- dns-wg - mailman.ripe.net

Upcoming changes to the DNSSEC root trust anchor
by Andres Pavez 05 Nov '24

05 Nov '24

Dear Colleagues, We are reaching out to inform you of important changes to the DNSSEC trust anchor in the root zone. If you manage a validating DNS resolver or a tool that interacts with the DNS root zone you might need to change your software to handle the changes. This letter provides a summary of the upcoming changes and gives pointers to resources that describe them in detail. *Upcoming addition of the KSK-2024 trust anchor* On January 11, 2025, a new trust anchor, codenamed KSK-2024, will appear in the root zone for the global DNS. This key was generated earlier this year and will co-exist with the current trust anchor, codenamed KSK-2017. The new DNSKEY record is: . 172800 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/c idltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHb GiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+s iFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqp dVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ 1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUe ayffKC73PYc= As a result of this addition, some DNS responses may be larger during the transition period. If your software uses the RFC 5011 process for managing trust anchors, KSK-2024 will be automatically trusted about one month after its introduction to the root zone. There are two important planned dates: * October 11, 2026: KSK-2024 will begin signing the root zone. * January 11, 2027: KSK-2017 is scheduled to be revoked. For a detailed description of the rollover process, please refer to https://www.iana.org/dnssec/files *New trust anchor file* IANA has issued a new trust anchor file using the updated XML format described in https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7958bis/ , which has recently been approved to be published as an RFC. The new trust anchor file contains additional data that was not provided in previous versions of the file. If your software or processes use the IANA trust anchor file (published at https://data.iana.org/root-anchors/root-anchors.xml ), you should ensure you have processes to retrieve it regularly (such as weekly) and check your systems can process the revised format of the file. *Keep in touch* Operational announcements regarding trust anchors and rollovers are published on the root-dnssec-announce mailing list at https://lists.icann.org/postorius/lists/root-dnssec-announce.icann.org/ . A separate ksk-rollover mailing list is a forum for discussion specific to rollovers can be found at https://lists.icann.org/postorius/lists/ksk-rollover.icann.org/ . Best regards, -- Andres Pavez Cryptographic Key Manager

1 0

DNS Resolver Recommendations in Practice BoF session
by Willem Toorop 12 Oct '24

12 Oct '24

Dear all, There will be a *DNS Resolver Recommendations in Practice* BoF session on Thursday the 31st of October from 18:00 till 19:00. This will be a panel session in which the operational practices of some resolver operators will be measured against the recommendations from ripe-823 <https://www.ripe.net/publications/docs/ripe-823/>. Currently we have representatives for the resolvers from UltraDNS public, Quad9, SURF and DNS4EU! The session will be chaired by Shane Kerr. We had a similar panel session <https://ripe88.ripe.net/archives/video/1323/> during the DNS working group meeting at RIPE 88. It was a huge success, however the available time for it within the DNS working group session was too little. Because of this, we repeat the same formula, but this time in a BoF slot, which allows for one hour! We also have more resolver representative this time from a diverse range of type of organizations. Very much looking forward to this session and to see you all in Prague! Cheers and regards, Willem Toorop

2 2

RIPE 89 DNS working group agenda
by Willem Toorop 12 Oct '24

12 Oct '24

Dear all, The agenda for the for the DNS working group session on Wednesday the 30^th of October from 9:00 till 10:30 during the RIPE 89 in Prague is ready! The agenda is as follows: * *Welcome* [3 min] Moritz Müller (SIDN Labs, University of Twente) * *Announcing the next DNS Hackathon* [3 min] Vesna Manojlovic (RIPE NCC) * *DarkDNS: Revisiting the Value of Rapid Zone Update* [15 min] Raffaele Sommese (University of Twente) * *Update of the HU registry DNS zone generation and signer systems* [15 min] Tamás Csillag (PCH) * *Extended DNS Errors - Unlocking the Full Potential of DNS Troubleshooting* [20 min] Yevheniya Nosyk (Université Grenoble Alpes) * *The Rise and Fall of an Undelegated Domain: the Impact of a Global Misconfiguration* [ 20 min] Roy Arends (ICANN) * *DNS Update from the RIPE NCC* [10 min] Anand Buddhdev (RIPE NCC) Also note that there will be a *DNS Resolver Recommendations in Practice* BoF session on Thursday the 31^st of October^from 18:00 till 19:00. This will be a panel session in which the operational practices of some resolver operators will be measured against the recommendations from ripe-823 <https://www.ripe.net/publications/docs/ripe-823/>. Currently we have representatives for the resolvers from UltraDNS public, Quad9, SURF and DNS4EU! The session will be chaired by Shane Kerr. See you all in Prague in 2 weeks! Cheers and regards, Willlem Toorop on behalf of the RIPE DNS working group co-chairs

1 0

DNS-OARC 44 - Call for Contribution
by Petr Špaček 13 Sep '24

13 Sep '24

PLEASE NOTE THIS Call for Contribution is for OARC 44, February 2025. We are posting it before OARC 43 has taken place to give submitters plenty of time, but the OARC 43 programme is set and we hope to see you there. The Programme Committee is seeking contributions from the community. This workshop will be a hybrid event. Date - 6-7 February 2025 Location - Atlanta Marriott Marquis - Atlanta, Georgia, USA Time zone - EST (UTC -5) Co-located with - NANOG 93 Deadline for Submissions - 2024-12-02 23:59 UTC All DNS-related subjects and discussion topics are welcome! Here’s a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve time to recovery, tooling), interoperability concerns and experience. - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: Performance management and metrics. Server efficiency. - Security: DoS experience, attacks on the DNS, DNSSEC signing and validation. - Privacy: Encrypted transports, qname minimization, data anonymization. For further details please see https://www.dns-oarc.net/oarc44 Petr Špaček, for the DNS-OARC Programme Committee

1 0

DNS-WG at RIPE 89: Call for presentations
by Willem Toorop 12 Aug '24

12 Aug '24

Dear colleagues, Summer is at its peak, but RIPE 89 in Prague is approaching! The RIPE 89 meeting will be held from 28 October till 1 November 2024. Our working group meeting is currently scheduled on the 30th of October at 9:00am, but note that this may still change. This e-mail is our first official call for topics for the DNS working group session. If you are interested in presenting, please send your proposals to dns-wg-chairs(a)ripe.net. Please also indicate how much time you would need for your presentation including Q&A. As usual, both in-person and remote participation in the working group is possible. We plan to send out a first round of notifications half September. Cheers, Willem on behalf of the RIPE DNS Working group co-chairs (Dodo, Moritz and me)

1 0

Sunsetting ns.ripe.net - new domain objects can no longer reference ns.ripe.net
by Paul de Weerd 18 Jun '24

18 Jun '24

Dear colleagues, On 6 June, we announced an updated schedule for the retirement of the "ns.ripe.net" secondary DNS service for LIRs. In this updated schedule, the first step was to stop accepting delegation requests with the name server "ns.ripe.net" in them. We have therefore adjusted our reverse DNS checking process to reject new delegation requests with "ns.ripe.net". If you are using this secondary service, you may also begin an orderly transition away from it, by updating the NS records in your zones, and then updating your domain objects in the RIPE Database, to remove "nserver" attributes containing "ns.ripe.net". Later this week, we will send out emails to users of the service, with a link to our RIPE Labs article, and instructions for stopping the use of this service. If you have any questions, please email dns(a)ripe.net. Regards, Paul de Weerd Manager Global Information Infrastructure team RIPE NCC

1 0

Retiring ns.ripe.net
by Paul de Weerd 06 Jun '24

06 Jun '24

Dear colleagues, We have published a RIPE Labs article on how we believe it is now time to retire the secondary DNS service for member’s reverse DNS delegations, ns.ripe.net: https://labs.ripe.net/author/anandb/retiring-nsripenet/ We are proposing to retire the secondary DNS service by the end of 2024 and we're asking for your input and feedback on this proposal. Please share any feedback on the DNS Working Group mailing list by 16 May 2024. Once we’ve collected your feedback, we will discuss this topic in the DNS Working Group session at RIPE 88 on Wednesday, 22 May 2024. Paul de Weerd Manager Global Information Infrastructure team RIPE NCC

10 12

DNS-OARC 43 - moved to Prague, CZ - 2024 October 26-27
by Petr Špaček 04 Jun '24

04 Jun '24

DNS-OARC 43 Workshop has moved to Europe and will be held right before RIPE 89. New location: Prague, Czech republic New date: 2024 October 26-27 (before RIPE 89) Details: https://www.dns-oarc.net/oarc43 Call for presentations is open until 2024-07-23 23:59 UTC You can also look forward to DNS Community day which will happen in the original location and date. See https://indico.dns-oarc.net/e/SMR2024 for more details. See you there! -- Petr Špaček, for the DNS-OARC Programme Committee

1 0

DELEG
by Andrew Campling 27 May '24

27 May '24

If Tale's DELEG update presentation at the RIPE 88 DNS wg session last week was of interest, you may also find our recent panel discussion on the same topic with Paul Mockapetris, Paul Vixie and Ralf Weber useful. If you missed it, the recording is at https://419.consulting/encrypted-dns/f/deleg-the-hairy-dns-camel. Andrew

1 0

Ars technica coverage of C-root's failure to refresh
by Willem Toorop 24 May '24

24 May '24

FYI: Ars technica published an article covering the recent C-root failure to refresh. See: https://arstechnica.com/security/2024/05/dns-glitch-that-threatened-interne…

1 0