- dns-wg - mailman.ripe.net

APNIC DNS4EU Research Presentation and Proposed Ripe Task Force
by Andrew Campling 29 May '22

29 May '22

During his presentation at the Ripe DNS working group meeting last week, João Damas of APNIC finished by asking whether there is room for the establishment of a common set of operational practices for operators of DNS resolvers, potentially an activity that a RIPE task force could undertake. You may find the European Resolver Policy that we published last year a useful reference as it is intended to address that very issue - see www.EuropeanResolverPolicy.com<http://www.EuropeanResolverPolicy.com>. If a RIPE task force is established and it identifies any areas where the policy could be enhanced, I'm confident that the existing adopters of the policy would be happy to consider an update of the current text. Andrew

1 0

RIPE DNS working group agenda for RIPE 84
by Shane Kerr 17 May '22

17 May '22

Dear colleagues, Here's the agenda for the DNS working group at RIPE 84. * Welcome & Agenda Bashing * Catalog Zones Petr Špaček from ISC * DNS over QUIC Sara Dickinson from Sinodun * DNS4EU Research Geoff Huston & João Damas from APNIC * KINDNS David Huberman from ICANN * RIPE NCC Update Florian Obser from RIPE NCC * AOB and Closing It should be a great session, hopefully we'll see you all there! Cheers, -- Shane (On behalf of the RIPE DNS working group co-chairs)

1 1

Experiences in Deploying and Scaling Support for Encrypted DNS
by Andrew Campling 16 May '22

16 May '22

You may be aware that I host a weekly call focused primarily on topics related to encrypted DNS. The call at 15:00 UTC may be of interest to some on this mailing list as it features an expert panel sharing their experiences in deploying and scaling support for encrypted DNS for their resolvers. The panel comprises Anestis Karasaridis of AT&T, Ólafur Guðmundsson of Cloudflare, Corey Mosher of Quad9 and Gianpaolo Scalone of Vodafone. Corey will kick things off by running through slides covering a range of operational challenges and other issues that Quad9 has identified, with the rest of the panel highlighting which are common issues and sharing any other challenges that they have faced. It should make for a fascinating discussion. If this topic is of interest to you and you'd like to join the call please email me directly for an invitation. The session will be recorded for later viewing in case you are attending Ripe 84 and so unable to join the discussion this afternoon. Andrew

1 1

RIPE NCC DNS operations update
by Anand Buddhdev 11 May '22

11 May '22

Dear colleagues, On Tuesday 3 May, we performed a DNSSEC Key Signing Key (KSK) roll-over for all the zones that we maintain and sign. During this roll-over, we dropped the Zone Signing Keys (ZSKs), and began signing the zones with just their new KSKs. Technically, these keys are the same as any other KSKs, but since they sign the entire zone, and there's no ZSK, such KSKs are informally known as Combined Signing Keys (CSKs). We use Knot DNS for signing, and we enabled the "single-type-signing" option for our zones. We then triggered the key roll-over. Knot DNS waited and watched for DS record updates, and then gracefully introduced and withdrew keys by waiting for the appropriate amount of time as determined by Time To Live (TTL) values in the zones. On Monday 9 May, a new version of the RIPE Database was deployed. This version communicates with our new version of Zonemaster. When users submit domain objects to the RIPE Database, it submits a pre-delegation check to Zonemaster, and only allows the update if Zonemaster returns a result without any errors. This new version of Zonemaster has several bug fixes, improved tests, and most importantly, support for the newest DNSSEC algorithms, algorithm 15 (ED25519) and algorithm 16 (ED448). Regards, Anand Buddhdev RIPE NCC

2 3

OARC 38 Call for Contributions
by Hazel Smith 03 May '22

03 May '22

OARC 38 will be a two-day hybrid meeting held on July 30th and 31st, 2022 starting at 10 am (Eastern)*. *The onsite part of the meeting will be co-located with IETF 114 (Philadelphia). The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT As it is an *hybrid *workshop, we'd like to encourage brevity; presentations should not be longer than 20 minutes (with additional time for questions). **Workshop Milestones:** 2022-05-01 Submissions open via Indico 2022-06-20 Deadline for submission (23:59 UTC) 2022-06-21 Initial Contribution list published 2022-06-28 Full agenda published 2022-07-12 Deadline for slideset submission and Rehearsal 2022-07-30 OARC 38 Workshop - Day 1 2022-07-31 OARC 38 Workshop - Day 2 The Registration page and details for presentation submission are published at: https://www.dns-oarc.net/oarc38 To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Additional information for speakers of OARC 38: * your talk will be broadcast live and recorded for future reference * your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * *Remote speakers* *have mandatory** rehearsal on** 2022-07-12 at 15:00 UTC.* It would be very useful to have your slides (even if draft) ready for this. *Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens.* If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> *Hazel Smith, for the DNS-OARC Programme Committee* OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Hazel Smith Site Reliability Engineer // Google Cloud, London hazelesque(a)google.com sre.google

1 0

Changes to Time-to-Live (TTL) values in reverse DNS zones
by Anand Buddhdev 22 Apr '22

22 Apr '22

Dear colleagues, In 2021, we announced a plan to change the time-to-live (TTL) values in the reverse DNS zones that we maintain. You may view the announcement here: https://www.ripe.net/ripe/mail/archives/dns-wg/2021-November/003928.html Many members of the community expressed support for our proposal. Therefore, we are going to make these changes next week on Wednesday 20 April. We will lower the TTL of NS records to 86400 (1 day) and that of DS records to 3600 (1 hour). Note that the TTL of records imported from other Regional Internet Registries (RIRs) will not be affected. Those records will be imported with the TTLs as published by the origin RIR. Regards, Anand Buddhdev RIPE NCC

5 9

New on RIPE Labs: Detecting DNS Root Manipulation
by Alun Davies 19 Apr '22

19 Apr '22

Dear colleagues, In 2021, when reports emerged that hosts in Mexico were unable to reach whatsapp.net, it was determined that middleboxes were to blame. These devices were intercepting the queries to the root instance hosted in China and sending a bogus reply. Taking this as their starting point, Qasim Lone and colleagues have been investigating the prevalence of middleboxes using RIPE Atlas: https://labs.ripe.net/author/qasim-lone/detecting-dns-root-manipulation/ Best regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

DNS4EU
by Andrew Campling 19 Apr '22

19 Apr '22

Tomorrow is the revised deadline for responses to the European Commission's DNS4EU Call for Proposals. I don't have the impression that there will be a large number of responses from the industry, does anyone have a different perspective? Andrew

1 0

.arpa ns changes
by James Mitchell 14 Apr '22

14 Apr '22

Dear network operators and other interested parties: This is advance notice that beginning 25 April, the hostnames for the nameservers for the .ARPA zone are planned to change. The new names will correspond to the same IP addresses that already provide the service. This change is planned occur in two phases. On Monday, April 25, the A, C, and E nameservers will change to their new hostnames. The remaining nameservers will change one week later on Monday, May 2. We do not expect any issues to arise from these changes. The work is being done as described in RFC 9120, in coordination with our root zone management partner Verisign and the IAB. Kind regards, James Mitchell Internet Assigned Numbers Authority

1 0

DNS and K-root Quarterly Planning Q2 2022
by Paul de Weerd 31 Mar '22

31 Mar '22

Dear colleagues, We've prepared our quarterly plans for our DNS services, including K-root. Please find them at https://www.ripe.net/support/documentation/quarterly-planning/dns-and-k-root We hope that by providing these plans, we can better inform the community of the ongoing work on the DNS services we operate and get feedback on our work. If you have any input on these plans or suggestions for future work, please reach out to us. Kind regards, Paul de Weerd RIPE NCC

1 0