SIDN, the registry for .nl domains, blogs about IPv4 and IPv6, DNS, email security standards, and internet infrastructure.
HN commenters link it for DANE and email security standards, and note SIDN as an early adopter of a registry practice.
I have also been self-hosting email for 15 years and only had couple of problems at the beginning, mainly until my IP got enough reputation. I have been hosting it on a bare metal Supermicro server in a proper datacenter, though. It has reverse-DNS, SPF, DKIM, TLS, MTA-STS and even DANE with DNSSEC (on a self-hosted BIND but that's another story). It is implemented using Exim, Dovecot, SpamAssasin, DNSBL and Roundcube with OpenLDAP auth. I can recommend this awesome hand-on guide provided by Netherlands Domain Registration Foundation as a basis of a nice configuration https://www.sidn.nl/en/news-and-blogs/hands-on-implementing-dane-in-exim
I had some troubles with IMAP search. I set up CLucene, it was easy and enough for me (no need for Java Lucene). It just took me a long time to figure out why it wouldn't search a domain part of email addresses. It just required to set up the tokenizations in such a way to split words also on @ character, i.e. don't consider a full email address as a word. :P I also had some troubles with OpenLDAP until I finally decided to read the docs and examples there properly. Since then I have been using this setup happily and it appears I will continue to do so! I also share the LDAP with NextCloud btw.
I've heard this claim too: apparently Facebook tested a lot of routers, and they consistently routed v6 ~500us faster than v4. v6 has no checksum, so routers don't need to recalculate it when they decrement the TTL header, and it does make sense that removing a step would help. Unfortunately my source for this is "I heard it from someone that works at Facebook".
In practice this is only a small part of final performance, so you need to do end-to-end measurements to get a proper idea of what people will experience. Both Facebook[1] and Apple[2] have done that, showing 10% faster page loads and 40% faster connection establishment respectively on v6. Even if that was solely down to routing policies, it's still a measurable difference.
[1] https://engineering.fb.com/2015/09/14/networking-traffic/ipv6-it-s-time-to-get-on-board/
[2] https://www.sidn.nl/en/news-and-blogs/apple-connections-established-40-per-cent-faster-with-ipv6-than-with-ipv4
It should be automateable, yes. Different RIRs (regional internet registries), which all operate their own WHOIS databases, might handle this differently but generally you should be able to get an abuse contact in an automated fashion for exactly this reason
> most of the scanner firms seem to be creating their own maps of as much of the internet as they can get their grubby hands on, and then sell API access to their database
Yeah, sure, a lot of scanners are run by black or gray hats. Just saying that all options are on the table and blocking (or even reporting) e.g. the non-profit .nl operator organization for scanning tcp:443 on all the A/AAAA records of .nl domains is going to do much good
(Example of what they're doing: https://www.sidn.nl/en/news-and-blogs/new-system-for-logo-based-detection-of-malicious-domain-names-successfully-piloted)
This was first done by SIDN I believe, the company that orchestrates the .nl domains. They however, do not implement most of the spec.
When searching their online whois[1], they'll tell you if a domain is for sale and link to the for sale page. They don't use any of the info you put in the DNS though. The URL comes from their internal system. You need to register it separately. They also don't use the price, txt or anything else you put in the DNS.
All they use is the "fcod", to look up the url in their own system. They had a different syntax for this before, but this functionality has existed for some years.
[1] https://www.sidn.nl/whois
Having cryptographically signed DNS records that can’t be forged and can be validated is good thing, which is what DNSSEC provides.
Right now, DANE is the only way to mitigate downgrade attacks with SMTP and TLS connections. Apparently use of DANE for email is growing [1].
DANE hasn’t taken off with browser vendors because of their concern about additional DNS lookups when making TLS connections.
[1]: “Number of DANE-enabled mail domains growing exponentially”—https://www.sidn.nl/en/news-and-blogs/number-of-dane-enabled-mail-domains-growing-exponentially
I like how the .nl tld in the Netherlands is managed by the non-profit SIDN [0]. They are dedicated to an open internet, and they make sure that I can very easily move my domain between (hosting) providers for example (and indeed it was easy to transfer from transip to vimexx for me). They are truly independent. It's how it should be if you ask me. When I read about the .org issues and now .io, I'm happy with my .nl domain, for personal use.
[0]: https://www.sidn.nl/en/about-sidn/what-we-stand-for