Hi.
This is working.
Yes.
I'm Benjamin.
I work for the government and I'll talk about online tooling to check your email configuration.
Partly, Internet.nl, but also some other tools.
For the government, I'm advice on standards and I use Internet.nl to scan the Dutch government internally
and report on that openly.
Let's take a look at Internet.nl.
For example, I do a website testing part, but there's also an email testing part and will mainly focus on the email testing part.
So, Internet.nl is from, it's done by the Dutch Internet standards platform that's the organization behind it.
And that's a private public partnership between government and Internet community.
Internet community like RIP or local.nl local TLD, but also an Internet society which we use the nice Internet.nl name.
We rent it or we can use it from.
And some governmental organizations including the local Dutch National Security Center.
So, the main goal is to promote modern Internet standards and I will mainly focus on these few standards.
Well, yeah.
Common standards hopefully, although not always.
So, IPv6 for email, we will check are your name servers?
Do you have at least two name servers with an IPv6 address? Are they reachable?
And the same goes for the email server.
So, does it actually have an IPv6 address?
We don't check if you actually, or you are allowed not having an IPv4 address, of course, but you should at least have an IPv6 address, right?
The main, this is, I think, 30 years old now or something.
It's pretty old.
Lots of tooling cannot handle IPv6.
So, my favorite tool like IPv4 info, you cannot use it, but you can use like IPv4.nl.
But you might also want to check all your monitoring tools if they actually support IPv6.
But that's this kind of problem.
Please don't use IPv4 maps as IPv6 addresses.
Sometimes you see governmental people doing this just to comply with our tooling.
But nowadays we ban this.
So, uptime, sometimes you get like these messages like, yeah, it's Google down or it's Internet.nl wrong.
Well, Google's down, of course, on IPv6 because they don't apparently monitor it somehow.
Check your monitoring tools, apparently Google didn't.
So, please also note if you're self hosting at home or something and you check your IPv6 address,
that you are not exposing your MAC address.
So, if you have, like, F-E in your IPv6 address, you might expose your MAC address.
Could also be a random data range.
We check that also on the connection test on Internet.nl.
So, you can do that also.
Some common issues we now may see with containers is like you can actually do support IPv6 incoming,
but not outgoing because if you don't enable IPv6 in Docker,
yeah, IPv6 just doesn't work from the container.
It works if you have an outgoing incoming connection, but not if you have an outgoing connection.
And we also quite often see that this is pretty tricky.
Your results or your external results actually does have an IPv6 address.
It can resolve, quote, A, but then it does not have, again, IPv6 on its own.
So, it cannot connect to IPv6 only name servers.
We serve, of course, interesting.
You don't see this often, but we have some, we also check this on Internet.nl.
So, you can do the connection test or you can try to resolve like the MX of DNS labs.nl, which is IPv6 only.
Yeah, please be inclusive like 4 billion or a bit less IPv4 addresses are, yeah.
Quite some, but not enough for the whole world.
So, please do IPv6.
Some countries also facing out IPv4 like the Czech Republic.
And mostly IPv6 is now a thing.
Also, here at the conference, I think the Wi-Fi is mostly IPv6.
DNSSEC, this is a trick.
In Europe, it's less controversial than in America.
We'll just check like, do you have DNSSEC, and is it valid?
And is it valid for your domain and also for your MX?
Yeah, not doing DNSSEC in 2025.
Do you know this problem, example, most cards?
Yeah.
So, the problem is they use Akamai, of course, very secure.
But then there's a bit of a typo here.
And that was a free domain apparently, so somebody registered it.
Yeah.
You might want to do like defense in depth and do DNSSEC, right?
And this is not even spoofing.
This is just buying a domain name, right?
That's very easy.
So, internet.nl has an, uses unbound, has an hard expire.
Unbound has like a soft expire, which says like, well, maybe your DNS can be like one hour or up to one day old.
We check it hard.
Google DNS also has a hard check.
So, we mostly see like your apex is valid, but your zip domain is not because you do some
naming to some weird, I don't know, Akamai Microsoft, something weird.
Or, yeah, you have an invalid or expired insect.
Internet.nl checks the whole chain because we use unbound.
So, yeah, if you see name, you might have a problem.
And we use Q name immunization.
So, sometimes, yeah, results into seeing problems on your DNS part.
If you think, well, DNS is not for me.
I advise from DSEC.nl.io, it's a European based free DNS provider.
Of course, the other tools, which are very nice and way better at DNSSEC,
or DNSSEC, and zonemaster, this is the positive thing on the green stuff, of course,
make something as wrong.
You, these will be kales and rats.
See names, yeah, more about gnems.
Watch out with gnems, because we see this a lot like www.cnm to your apex.
You won't have most of the people who have like an mx record from their apex.
Now, you also have an mx record for your www, maybe you don't want that.
And also, if you see name to external sites, of course, if you don't set up an mx,
now the external site is responsible for the A and the Qat A, but also anything else,
like a null mx, or if they don't do that, they can actually send and receive email, right,
on this thing.
So, maybe you don't want to do that, and just flatten this.
SPF should be simple, but yeah, isn't, of course, if you do it like plus, or question mark,
or like force them, yeah, what does it say?
So, SPF is should be simple, but it's somehow extremely hard.
These are like common configurations for allowing your mx, your mx, a and Qat A, by the way,
or just don't allow email with a hard feel.
Common problems, we see people only configure this on their apex and nothing else.
And when using an include, make sure you have maximum of 10 lookups,
and then I will come back to that later.
And if you're using an include, you should probably monitor that, because if the includes
are not managed by you, they can change, and they might go over that 10 limits.
And yeah, more than 9 out of 10 tools do the counting wrong.
Including internet, doesn't it, lots of moments?
Yeah, yeah, and our developer now said,
mainly developer now said, like, yeah, we're not going to fix this anymore.
We're going to include SPF trays, which is a nice rust tool.
They also initially did counting wrong, but they fixed it in PR issue for or something.
Because you have your main counting, but you also have the sub-counting.
So if you're, so all the includes are counted, but also have every mx should be resolved
and IP address, you end up with possibly 11 valid DNS address.
So not 10, 11, 11 worst case scenario.
So some links here, how do you install it?
Deakin, how can we check that without knowing your selector?
Well, we just check your domain key, and we expect an no error,
then there's something below it, an x domain.
Shouldn't be something below it.
But we see a lot of nx domains when there is some selector below it,
barely configured DNS server.
Yeah, there's a RFC for that, there should be nothing below it.
D mark, yeah, should be something like this.
Only on your top domain, you can override it, but it still means SPF or date decimus valid.
It doesn't mean ends.
The main problem we see here, yeah, P is none, doesn't have anything.
And somehow you don't need a trailing semicolon, except for the authentication stuff.
There it is, but it's wrong in the documentation.
It's in the erata, that there should be a semicolon there.
It's in the ABNF, but yeah, who reads that?
And who reads the erata, so.
But we checked for that, and we will say, like, something is wrong.
But yeah, first of them didn't have anything, but I, from a previous conference, this is an example.
So if you want to do no mail, it might be a bit weird this room for no mail.
But there's a null image you can set up.
And then you explicitly say, I do no email.
Which is just a priority zero with a dot.
You cannot set up this in every DNS software, but you shoot.
And then you could also, of course, do an SPF file.
Also with a semicolon, and also do a DMARC reject.
So you force, actually, there should be decim or SPF, and it will fail always, right?
Then we do Dane.
Oh, yeah, we check if it's exist, it's valid.
And if you do some rollover scheme, I will go over very brief, because I've sent two minutes.
Yeah, you can see it in the slides, so we'll upload them later.
So common issues, they need the NSEC.
And we see a lot of people, they want to pass like Dane and set it up once,
and then automatically renewal their certificate, but don't update their DNS.
Yeah, don't do that.
Have a rollover scheme to at least, maybe an intermediate certificate,
but also monitor that because they change.
You probably want to do TLS reporting.
I probably don't want to do MTA STS in combination, because it's tricky,
if one is wrong, and the other is,
we have another tool, which is an active tool.
It's a have Dane.
You can have Dane both net.
You can send an email to three addresses and it checks if you have configured Dane correctly,
or if your mill server actually sends email to servers that has like bogus date.
Also shout out to assist for a Christmas present, open sources tool.
It was close source before, now it's open source, which is really nice.
Some other check with is nice, but not open source, but also not really commercial.
And of course you can do like a manual Dane check with OpenSL, which is also nice.
And the main thing, I think, in TLS, only tool that actually does like online open source,
online tool that does start TLS debocking.
And the main issue is that mill servers do like rate limit us.
So that's a problem.
Because we need to do quite some TLS connections to set up and know,
because the only way, the only way to know what your server is supporting is sending over every possible
sliver, then see what it will connect, then removing that, then do it again, etc, etc.
So if your server supports lots of TLS, we need to do lots of connections.
Oh, something wrong there, but my time is also.
Yeah, so you can also do it with test, as so, which scripts.
We also check for a T.A. issue.
And yeah, issue mill might be interesting to you can block S-mime certificates with that.
And other stuff, these are nice tools, not open source.
We should have some fast tools, alternative for that.
Actually, mill tester, I would really like to have a full sort of internet for that.
And some URLs, we have testing tool, it's on internet. Now, we used to give this T-shirts away.
If you score 100% currently, we're out of stock, we are working on a new design,
and we will have a new T-shirt soon.
And we have some localized versions in Brazil, Denmark, France, Germany.
And we have a dashboard for a non-profit with a foregovernment and vital sector,
and you can dump like loads of domains in there and have them.
We're currently checking.
We're currently in the GitHub trying to move that to something else,
and you can run it yourself and PR show welcome.
Questions?
You recommended a new set SPF records on the wild card in the DNS.
Yeah, that might be-
Sorry, the repeat question.
You recommended to have SPF on the wild cards.
Does internet open L check for that?
No.
What's the question?
Why doesn't it check for that?
It's pretty tricky to check, but we have some open issues to maybe check for this,
and maybe also check for, is it a C now or something?
Yeah, there are some issues open for that.
Yeah, it's not on a big highest on the PR or T-list yet.
Do you have a plan to implement the MTA STS checks?
I think it's not on the schedule.
Oh, sorry.
A question is, do you have plans to implement the MTA STS checks,
currently not an issue?
But you can file, of course, an issue for this.
What's the highest on your priorities?
We have a public roadmap.
Currently, we're working on a new Dutch government TLS guidelines,
so that's a complete TLS rework on the internal parts,
which is also open on death for that internet.
That's the main thing, then comes to redesign,
so we can give out new t-shirts,
and then we have a huge list of DNS stuff we want to add.
So, yeah, mainly checking DNS, right?
That's a question.
Okay.
I just want to say, thank you so much for doing the RTI checks.
I think that's really awesome to do that.
Thank you.
So the question, the remark was, thank you for the RTI checks.
Yes.
The more, yeah, thanks for the National Fabric Security Center
of the Netherlands, they gave that code as a contribution.
Yes, very nice.
Do you have a list of the minimum list that needs to be done
in order for emails not to get into spam?
The question was, do you have a minimal list of things
that needs to be done for not ending up in spam?
Yeah, internet score 100% on internet.
Of course, but then maybe also do like reverse DNS correct,
and yeah, I would advise you for also the these tools.
Which are sadly not false.
Thank you very much.