May 2022 - dns-wg - mailman.ripe.net

APNIC DNS4EU Research Presentation and Proposed Ripe Task Force
by Andrew Campling 29 May '22

29 May '22

During his presentation at the Ripe DNS working group meeting last week, João Damas of APNIC finished by asking whether there is room for the establishment of a common set of operational practices for operators of DNS resolvers, potentially an activity that a RIPE task force could undertake. You may find the European Resolver Policy that we published last year a useful reference as it is intended to address that very issue - see www.EuropeanResolverPolicy.com<http://www.EuropeanResolverPolicy.com>. If a RIPE task force is established and it identifies any areas where the policy could be enhanced, I'm confident that the existing adopters of the policy would be happy to consider an update of the current text. Andrew

1 0

RIPE DNS working group agenda for RIPE 84
by Shane Kerr 17 May '22

17 May '22

Dear colleagues, Here's the agenda for the DNS working group at RIPE 84. * Welcome & Agenda Bashing * Catalog Zones Petr Špaček from ISC * DNS over QUIC Sara Dickinson from Sinodun * DNS4EU Research Geoff Huston & João Damas from APNIC * KINDNS David Huberman from ICANN * RIPE NCC Update Florian Obser from RIPE NCC * AOB and Closing It should be a great session, hopefully we'll see you all there! Cheers, -- Shane (On behalf of the RIPE DNS working group co-chairs)

1 1

Experiences in Deploying and Scaling Support for Encrypted DNS
by Andrew Campling 17 May '22

17 May '22

You may be aware that I host a weekly call focused primarily on topics related to encrypted DNS. The call at 15:00 UTC may be of interest to some on this mailing list as it features an expert panel sharing their experiences in deploying and scaling support for encrypted DNS for their resolvers. The panel comprises Anestis Karasaridis of AT&T, Ólafur Guðmundsson of Cloudflare, Corey Mosher of Quad9 and Gianpaolo Scalone of Vodafone. Corey will kick things off by running through slides covering a range of operational challenges and other issues that Quad9 has identified, with the rest of the panel highlighting which are common issues and sharing any other challenges that they have faced. It should make for a fascinating discussion. If this topic is of interest to you and you'd like to join the call please email me directly for an invitation. The session will be recorded for later viewing in case you are attending Ripe 84 and so unable to join the discussion this afternoon. Andrew

1 1

RIPE NCC DNS operations update
by Anand Buddhdev 11 May '22

11 May '22

Dear colleagues, On Tuesday 3 May, we performed a DNSSEC Key Signing Key (KSK) roll-over for all the zones that we maintain and sign. During this roll-over, we dropped the Zone Signing Keys (ZSKs), and began signing the zones with just their new KSKs. Technically, these keys are the same as any other KSKs, but since they sign the entire zone, and there's no ZSK, such KSKs are informally known as Combined Signing Keys (CSKs). We use Knot DNS for signing, and we enabled the "single-type-signing" option for our zones. We then triggered the key roll-over. Knot DNS waited and watched for DS record updates, and then gracefully introduced and withdrew keys by waiting for the appropriate amount of time as determined by Time To Live (TTL) values in the zones. On Monday 9 May, a new version of the RIPE Database was deployed. This version communicates with our new version of Zonemaster. When users submit domain objects to the RIPE Database, it submits a pre-delegation check to Zonemaster, and only allows the update if Zonemaster returns a result without any errors. This new version of Zonemaster has several bug fixes, improved tests, and most importantly, support for the newest DNSSEC algorithms, algorithm 15 (ED25519) and algorithm 16 (ED448). Regards, Anand Buddhdev RIPE NCC

2 3

OARC 38 Call for Contributions
by Hazel Smith 03 May '22

03 May '22

OARC 38 will be a two-day hybrid meeting held on July 30th and 31st, 2022 starting at 10 am (Eastern)*. *The onsite part of the meeting will be co-located with IETF 114 (Philadelphia). The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT As it is an *hybrid *workshop, we'd like to encourage brevity; presentations should not be longer than 20 minutes (with additional time for questions). **Workshop Milestones:** 2022-05-01 Submissions open via Indico 2022-06-20 Deadline for submission (23:59 UTC) 2022-06-21 Initial Contribution list published 2022-06-28 Full agenda published 2022-07-12 Deadline for slideset submission and Rehearsal 2022-07-30 OARC 38 Workshop - Day 1 2022-07-31 OARC 38 Workshop - Day 2 The Registration page and details for presentation submission are published at: https://www.dns-oarc.net/oarc38 To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Additional information for speakers of OARC 38: * your talk will be broadcast live and recorded for future reference * your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * *Remote speakers* *have mandatory** rehearsal on** 2022-07-12 at 15:00 UTC.* It would be very useful to have your slides (even if draft) ready for this. *Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens.* If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> *Hazel Smith, for the DNS-OARC Programme Committee* OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Hazel Smith Site Reliability Engineer // Google Cloud, London hazelesque(a)google.com sre.google

1 0