via
Postfix-users wrote:
> > The correct sets of DANE-TA(2) TLSA records to use with Let's Encrypt
> > are either or both of:
> >
> > - ECDSA (YE1-YE3):
> > 2 1 1 6ebcefb4210b088654a38b03fea3d7d1c711b4fb1ddc363a45f9b1a4e53da01e
> > 2 1 1 b3fb5d00e994cddf2cc9a4eea9f806bc5727e83cc0e4299bf956f2d524fe5376
> > 2 1 1 a698a20824be04e47a1a33c4fa488731be92011f23a31e900e2ca26c9c2acfce
> >
> > - RSA (YR1-YR3):
> > 2 1 1 2e8307068b6db620e4a39d068b5dee5d6ef5788cbb2c0b6d23ead84fcc17178c
> > 2 1 1 9d637b3d27a9e570d07607b9ccadb80a70915c7af72afce12841b1b1da825fd1
> > 2 1 1 51aaa87d984b559ac69e929f888a022d832e089ff4dba0a412b5101bca4bc799
> >
> > (... snip ...)
>
> Today i did updating, thanks Viktor!
You're welcome, thanks for taking care of it. Just 2632 more MX hosts
to go. :-(
https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html#mxhosts
The MX host (TLSA RRset) count distribution by Let's Encrypt CA is:
- Retired, should not be included in TLSA RRsets:
#mxs | CA
-----+---------
47 | X3
1 | X4
195 | R3
60 | R4
58 | E1
46 | E2
298 | E5
307 | E6
301 | R10
333 | R11
602 | E7
593 | E8
386 | E9
476 | R12
486 | R13
367 | R14
715 | ISRG X1 (outdated RSA root)
1117 | ISRG X2 (outdated EC root)
- Active, fine to include in TLSA RRsets:
#mxs | CA
-----+---------
1029 | YE1
1053 | YE2
350 | YE3
476 | YR1
509 | YR2
278 | YR3
219 | IYR (RSA root)
836 | IYE (EC root)
Sadly, neglect is standard operating procedure for too many.
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
