dns-resolver-tf

Download

dns-resolver-tf@ripe.net

August 2023

2 participants
2 discussions

Draft Minutes - DNS Resolver Best Common Practice Task Force - 8 August 2023
by Boris Duval 24 Aug '23

24 Aug '23

Dear TF members, Here are the minutes from our seventh call. Cheers, Boris *** Tuesday, 8 August 2023 17:00 (UTC+2) Attendees: Marteen Aertsen, Shane Kerr, Andronikos Kyriakou, Tim Wicinski Scribe: Boris Duval 1. Recommended Knobs Settings The Task Force discussed recommendations for specific DNS settings: https://github.com/DNS-Resolver-BCP-TF/Resolver-Recommendations/issues/10 Here’s a summary: DNSSEC Validation: · Recommended enabling DNSSEC validation. · Negative caching (NSEC, NSEC3) reduces traffic, safeguards against random subdomain attacks (RFC 8198). · Root KSK update essential; RFC 5011 or resolver operator for updates via OS. · Valuable material in RFC9364 for DNSSEC operations. TTL Limits (max & min): · Software default TTL of 1-2 days; potential reduction for cache size. · Lower TTL removes infrequently-used records, minimal operational impact, memory savings. · Some implementations allow minimum TTL, though a DNS protocol violation. · Software can set differing max/min TTL, impacting queries. TTL Record Pre-fetch: · Certain resolvers prefetch records before cache expiration to extend TTL. · Feature not standardized; related proposal: https://datatracker.ietf.org/doc/html/draft-wkumari-dnsop-hammer-03 · Recommended enabling if available. Cache Saving: · Exploring downsides; input sought from implementors, DNS OARC list. Local Root (and maybe local TLD?): · Beneficial to use local root (RFC8806). · Not applicable to most TLDs due to frequent changes. Shane offered to develop these notes and come up with a first draft.

1 0

Task Force Status Update
by Shane Kerr 22 Aug '23

22 Aug '23

Hello to everyone interested in DNS Resolvers, We've been having regular weekly meetings to discuss our draft document, and some people have contributed excellent text for this, and the discussions have been good. We have more writing to do, but we are largely done with two main sections: systems/network/capacity and DNS knobs. At our next call we're going to review the work that Farzaneh has been doing, which should put us a lot further along with the privacy/filtering/transparency section. The remaining section is a list of other documents to reference. We intend to provide guidance, rather than just a list of things to read. Maarten will start that work by looking at the FIRST DNS stuff, but we should go through all of it. I think that we are in good shape to have a draft a month or so before the upcoming RIPE 87 meeting in Rome at the end of November 2023. That should give anyone in the RIPE community enough time to have a read and get back to us with whatever feedback they have before a final draft can be published. Since our Mattermost instance went away, we have been using the RIPE Forum for non-public communications - everyone on the task force should check it periodically. It's not quite as nice for real-time or near-real-time communication, but it is what we have. Cheers, -- Shane Chair, DNS Resolver Best Common Practice Task Force

1 0