December 2020 - dns-wg - mailman.ripe.net

Update RIPE's DNS Zonemaster
by Arsen STASIC 05 Jan '21

05 Jan '21

Hi, RIPE's DNS Zonemaster version might be outdated, because it does not support DNSSEC algorithm ED25519. This is the error message: Signature for DNSKEY with tag 52537 failed to verify with error 'Unknown cryptographic algorithm'. https://dnscheck.ripe.net/test/328db6c75665721b But the Zonemaster software (Versions: engine 4.0.3, backend 6.0.2, GUI 3.2.1) has already support for DNSSEC algorithm ED2551: https://www.zonemaster.net/result/c1607f01d96a8d60 It would be good if RIPE's Zonemaster could also list its version numbers. cheers, -Arsen

2 3

2021 DNS WG Schedule and call for contributions
by Dave Knight 15 Dec '20

15 Dec '20

Colleagues, We intend to resume remote sessions in 2021, though we'll step back from every third week to every fourth, as follows: Wed Jan 27 DNS WG Remote Session Wed Feb 24 DNS WG Remote Session Wed Mar 24 DNS WG Remote Session Wed Apr 21 DNS WG Remote Session Wed May 19 DNS WG at RIPE 82 Wed Jun 16 DNS WG Remote Session At this point we have no actual content in the backlog for those meetings, so please submit your presentation ideas, or discussion topics to <dns-wg-chairs(a)ripe.net>. Thanks and kind regards, dave, for the dns wg chairs

1 0

OARC 34 Workshop, February 4th & 5th, Registration and Call for Contributions now open
by Brett Carr 11 Dec '20

11 Dec '20

OARC 34 will be an online meeting on February 4th & 5th starting at 16:00 UTC. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. Based on the feedback from the previous workshop, the DNS-OARC audience is interested to see more content related to DNS operations. Therefore we are particularly interested in submissions from DNS Operators about attack mitigation and any major (public or non-public) DNS outages that your organization might have faced over the last year or so, the steps taken to resolve/mitigate the immediate issue, and to prevent future such events and any lessons learned. As it is an online workshop, we'd like to encourage brevity; presentations should not be longer than 20 minutes (with additional time for questions). **Workshop Milestones:** * 9 Dec 2020 - Submissions open via Indico * 4 Jan 2021 - Deadline for submission (23:59 UTC) * 14 Jan 2021 - Initial Contribution list published * 21 Jan 2021 - Full agenda published * 28 Jan 2021 - Deadline for slideset submission and Rehearsal * 4 Feb 2021 - OARC 34 Workshop The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc34> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Additional information for speakers of OARC 34: * your talk will be broadcast live and recorded for future reference * your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * you will be expected to attend a rehearsal on January 28th. It would be very useful to have your slides (even if draft) ready for this. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> Brett Carr, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Brett Carr Manager DNS and Network Engineering Nominet UK

1 0

Next Online DNS WG meeting - 9 December
by Shane Kerr 07 Dec '20

07 Dec '20

Dear DNS working group, We are finishing up our virtual RIPE DNS working group sessions on Wednesday, when Ed Lewis will be digging into RPKI usage in parts of the DNS world: - Ed Lewis, Measuring ROA deployment at the top of the DNS This will be our last RIPE DNS working group session of 2020, so we hope to see you all there! (If you are unable to attend, we will publish the recorded session and minutes on the RIPE website, as usual.) The connection details are: Topic: DNS Working Group - Meeting Time: Dec 9, 2020 03:00 PM Amsterdam Join Zoom Meeting https://ripe.zoom.us/j/97323124270?pwd=Z3doc0R5QWVqWFV2bm1WOFNtYzBGQT09 Meeting ID: 973 2312 4270 Passcode: 628274 One tap mobile +31207946519,,97323124270# Netherlands +31207946520,,97323124270# Netherlands Dial by your location +31 20 794 6519 Netherlands +31 20 794 6520 Netherlands +31 20 794 7345 Netherlands +31 707 006 526 Netherlands +31 20 241 0288 Netherlands +31 20 794 0854 Netherlands +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma) +1 301 715 8592 US (Washington D.C) Meeting ID: 973 2312 4270 Find your local number: https://ripe.zoom.us/u/adNiPJBj5Z Join by SIP 97323124270(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (Amsterdam Netherlands) 213.244.140.110 (Germany) 103.122.166.55 (Australia) 149.137.40.110 (Singapore) 64.211.144.160 (Brazil) 69.174.57.160 (Canada) 207.226.132.110 (Japan) Meeting ID: 973 2312 4270 Passcode: 628274 Cheers, -- Shane On behalf of the DNS working group chairs

1 0

DNSSEC validation problem with ripe.net
by Anand Buddhdev 04 Dec '20

04 Dec '20

Dear colleagues, On 3 December, at around 15:40 (UTC+1), Matt Nordhoff and Peter van Dijk alerted us to a problem with the DNS resolution of certain names in ripe.net. Upon investigation, we discovered that a recent update in the zone had changed the status of some address records to glue records. This change was not handled correctly by our DNSSEC signer, and it left spurious NSEC records in the zone, which then caused validation failures. Eventually, around 20:00 (UTC+1), we forced the DNSSEC signer to fully re-sign the zone, and this fixed the problem. We have reported this issue to the developers of the DNSSEC signing software, and they are investigating. We are also adding some extra monitoring to our infrastructure, to detect such problems more quickly. Regards, Anand Buddhdev RIPE NCC

1 0