- dns-wg - mailman.ripe.net

New on RIPE Labs: DNS Privacy (by Geoff Huston)
by Mirjam Kuehne 18 Jul '16

18 Jul '16

Dear colleagues, Please find this new article on DNS privacy by Geoff Huston on RIPE Labs: https://labs.ripe.net/Members/gih/dns-privacy Kind regards, Mirjam Kuehne RIPE NCC

1 0

New on RIPE Labs: Operator Level DNS Hijacking
by Mirjam Kuehne 11 Jul '16

11 Jul '16

Dear colleagues, Please find a new article by Babak Farrokhi on RIPE Labs: Operator Level DNS Hijacking This is follow-up from Babak's recent research on DNS hijacking. In this new article he is wondering whether this is a common practice among the operators. With the help of RIPE Atlas, he started to think of a solution to figure out whether such practice is widespread in other areas of the world. https://labs.ripe.net/Members/babak_farrokhi/operator-level-dns-redirection… Kind regards, Mirjam Kuehne RIPE Labs

1 0

New on RIPE Labs: Is Your ISP Hijacking Your DNS Traffic?
by Mirjam Kuehne 06 Jul '16

06 Jul '16

Dear colleagues, Please find a new article by Babak Farrokhi on RIPE Labs: Is your ISP Hijacking your DNS Traffic? https://labs.ripe.net/Members/babak_farrokhi/is-your-isp-hijacking-your-dns… Kind regards, Mirjam Kuehne RIPE NCC

7 8

Root DNS incident on June 25
by Romeo Zwart 04 Jul '16

04 Jul '16

Dear colleagues, On June 25, 2016 all of the Internet Domain Name System's root name servers received an unusually high rate of TCP SYN and ICMP traffic. A report that explains the nature and impact of the incident has been published here: http://root-servers.org/news/events-of-20160625.txt Kind regards, Romeo Zwart

2 1

New on RIPE Labs: Securing Network Infrastructure for DNS Servers
by Mirjam Kuehne 29 Jun '16

29 Jun '16

Dear colleagues, Ramtin Kiaei shows how to mitigate DNS attacks by implementing a stateless firewall filter at the aggregation or edge router. Please find his article on RIPE Labs: https://labs.ripe.net/Members/ramtin_kiaei/securing-network-infrastructure-… Kind regards, Mirjam Kuehne RIPE NCC

6 10

New on RIPE Labs: K-root Reachability in the Middle East and Central Asia
by Mirjam Kuehne 27 Jun '16

27 Jun '16

Dear colleagues, Babak Farrokhi looked at the reachability of K-root from countries in the Middle East and Central Asia. Please find the results on RIPE Labs: https://labs.ripe.net/Members/babak_farrokhi/k-root-reachability-in-the-mid… Kind Regards, Mirjam Kuehne RIPE NCC

1 0

Call for Presentations - DNS-OARC Fall Workshop, Oct 2016
by Stuart, Sean 16 Jun '16

16 Jun '16

Apologies if you are on multiple lists and see multiple copies of this email. Call for Presentations The DNS-OARC 25th Workshop will take place in Dallas, Texas during October 15th and 16th 2016, the Saturday and Sunday before NANOG68. To attract the best DNS minds, DNS-OARC is requesting proposals for presentations, with a preference for Resolver's Operations experiences, including running DNSSEC validating resolvers. This workshop intends to build from previous strong DNS-OARC workshops, where both operational content and research are welcome. All DNS-related subjects are accepted. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. A timeslot will be available for lightning talks (5-10 minutes) on Sunday October 16th, for which submissions will be accepted during October 15th on a first-come first-served basis. Workshop Milestones • 15th June 2016, Call for Presentations posted and open for submissions • 14th August 2016, Deadline for submission • 1st September 2016, Final Program published • 10th October 2016, Final deadline for slideset submission Details for presentation submission will be published here: https://indico.dns-oarc.net/event/25/call-for-abstracts/ The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To ensure the quality of the workshop, submissions should include slides. Draft slides are acceptable on submission. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee OARC is also seeking sponsorship for this workshop, please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) Thanks, Sean ‹ Sean Stuart Engineer, Resolution Operations sstuart(a)verisign.com <mailto:sstuart@verisign.com> 12061 Bluemont Way, Reston, VA, 20190

1 0

Question about use of cname in Google's services
by Anurag Bhatia 04 Jun '16

04 Jun '16

Hello everyone Someone asked me question on why google uses cname for their services anyways? I mean I get it that for Google Apps customers it makes sense to have mail.domain.com pointed to a cname rather then A record to a host which may die. But why for their own services? Like e.g "mail.google.com" is cname to googlemail.l.google.com. and googlemail.l.google.com. eventually returns A record. This adds up one extra step in resolution and I wonder why Google does it this way? What advantage they get ? or What advantage they miss if they simply return record which I am getting for googlemail.l.google.com. directly as A record for mail.google.com ? Curious to hear your thoughts. Thanks! -- Anurag Bhatia anuragbhatia.com

4 4

New on RIPE Labs: Anycast vs. DDoS - Evaluating the November 2015 Root DNS Event
by Mirjam Kuehne 31 May '16

31 May '16

Dear colleagues, IP anycast has been widely used to replicate services in multiple locations as a way to deliver better performance and resilience. It has been largely employed by CDNs and DNS operators, such as on the root server system. However, there is little evaluation of anycast under stress. Please find this short guest post by Giovane Moura on RIPE Labs: https://labs.ripe.net/Members/giovane_moura/anycast-vs-ddos-evaluating-the-… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [dns-wg] DNS Privacy
by Sara Dickinson 27 May '16

27 May '16

> On 25 May 2016, at 19:13, Roland van Rijswijk - Deij <Roland.vanRijswijk(a)surfnet.nl> wrote: Hi Roland, > I've already run a number of benchmark tests with TLS-enabled Unbound, That’s interesting, we are doing the same although there still are a couple of features that are missing from Unbound for it to be fully performant/production ready. We have also had a lot of discussions about how existing load balancers might be modified do to the TCP/TLS connection management for DNS, so it would actually be interesting to have resolvers with differing configurations. > and would be willing to host one or two public resolvers at SURFnet that > are TLS-enabled. Would that be helpful? That sounds great. > I even have (relatively) nice IP > addresses available ;-) (145.0.0.145 comes to mind). nice :-) Sara.

4 3