- dns-wg - mailman.ripe.net

EDU zone operational announcement: DNSSEC algorithm rollover
by Wessels, Duane 05 Sep '23

05 Sep '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Verisign will soon begin the transition to DNSSEC algorithm 13 (ECDSA) for the EDU zone. Over the next few days, algorithm 13 signatures will start to appear in the zone, followed by the algorithm 13 DNSKEY records. We expect the DS record for the EDU zone to change from algorithm 8 to algorithm 13 between September 12-15. Additional information can be found at our blog post and DNS-OARC presentation URLs below: https://blog.verisign.com/security/dnssec-algorithm-update/ https://indico.dns-oarc.net/event/47/contributions/1012/ We expect no operational impacts for end users, but please feel free to reach out to us with concerns or any observations of anomalous behavior related to this algorithm rollover. DW -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBCAAGBQJk90tSAAoJEGyZpGmowJiNynsIAIWBx6Gc8CyOl0pcr65a3aUh FnrrteufEs1KvNk+HtexDs8opUGz8sKf4zG/ABj4NtTQFRwsvD/nxh8q+fnu4Vci niSPbJLZcadY+344FioGNE4/jE28jKmItx7fFmTBoaBcF5iy1aS5xSh4vOA6fcSy snJeYd6VsnrezK6IujgmiqAg7iLwl+YHvPnu8lJuXEpUPqBmO/EEHZPn7oEps8Xf A8duusfKIvP6zrIF0vnnqwS0TgUpTdam5MGtVAkv+JUlpzRmqAYNcQd872nYUVIp 5qZ1R+pjHsngwe+8pf/LQtpYwKjaiP06CUbZH8hlg3ioDWSLEAjs0NEgb45Wmhw= =Wi2m -----END PGP SIGNATURE-----

1 0

Call for nominations/volunteers to co-chair the RIPE DNS working group.
by Joao Luis Silva Damas 05 Sep '23

05 Sep '23

Dear Colleagues, This is a call for nominations or volunteers to co-chair the RIPE DNS working group. ************************************************************************************* Please DO NOT reply to this message if you wish to propose a volunteer. ************************************************************************************* Call for RIPE DNS Working Group Chair ------------------------------------------------------ In accordance with the chair selection process we announce that the term of one of our co-chairs (Joao Damas) will expire at the upcoming RIPE Meeting (RIPE 87, near Rome) and we would like to invite volunteers, or nominations for someone to become a co-chair of the DNS working group. Anyone may volunteer, and anyone may be nominated by someone else (we will check with the person for acceptance). Note that having served two terms, in accordance with the selection process Joao is not eligible. To do this, please send a mail to <dns-wg-chairs AT ripe.net <mailto:dns-wg-chairs@ripe.net>> before end of Sunday 5 November 2023 (UTC). Again, please DO NOT send your volunteer/nomination to the DNS WG mailing but rather the dns-wg-chairs mail alias. It would be helpful for candidates to give some words as to why they think they ought to be a co-chair, what new ideas, or improvements they might bring, and so on. We will publish the list of volunteers, along with anything the volunteers wish to include with their nomination, to this mailing list on Monday 6 November 2023. Discussion and support (or opposition) for each candidate can then be offered on the list. At the DNS working group session at RIPE 87, Moritz and Wilhelm hope to announce consensus based on the mailing list discussion. Timeline ———— Tuesday, 5 September 2023 This call for volunteers posted to the dns-wg mail list Sunday, 5 November 2023 Deadline for volunteers/nominations Monday, 6 November 2023 List of candidates and call for support posted to the mail list Monday, 27 November 2023 Deadline for showing support for candidates/volunteers on the mail list Tuesday, 28 November 2023 DNS WG session at RIPE 87 References ---------- The RIPE working group chair job description is included in ripe-692: https://www.ripe.net/publications/docs/ripe-692 The DNS working group chair selection process is documented here: https://www.ripe.net/participate/ripe/wg/dns/dns-wg-chair-selection-process We have 3 co-chairs so the term is 3 years. The current approach was announced on this mailing list on 2018-07-17: https://www.ripe.net/ripe/mail/archives/dns-wg/2018-July/003566.html As always, please feel free to reach out to any of the chairs directly, to us as a group at dns-wg-chairs AT ripe.net <mailto:dns-wg-chairs@ripe.net>, or discuss this or any other any relevant topic on this mailing list.

1 0

DNS and K-root Quarterly Planning Q3 2023
by Paul de Weerd 27 Jun '23

27 Jun '23

Dear colleagues, The DNS Services quarterly plans, including K-root, are published on our website: https://www.ripe.net/support/documentation/quarterly-planning/dns-and-k-root For this quarter, we'll continue with our day-to-day operations and update the operating system of some of our DNS servers. We also plan on deploying a new AuthDNS core site in Asia. We hope that by providing these plans, we can better inform the community of the ongoing developments on the DNS services we operate and get feedback on our work. If you have any input on these plans or suggestions for future work, please reach out to us. Kind regards, Paul de Weerd RIPE NCC

1 0

OARC 41 - Call for Contribution -- deadline extension
by Hazel 09 Jun '23

09 Jun '23

Deadline for OARC 41 abstract submission is extended to June 20th, 23:59 UTC. Please note that, we are looking for contributions and remote participation is actively supported ********************************* OARC 41 will be a two-day hybrid meeting and the tentative dates are 6th and 7th September to be co-located with ICANN DNS Symposium in Da Nang, Vietnam. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either 10 or 20 minutes in length (plus 5 minutes for Q&A). Proposals for in-person lightning presentations will be opened at the Workshop. Workshop Milestones: 2023-04-16 Submissions open via Indico 2023-06-20 Deadline for submission (23:59 UTC) 2023-06-27 Preliminary list of contributions published 2023-07-11 Full agenda published 2023-08-08 Deadline for slideset submission and Rehearsal 2023-09-06 OARC 41 Workshop - Day1 2023-09-07 OARC 41 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc41> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Example guidelines for presentation slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 41 - your talk will be broadcast live and recorded for future reference - your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting - Remote speakers have mandatory rehearsal on 2023-08-08 at 14:00 UTC. It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net Hazel Smith, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

OARC 41 - Call for Contribution
by Hazel 23 May '23

23 May '23

OARC 41 will be a two-day hybrid meeting and the tentative dates are 6th and 7th September to be co-located with ICANN DNS Symposium in Asia. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either 10 or 20 minutes in length (plus 5 minutes for Q&A). Proposals for in-person lightning presentations will be opened at the Workshop. *Workshop Milestones:* 2023-04-16 Submissions open via Indico 2023-06-10 Deadline for submission (23:59 UTC) 2023-06-27 Preliminary list of contributions published 2023-07-11 Full agenda published 2023-08-08 Deadline for slideset submission and Rehearsal 2023-09-06 OARC 41 Workshop - Day1 2023-09-07 OARC 41 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc41> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Example guidelines for presentation slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 41 - your talk will be broadcast live and recorded for future reference - your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting - *Remote speakers have mandatory rehearsal on 2023-08-08 at 14:00 UTC.* It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net Hazel Smith, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

DNSSEC and DHCP
by Julian Fölsch 23 May '23

23 May '23

Hi, First of all: If you think, I should discuss this somewhere else, please tell me. :) During my quest to get my SSH client to use SSHFP records and not annoy me with trust questions anymore, I fell into the rabbit hole that is DNSSEC. Our domain already uses DNSSEC, so I only had to set up the resolver in our office and my PC to verify it. This however had the side effect that child zones that are not signed were no longer resolving so I thought "Lets just sign them. Can't be that hard, right?" I was very wrong. One of the child zones is for hosts using DHCP and is managed by dnsmasq that unfortunately can't sign the zone. But it can do zone transfers. So we tried a setup using opendnssec as a signing proxy that transfers the zone to an unbound. Unfortunately this has proven unreliable at best and broken at worst so I am looking to replace that. I was just looking around for a DHCP server that directly can sign the zone but I was unable to find something so far. So I was wondering how other people are doing this. Are you signing DHCP zones? Would you recommend (not) doing it? If you are doing it, how are you doing it? Kind regards, Julian PS: If you are at RIPE86 I also would be happy to discuss this in person :) -- Julian Fölsch Arbeitsgemeinschaft Dresdner Studentennetz (AG DSN) Teamsprecher Computing Tel.: +49 351 271816 69 E-Mail: julian.foelsch(a)agdsn.de StuRa der TU Dresden Helmholtzstr. 10 01069 Dresden

4 4

Proposed Service Criticality Forms
by Paul de Weerd 15 May '23

15 May '23

Dear Colleagues, During the DNS WG session at RIPE 84 in May, we discussed the Service Criticality Framework (https://ripe84.ripe.net/wp-content/uploads/presentations/101-101-Technology… and https://ripe84.ripe.net/archives/video/811). We mentioned that we would like the Working Group's input on the criticality ratings for K-Root and AuthDNS. We have completed the forms internally and would like to share them with you. We hope to receive your feedback by 23 December. Best regards, Paul de Weerd RIPE NCC

1 1

DNS-WG at RIPE 86: Agenda
by Moritz Muller 12 May '23

12 May '23

Hi all, Below you can find our packed agenda for the DNS-WG session at the upcoming meeting. - Shielding Europe - DNS4EU's Pan-European Protective DNS Service for 100 Million Users: Andronikos Kyriakou - Update on the resolver task-force: Shane Kerr - Measuring Open Resolver Use in EU: Geoff Huston - Connectbyname and the Proxy Control option: Philip Homburg - DNSSEC multi-signer models: Matthijs Mekking - RIPE NCC update: Anand Buddhdev - Short presentation by a notable project of the DNS hackathon See you in Rotterdam or online! — Moritz

1 0

Reminder: DNS-WG at RIPE 86 call for presentations
by Moritz Muller 24 Apr '23

24 Apr '23

Dear Colleagues, This is a short reminder that we’re still accepting submissions to the DNS working group meeting at RIPE 86 in Rotterdam. We're scheduled for 2023-05-25 (Thursday, 25 May 2023) at 9:00 CEST (07:00 UTC). Please send your presentation proposals and discussion topics to dns-wg-chairs(a)ripe.net. Please also indicate how much time you would need for your presentation. Cheers, Moritz

1 0

NRDelegationAttack: Complexity DDoS attack on DNS Recursive Resolvers
by Hank Nussbacher 10 Apr '23

10 Apr '23

https://www.usenix.org/conference/usenixsecurity23/presentation/afek https://www.usenix.org/system/files/sec23fall-prepub-309-afek.pdf -Hank

1 0