June 2021 - dns-wg - mailman.ripe.net

DNSSEC algorithm roll-over of all RIPE NCC zones
by Anand Buddhdev 30 Jun '21

30 Jun '21

Dear colleagues, During the RIPE 82 Meeting, we announced that we would soon roll the keys of all our DNSSEC-signed zones to a new algorithm, ECDSAP256SHA256, as recommended by RFC 8624. We are happy to announce that we are now ready to do this. On Tuesday, 15 June 2021, we will start the roll-over of both the Key Signing Keys (KSKs) and Zone Signing Keys (ZSKs) of our zones. The process will take several days to complete. We have performed algorithm roll-over previously, when we switched from RSASHA1 to RSASHA256. We wrote a RIPE Labs article about it, wherein we observed the need to perform this roll-over conservatively, in order to accommodate strict validators:  https://labs.ripe.net/author/anandb/dnssec-algorithm-roll-over/ Therefore, our Knot DNS signer will use the conservative approach described in section 4.1.4 of RFC 6781. This approach ensures that even strict validators can continue to validate our DNSSEC-signed responses during the roll-over. If you have any questions or concerns, please send an email to dns(a)ripe.net. Regards, Anand Buddhdev RIPE NCC

2 1

Sony Wins Pirate Site Blocking Order Against DNS-Resolver Quad9
by Stephane Bortzmeyer 21 Jun '21

21 Jun '21

I think it is the first time there is a court ruling specifically against a public DNS resolver? https://torrentfreak.com/sony-wins-pirate-site-blocking-order-against-dns-r… Note the reasoning (if some german-speaking person can confirm this is a fair summary?): > One of the arguments that Sony brought up in court was that Quad9 > already blocks various problematic sites voluntarily. This is indeed common in court: either you are neutral or you are not and, in the second case, you can no longer claim you are "just an intermediary". When you start filtering DNS answers, it is hard to resist pressures to add more filtering.

2 1

New on RIPE Labs: Fragmentation, Truncation, and Timeouts - Are Large DNS Messages Falling to Bits?
by Alun Davies 16 Jun '21

16 Jun '21

Dear colleagues, Large DNS responses over UDP can lead to fragmentation, truncation, and timeouts. But how much of a problem is this actually causing in the wild? Are large DNS messages falling to bits? In this new article now available on RIPE Labs, Giovane Moura and colleagues from SIDN Labs investigate: https://labs.ripe.net/author/giovane_moura/fragmentation-truncation-and-tim… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0