November 2015 - dns-wg - mailman.ripe.net

Algorithm Upgrade for RIPE NCC DNS Zones
by Anand Buddhdev 21 Dec '15

21 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear colleagues, All the zones maintained by the RIPE NCC are signed with the RSA/SHA1 algorithm. At the RIPE 70 meeting we committed to upgrade the algorithm of all our zones. We required an updated version of our signer software that could sign a zone with two different algorithms at the same time. We then needed to test it, to ensure that we could switch algorithms without causing major validation errors. We published a RIPE Labs article about our experiences here: https://labs.ripe.net/Members/anandb/dnssec-algorithm-roll-over We are happy to announce that we are now ready to roll the keys of all our zones and sign them with the RSA/SHA256 algorithm. We will follow the process described in the RIPE Labs article. We plan to begin the roll-over on Monday, 30 November 2015. We would still like to exercise caution, so we will not roll the keys of all zones at the same time. We will do this in batches, starting with a small number of reverse DNS zones of the RIPE Meeting address space. If you have any questions, please send an email to <dns(a)ripe.net>. Regards, Anand Buddhdev RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWVuZ8AAoJEBXgoyUMySoFoHYP+weE0kP6hkbeRJLDO610v612 ZyE81BkNQs6LE/lufAyMLkA36b3J9mVvDcmc2ciuRWdFLef3Z4XD2X+BG0mAAJgM cy4nD7Hx+6m9h3nGGT62CJTneXXNMyqzozcQIDdEyau8qUVM91/SgDFgBJWmnMML JC34hXWb5au5S+Bus/Vaq4iMtROQAq3F6xXR4xiEQoU+XwbOLkWU6WjqwCaJfYZ5 UBaQtpdcqNOjKXyVlDoF6LJnxgxW3kXMi98FEQ8Ye0oYri/h98gdt6BWYfhf5kTY aU7RTAJ2V0ksOVmipSQIT5KkrmV3mwOiuAWjVJYaVJWxmYoHdyMlhtHpUJT4LV1P KvN/XXSZdjBawCNib8zjFFXb79cFRBZ8PMm55W5pcwYNipAK71mlmhEIop8PX3ee oYwU1MzxNoREP3zYWWgolJhhzJsGpZP1ceRJwI4pKQpz4xFju0tJHBQAHICI8Z1R yinf2H0rYPKKyaBNt9aYB/LsTGdh+ccIl4o4/Ep4sc102cemT11mf4QYCeYUIjZW wULcgf4L7d8m3NCa33i5zX44TlQ7xTjdW4m60auSdaRjlUsLTewYkAkrhC5G+aZP oA4RYJVwi0dSbw62S03+MN2senWgSfZe85jqgMX24u/W7XNp59va9wA8nPVJVPl/ XbAQ69qXXKbldMdI4CI2 =/Pwl -----END PGP SIGNATURE-----

2 3

K-root DNS Service Incident
by Romeo Zwart 30 Nov '15

30 Nov '15

Dear colleagues, Between about 07:00 and 09:15 UTC today multiple root operators including K-root were receiving an unusually large amount of query packets. This was impacting the overall performance of K-root DNS services, as can be seen for example in DNSMON (with apologies for the unpleasant URL below): https://atlas.ripe.net/dnsmon/group/k-root?dnsmon.session.color_range_pls=0… After initial investigation, the RIPE NCC took counter-measures during the incident. The results of these measures are partially visible in DNSMON. The full effect of the mitigations implemented roughly coincided with the end of the event. We will investigate the events and the effectiveness of our response further and report about this in the near future. Kind regards, Romeo Zwart

2 3

Call for Presentations - DNS-OARC Spring Workshop, Apr 2016
by Stuart, Sean 25 Nov '15

25 Nov '15

Apologies if you are on multiple lists and see multiple copies of this email. ------------- Call for Presentations The next DNS-OARC Spring Workshop will take place in Buenos Aires, Argentina between March 31st and April 1st 2016, Thursday and Friday before IETF95. This will be the first time DNS-OARC is held in the Southern Hemisphere. To attract the best DNS minds and local audience, DNS-OARC is requesting proposals for presentations, with a preference for Operational Practices Reports, and "How we solved this problem" presentations. This workshop intends to build from previous strong DNS-OARC workshops, where both operational content and research are welcome. Presentations from DNS operators are particularly desired, as well as from DNS researchers. All DNS-related subjects are accepted. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. A timeslot will be available for lightning talks (5-10 minutes) on April 1st, for which submissions will be accepted during March 31st on a first-come first-served basis. Workshop Milestones 26th November 2015, Call for Presentations posted and open for submissions 29th January 2016, Deadline for submission 16th February 2016, Final Program published 28th March 2016, Final deadline for slideset submission Details for abstract submission will be published here: https://indico.dns-oarc.net/event/22/call-for-abstracts/ The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To ensure the quality of the workshop, submissions including draft slides will get extra points during evaluation. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee OARC is also seeking sponsorship for this workshop, please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) Thanks, Sean ‹ Sean Stuart Engineer, Resolution Operations sstuart(a)verisign.com 12061 Bluemont Way, Reston, VA, 20190 Verisign.com <http://www.verisign.com/>

1 0

updates to RIPE-429 about DNSMON services
by Romeo Zwart 17 Nov '15

17 Nov '15

Dear colleagues, We have updated RIPE Document ripe-429, which describes RIPE NCC's DNSMON service. You’ll find the document in PDF format attached to this email. We invite you to share your feedback regarding this document before it is frozen as the updated RIPE document. Thank you for your support. Kind regards, Romeo Zwart

1 0

New on RIPE Labs: Impact of K-root Expansion as Seen by RIPE Atlas
by Mirjam Kuehne 16 Nov '15

16 Nov '15

Dear colleagues, Following-up from the high-level update on the K-root expansion published on RIPE Labs last week, we now look at RIPE Atlas to see what impact this expansion had on performance on both global and regional scales: https://labs.ripe.net/Members/wilhelm/impact-of-new-k-root-anycast-nodes-as… Kind regards, Mirjam Kuehne RIPE NCC

1 0

RIPE NCC secondary name services for ccTLDs
by Romeo Zwart 16 Nov '15

16 Nov '15

Dear colleagues, The RIPE NCC offers a best-effort secondary name service for ccTLDs in the start-up phase of their organisational life. At RIPE 68 you, the working group, provided us with some guidelines regarding the eligibility of new zones to be added to this service. We intend to document these guidelines in the form of a new RIPE Document*, of which a draft version is attached to this email. We welcome any comments you may have on this document. Kind regards, Romeo Zwart * Actually, an earlier version of this document has already been published as a RIPE Document, but this was a procedural error on our part, which will be corrected.

3 2

Advance notice - H-root address change on December 1, 2015
by Kash, Howard M CIV USARMY RDECOM ARL (US) 16 Nov '15

16 Nov '15

This is advance notice that there is a scheduled change to the IP addresses for one of the authorities listed for the DNS root zone and the .ARPA TLD. The change is to H.ROOT-SERVERS.NET, which is administered by the U.S. Army Research Laboratory. The new IPv4 address for this authority is 198.97.190.53. The new IPv6 address for the authority is 2001:500:1::53. This change is anticipated to be implemented in the root zone on 1 December 2015, however the new addresses are operational now. They will replace the previous IP addresses of 128.63.2.53 and 2001:500:1::803f:235 (also previously known as AOS.BRL.MIL and AOS.ARL.ARMY.MIL). We encourage operators of DNS infrastructure to update any references to the old IP addresses and replace them with the new addresses. In particular, many DNS resolvers have a DNS root "hints" file. This should be updated with the new IP addresses. New hints files will be available at the following URLs once the change has been formally executed on December 1: http://www.internic.net/domain/named.root http://www.internic.net/domain/named.cache The old IPv4 address will continue to work for six months after the transition (until 1 June 2016), at which point it will be retired from service. The address will remain under the control of the Army Research Laboratory, never to be used again for DNS service. The old IPv6 address will continue to work indefinitely, but may ultimately be retired from service. Simultaneous to the retirement of the old address on June 1, 2016, the ASN for H-root will change from 13 to 1508. You can monitor the transition of queries to the new addresses at the following URL: http://h.root-servers.org/old_vs_new.html -- Howard Kash U.S. Army Research Laboratory

1 1

Update on K-root expansion
by Romeo Zwart 13 Nov '15

13 Nov '15

Dear colleagues, As you know, we have been expanding coverage of K-root over the course of this year. Since the last announcement in April, we have added 17 new K-root locations, supported by 16 new sponsoring organisations. An update covering the progress of the expansion project so far is now published on RIPE Labs: https://labs.ripe.net/Members/romeo_zwart/update-on-k-root-expansion Kind regards, Romeo Zwart

2 1

Reminder about the WG Chair appointment process
by Jim Reid 13 Nov '15

13 Nov '15

Colleagues, there's still time left to nominate candidates and to express support for those who have been nominated. The response so far from the WG has been disappointing and that's making it awkward to decide if consensus has been reached. Please speak up! Even if it's just to say "meh". :-)

6 6

revised agenda for RIPE71
by Jim Reid 11 Nov '15

11 Nov '15

The agenda for next week's meeting has been updated. Here's the latest version. Please note that things are not finalised and there might be further tweaks to the agenda or running order. # # $Id: agenda,v 1.7 2015/11/11 14:08:51 jim Exp $ # FIRST SESSION A. Usual Administrivia 5 mins Agenda bashing Minutes of previous meeting Review of Action Items B. NCC Report 15 mins Anand Buddhdev C. Measuring the impact of IPv6 resolver preference 20 mins Chris Baker, Dyn D. Impact of DNS over TCP - a resolver point of view 15 mins Joao Damas, Bondis The impact two very different aspects of the life of a recursive server were examined for this project: queries to authoritative servers as well as the queries from stub resolvers. Traffic from two different ISP's recursive resolvers was captured to analyse the potential impact on the servers of long lived TCP sessions, investigating the effect of timeout settings, the total number of simultaneous connections that would be kept open and the potential benefits of connection reuse as proposed in the current version of draft-ietf-dnsop-5966bis, with the intent of offering simulated operational advice, based on observed traffic. E. Integration testing of DNS Recursive servers 15 mins Ondřej Surý, CZ.NIC A generic testing framework was produced as a part of developing the Knot Resolver. This framework is written in python and can use UNIX domain sockets to bypass the underlying physical network. F .nl Open DNS datasets and Statistics 10 mins Marco Davids, SIDN SIDN makes available aggregated datasets from .NL authoritative servers to the Internet/Research/DNS communities. It includes visualizations of the DNS-traffic for .nl, as well as statistics on domain registrations, DNS queries, DNSSEC usage, plus layer-3 and layer-4 information. The datasets (starting from May 2014) are updated on a daily basis. They are provided in JSON-format and can be found on https://stats.sidnlabs.nl. G. Discussion of latest SSAC recommendations 10 mins SSAC Stuckee SECOND SESSION H. Discovery method for a validating stub resolver 20 mins Xavier Gorjón, NLnetLabs This research project aims to develop a discovery method to ensure DNSSEC information can be delivered to the end host. It used RIPE ATLAS to study the current state of DNSSEC aware and DNSSEC validating resolvers, and define a course of action from that information. The project explored a novel method to discover the capabilities of the ISP's recursive resolver and bypass incompetent Customer-premises equipment (CPE) middle-boxes to target the often more capable ISP's resolver directly. I. DNSSEC for Legacy Applications 15 mins Willem Toorop, NLnetLabs Validating stub resolvers are hampered by middle boxes (typically CPE) that corrupt the path from the stub to the recursive resolver. Using the getdns library and the Linux/Unix name resolution framework, libnss_getdns provides (stub-level) DNSSEC validation for legacy applications. This module can work around broken middle boxes by double checking bogus answers. It also offers in-path signalling of DNSSEC failure for http, informing the end-user why validation failed and giving them control of deciding how to deal with that. J. Implementation challenges of geographic split-horizon DNS 20 mins Jan Včelák, CZ.NIC There are multiple ways to find a network service according to a client's geographic location. One possibility is to perform a split-horizon at the DNS level. The presentation will briefly inform about existing approaches, problems introduced by this mechanism, possible solutions of these problems, and experience we gained when implementing this feature into Knot DNS. K. Root Zone KSK rollover 30 mins Roy Arends, IANA L. WG Co-chair appointment 5 mins M. AOB

1 0