- dns-wg - mailman.ripe.net

Retiring ns.ripe.net
by Paul de Weerd 06 Jun '24

06 Jun '24

Dear colleagues, We have published a RIPE Labs article on how we believe it is now time to retire the secondary DNS service for member’s reverse DNS delegations, ns.ripe.net: https://labs.ripe.net/author/anandb/retiring-nsripenet/ We are proposing to retire the secondary DNS service by the end of 2024 and we're asking for your input and feedback on this proposal. Please share any feedback on the DNS Working Group mailing list by 16 May 2024. Once we’ve collected your feedback, we will discuss this topic in the DNS Working Group session at RIPE 88 on Wednesday, 22 May 2024. Paul de Weerd Manager Global Information Infrastructure team RIPE NCC

10 12

DNS-OARC 43 - moved to Prague, CZ - 2024 October 26-27
by Petr Špaček 04 Jun '24

04 Jun '24

DNS-OARC 43 Workshop has moved to Europe and will be held right before RIPE 89. New location: Prague, Czech republic New date: 2024 October 26-27 (before RIPE 89) Details: https://www.dns-oarc.net/oarc43 Call for presentations is open until 2024-07-23 23:59 UTC You can also look forward to DNS Community day which will happen in the original location and date. See https://indico.dns-oarc.net/e/SMR2024 for more details. See you there! -- Petr Špaček, for the DNS-OARC Programme Committee

1 0

DELEG
by Andrew Campling 27 May '24

27 May '24

If Tale's DELEG update presentation at the RIPE 88 DNS wg session last week was of interest, you may also find our recent panel discussion on the same topic with Paul Mockapetris, Paul Vixie and Ralf Weber useful. If you missed it, the recording is at https://419.consulting/encrypted-dns/f/deleg-the-hairy-dns-camel. Andrew

1 0

Ars technica coverage of C-root's failure to refresh
by Willem Toorop 24 May '24

24 May '24

FYI: Ars technica published an article covering the recent C-root failure to refresh. See: https://arstechnica.com/security/2024/05/dns-glitch-that-threatened-interne…

1 0

Fwd: [ripe-list] DNS Resolver Recommendations Published (ripe-823)
by Shane Kerr 17 May '24

17 May '24

Dear RIPE DNS working group, Here is a belated notice that the DNS Resolver Recommendations document was published a couple of weeks ago. Apologies for not mentioning it sooner! Cheers, -- Shane

1 0

GOV zone operational update: DNSSEC transition to algorithm 13
by Christian Elmerot 13 May '24

13 May '24

Cloudflare will start the transition of the .GOV zone to use DNSSEC signing algorithm 13 (ECDSA P-256) about a week from now. We do not expect any action to be required by the operators of DNS resolvers or by end-users due to this change. This note is being sent as a courtesy, in the interests of operational transparency.. We plan to start the transition on May 20th, 2024. The initial step will be to include algorithm 13 signatures alongside algorithm 8 signatures in signed responses sent by the authoritative .GOV nameservers. The transition will proceed through the following sequence of events: 1. Algorithm 13 signatures are published in addition to algorithm 8 signatures 2. Algorithm 13 DNSKEY records are published alongside the current algorithm 8 DNSKEYs 3. Algorithm 13 DS record is published in the root zone 4. Algorithm 8 DS record is removed from the root zone 5. Algorithm 8 DNSKEY records are removed 6. Algorithm 8 signatures are removed from responses Cloudflare has been using algorithm 13 for zone signing since 2015, pioneering its use to the wider community. The widespread adoption since serves as a testament to the maturity of the resolver ecosystem's ability to recognize and validate the algorithm. Other important zones also use algorithm 13 today, such as the .COM and .NET Top-Level Domains (TLDs) that transitioned to algorithm 13 in the fourth quarter of 2023. While we anticipate minimal operational impact for end users, we encourage you to reach out to us with any questions or reports of unexpected behavior related to the transition. Christian Elmerot, Cloudflare

1 0

Survey & invitation: Open source quality assurance & risks @ RIPE 88 Open Source WG
by Petr Špaček 13 May '24

13 May '24

Dear DNS colleagues, I invite you to RIPE 88 Open Source WG discussion about Open source quality assurance & risks. To fuel the discussion please fill out a 5-minute survey here: https://ec.europa.eu/eusurvey/runner/RIPE88OpenSourceWGSurvey You opinions are very welcome even if you don't plan to attend the meeting! Our goal is to find out what people actually look for when assessing open source quality and risks associated with the software. During the RIPE 88 open source session we will have a speculative session where we will present survey results about how people see the open-source Q&A processes, compare these wishes with real example of what is being done today around BIND DNS server, and follow all that with an open discussion at the microphone. See you in Krakow! -- Petr Špaček Internet Systems Consortium

1 0

DNS-WG Agenda for RIPE88
by Doris Hauser 09 May '24

09 May '24

Hello everyone! The agenda for the DNS working group at RIPE88 is finally ready! Our working group is scheduled on Wednesday 22nd of May from 9 until 10:30. The Agenda is as follows: 09:00 - Welcome and new chair selection - Doris Hauser (5min) 09:05 - DNSSEC bootstrapping support in Knot DNS 3.3.5 and in PowerDNS 10 - Peter Thomassen (15min) 09:20 - DELEG updates - Dave Lawrence (15min) 09:35 - DNS update from the RIPE NCC - Martin Pels (10min) 09:45 - Studying DNS energy consumption - Sandoche Balakrichenan (15min) 10:00 - Comparing RIPE BCP resolver recommendations with actual resolvers - Shane Kerr (25min) We are looking forward to seeing you all again soon! Kind regards, Doris Hauser, BSc Linux System Engineering nic.at GmbH Jakob-Haringer-Straße 8/V · 5020 Salzburg · Austria T +43 662 46 69 -580 · F -751 M +43 676 898 298 751 Doris.hauser(a)nic.at · www.nic.at LG Salzburg / FN 172568b · Sitz / location: Salzburg ......................................................................................................................................................... Alle nic.at Produkte: www.nic.at/markenwelt all nic.at products: www.nic.at/brands

1 1

Candidates for the open co-chair position at the RIPE DNS working group
by Willem Toorop 08 May '24

08 May '24

Dear all, The deadline for volunteers/nominations has passed and I am very pleased to announce that we received a single self-nomination: Moritz Müller applying for a second term as co-chair. We will now collect expressions of support (or opposition) from the mailing-list, until Monday 20 May 2024, and will announce the results on Wednesday 22 May 2024 during the DNS working group session at the RIPE 88. Find below Moritz' motivation to apply for a second term: ### I'd like to volunteer for a second term as RIPE DNS-WG co-chair. In my last term, I've helped organizing (hopefully) interesting and diverse working-group meetings and I'd like to continue doing this for another 3 years. For the next term, I'd like to go on organizing meetings that are relevant not only for DNS experts but also for the broader RIPE community with interest in the DNS. ### Timeline * Monday, 20 May 2024 Deadline for showing support for candidates/volunteers on the mail list * Wednesday, 22 May 2024 DNS WG session at RIPE 88 References The RIPE working group chair job description is included in ripe-692: https://www.ripe.net/publications/docs/ripe-692 The DNS working group chair selection process is documented here: https://www.ripe.net/participate/ripe/wg/dns/dns-wg-chair-selection-process We have 3 co-chairs so the term is 3 years. The current approach was announced on this mailing list on 2018-07-17: https://www.ripe.net/ripe/mail/archives/dns-wg/2018-July/003566.html As always, please feel free to reach out to any of the chairs directly, to us as a group at dns-wg-chairs AT ripe.net, or discuss this or any other any relevant topic on this mailing list.

4 3

Authoritative DNS service degradation 2024-04-15
by Martin Pels (RIPE NCC) 18 Apr '24

18 Apr '24

Dear colleagues, Yesterday at 09:15 UTC an unscheduled software update was rolled out on several of our Hosted DNS instances. This update applied an incorrect routing daemon configuration. Due to the incorrect configuration, DNS requests received by these DNS instances could no longer be answered. This affected 8 of our 20 Authoritative DNS sites. At 14:03 UTC the cause of the incident was identified, and anycast BGP announcements for the affected instances were withdrawn, redirecting traffic to other locations. This was completed at 14:15 UTC. We re-applied the correct routing configurations on all affected servers, and restored BGP announcements at 09:00 UTC today. Furthermore, we have applied measures to prevent automatic updates of the routing daemon software on all of our DNS servers. Kind regards, Martin Pels RIPE NCC

2 1