The Programme Committee is seeking contributions from the community.
This workshop will be a hybrid event.
Date - 6-7 February 2025
Location - Atlanta Marriott Marquis - Atlanta, Georgia, USA
Time zone - EST (UTC -5)
Co-located with - NANOG 93
Deadline for Submissions - 2024-12-02 23:59 UTC
All DNS-related subjects and discussion topics are welcome although
we're particularly keen to hear about operational and security related
experiences, best practices and practical advice; both for newcomers to
the DNS arena and those who have been around for longer who want to
learn more about new features and opportunities to improve resilience,
security and privacy.
If you have something interesting to share with the community that lies
outside of the focus above, please don't be put off - if it's good,
we'll be happy to include it.
If you'd like to offer a talk, but are not quite sure what to pick,
here's a non-exhaustive list of ideas:
* *Operations*: Experiences, interoperability concerns, tooling tips,
lessons learned from or details/reasons for a recent outage (how to
improve time to recovery, tooling for detection/mitigation),
operational 'gotchas'...
* *Deployment*: DNS config management and release process.
* *Monitoring*: Log ingestion pipeline, analytics infrastructure,
anomaly detection.
* *Scaling*: DNS performance management and metrics. Increasing DNS
server efficiency.
* *Security*: DoS experience, attacks on the DNS, DNSSEC signing and
validation.
* *Privacy*: Encrypted transports, qname minimization, data anonymization.
* *Resilience*: Provisioning planning, load-balancing services,
features (e.g. serve-stale)
For further details please see https://www.dns-oarc.net/oarc44
Willem Toorop, for the DNS-OARC Programme Committee
Dear Colleagues,
We are reaching out to inform you of important changes to the DNSSEC trust anchor in the root zone. If you manage a validating DNS resolver or a tool that interacts with the DNS root zone you might need to change your software to handle the changes. This letter provides a summary of the upcoming changes and gives pointers to resources that describe them in detail.
*Upcoming addition of the KSK-2024 trust anchor*
On January 11, 2025, a new trust anchor, codenamed KSK-2024, will appear in the root zone for the global DNS. This key was generated earlier this year and will co-exist with the current trust anchor, codenamed KSK-2017. The new DNSKEY record is:
. 172800 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/c idltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHb GiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+s iFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqp dVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ 1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUe
ayffKC73PYc=
As a result of this addition, some DNS responses may be larger during the transition period. If your software uses the RFC 5011 process for managing trust anchors, KSK-2024 will be automatically trusted about one month after its introduction to the root zone. There are two important planned dates:
* October 11, 2026: KSK-2024 will begin signing the root zone.
* January 11, 2027: KSK-2017 is scheduled to be revoked.
For a detailed description of the rollover process, please refer to https://www.iana.org/dnssec/files
*New trust anchor file*
IANA has issued a new trust anchor file using the updated XML format described in https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7958bis/ , which has recently been approved to be published as an RFC. The new trust anchor file contains additional data that was not provided in previous versions of the file.
If your software or processes use the IANA trust anchor file (published at https://data.iana.org/root-anchors/root-anchors.xml ), you should ensure you have processes to retrieve it regularly (such as weekly) and check your systems can process the revised format of the file.
*Keep in touch*
Operational announcements regarding trust anchors and rollovers are published on the root-dnssec-announce mailing list at https://lists.icann.org/postorius/lists/root-dnssec-announce.icann.org/ . A separate ksk-rollover mailing list is a forum for discussion specific to rollovers can be found at https://lists.icann.org/postorius/lists/ksk-rollover.icann.org/ .
Best regards,
--
Andres Pavez
Cryptographic Key Manager
