- dns-wg - mailman.ripe.net

ICANN SSAC Survey on the anticipated impacts of open source regulation on the DNS infrastructure
by Maarten Aertsen 28 Jan '25

28 Jan '25

hello DNS wg, I ask for your help to inform policy makers of specific concerns in the DNS community. ICANN's Security and Stability Advisory Committee [1] is attempting to document the operational reliance on Free and Open Source Software (FOSS) in the Internet’s domain name infrastructure to inform policy discussions regarding the security of software and critical infrastructure. Our work aims aim to clear up misinformed assumptions by regulators and policy makers that may threaten the FOSS development and supply model, impacting operators of the Internet’s domain and routing systems. Please contribute your professional experience and opinion with a response to an anonymous qualitative survey: https://ec.europa.eu/eusurvey/runner/SSAC-open-source-software-in-DNS-and-r… Our report will be published on the ICANN website [2], with a target publication date in June. The survey will be closed for new submissions at the end of February anywhere on earth. Considering many of you use open source DNS implementations ever day, we ask you to help us make visible the scope and scale of FOSS in Internet infrastructure and share positive/negative impact of regulation you anticipate on the infrastructure you support. kind regards, Maarten [1] https://www.icann.org/en/ssac [2] https://www.icann.org/en/ssac/publications # What is SSAC? The Security and Stability Advisory Committee advises the ICANN community and ICANN Board on security and integrity matters related to Internet naming and address systems. We perform ongoing threat assessment and risk analysis to assess principal threats to stability and security of these systems. SSAC publications are available from https://www.icann.org/en/ssac/publications # What software are you looking at? Our focus is on recursive & authoritative nameservers, RDAP/WHOIS, EPP/registry and escrow functions. # Anonymous? We use the European Commission's EUsurvey tool, configured not to log IP addresses or other information with the potential to identify you. Your (anonymous) comments may be reprinted as entered in the report, if there is personally identifying information / personal data included in your comments, we will edit that from your remarks. -- Maarten Aertsen senior internet technologist, NLnet Labs

1 0

Don’t Miss the 44th DNS-OARC Workshop in Atlanta!
by Willem Toorop 24 Jan '25

24 Jan '25

Dear all, Join us for the 44th DNS-OARC Workshop in Atlanta, GA, USA, on February 6–7, 2025, right after NANOG 93 at the Atlanta Marriott Marquis (Location: https://maps.app.goo.gl/QLur9V7ahdgRJRgW8). *Workshop Highlights* Engaging sessions for operators, developers, and researchers: * Day 1: DNS resolver insights, authoritative operations, Encrypted Client Hello, and a Best Practices panel * Day 2: DNS abuse detection, tunneling analysis, DNSSEC innovations, and lightning talks Full Program schedule at: <https://www.dns-oarc.net/oarc44> *Register Now* Don’t miss out! Attend in person or remotely. Register here: <https://www.dns-oarc.net/oarc44> We look forward to seeing you at OARC 44! Best Regards, The DNS-OARC Programme Committee

1 0

Sunsetting ns.ripe.net - Final Cleanup - Wednesday, 15 January
by Anand Buddhdev 15 Jan '25

15 Jan '25

Dear colleagues, On Wednesday 15 January, we'll be moving on to the final phase of removing our secondary DNS service for LIRs (ns.ripe.net) and updating all associated objects in the RIPE Database. This update will remove the "nserver: ns.ripe.net" attribute from them. I am happy to report that 93% of the zones have been updated and stopped using ns.ripe.net as a secondary name server. The remaining zones that have not been updated will not be affected because they will have at least one working name server after this update. Therefore, we do not expect the DNS resolution of these zones to fail. The full sunsetting plan, published last year, is available on RIPE Labs: https://labs.ripe.net/author/anandb/retiring-nsripenet/ Regards, Anand Buddhdev

2 3

Re: [Ext] Reminder: New KSK Publication in DNS Root Zone
by Andres Pavez 07 Jan '25

07 Jan '25

Please note that there is a mistake with the time in my previous email. The new Key Signing Key (KSK) will be published in the DNS root zone on January 11 around 06:00 UTC, not 00:00 UTC as originally stated. Best regards, -- Andres Pavez Cryptographic Key Manager On 1/7/25, 11:39, "Andres Pavez" <andres.pavez(a)iana.org <mailto:andres.pavez@iana.org>> wrote: This is a reminder that the new Key Signing Key (KSK) will be published in the DNS root zone starting January 11 at 00:00:00 UTC. This will start the process of adoption of this trust anchor in RFC 5011 aware resolvers. We encourage operators to pay attention during this process to monitor for any unexpected consequences. Publishing the KSK is part of the process of ensuring widespread adoption of the KSK prior to its use in signing, currently scheduled for October 2026. For more details, please visit: https://www.iana.org/dnssec/files <https://www.iana.org/dnssec/files> Thanks, -- Andres Pavez Cryptographic Key Manager

1 0

Reminder: New KSK Publication in DNS Root Zone
by Andres Pavez 07 Jan '25

07 Jan '25

This is a reminder that the new Key Signing Key (KSK) will be published in the DNS root zone starting January 11 at 00:00:00 UTC. This will start the process of adoption of this trust anchor in RFC 5011 aware resolvers. We encourage operators to pay attention during this process to monitor for any unexpected consequences. Publishing the KSK is part of the process of ensuring widespread adoption of the KSK prior to its use in signing, currently scheduled for October 2026. For more details, please visit: https://www.iana.org/dnssec/files Thanks, -- Andres Pavez Cryptographic Key Manager

1 0

OARC 44 Call for Contribution deadline extension - Dec 9, 2024
by Willem Toorop 03 Dec '24

03 Dec '24

The deadline for OARC 44 abstract submission is extended to December 9, 2024, at 23:59 UTC. Thanks to those who already submitted, but we're still looking for more contributions. If you have something interesting to present and missed the chance last week, then this is your opportunity to still be part of the agenda for this event. This workshop will be a hybrid event. Date - 6-7 February 2025 Location - Atlanta Marriott Marquis - Atlanta, Georgia, USA Time zone - EST (UTC -5) Co-located with - NANOG 93 Deadline for Submissions - 2024-12-09 23:59 UTC All DNS-related subjects and discussion topics are welcome although we're particularly keen to hear about operational and security related experiences, best practices and practical advice; both for newcomers to the DNS arena and those who have been around for longer who want to learn more about new features and opportunities to improve resilience, security and privacy. If you have something interesting to share with the community that lies outside of the focus above, please don't be put off - if it's good, we'll be happy to include it. If you'd like to offer a talk, but are not quite sure what to pick, here's a non-exhaustive list of ideas: * *Operations*: Experiences, interoperability concerns, tooling tips, lessons learned from or details/reasons for a recent outage (how to improve time to recovery, tooling for detection/mitigation), operational 'gotchas'... * *Deployment*: DNS config management and release process. * *Monitoring*: Log ingestion pipeline, analytics infrastructure, anomaly detection. * *Scaling*: DNS performance management and metrics. Increasing DNS server efficiency. * *Security*: DoS experience, attacks on the DNS, DNSSEC signing and validation. * *Privacy*: Encrypted transports, qname minimization, data anonymization. * *Resilience*: Provisioning planning, load-balancing services, features (e.g. serve-stale) For further details please see https://www.dns-oarc.net/oarc44 Willem Toorop, for the DNS-OARC Programme Committee

1 0

Deadline Reminder: OARC 44 Call for Contribution - Dec 2, 2024
by Willem Toorop 29 Nov '24

29 Nov '24

The Programme Committee is seeking contributions from the community. This workshop will be a hybrid event. Date - 6-7 February 2025 Location - Atlanta Marriott Marquis - Atlanta, Georgia, USA Time zone - EST (UTC -5) Co-located with - NANOG 93 Deadline for Submissions - 2024-12-02 23:59 UTC All DNS-related subjects and discussion topics are welcome although we're particularly keen to hear about operational and security related experiences, best practices and practical advice; both for newcomers to the DNS arena and those who have been around for longer who want to learn more about new features and opportunities to improve resilience, security and privacy. If you have something interesting to share with the community that lies outside of the focus above, please don't be put off - if it's good, we'll be happy to include it. If you'd like to offer a talk, but are not quite sure what to pick, here's a non-exhaustive list of ideas: * *Operations*: Experiences, interoperability concerns, tooling tips, lessons learned from or details/reasons for a recent outage (how to improve time to recovery, tooling for detection/mitigation), operational 'gotchas'... * *Deployment*: DNS config management and release process. * *Monitoring*: Log ingestion pipeline, analytics infrastructure, anomaly detection. * *Scaling*: DNS performance management and metrics. Increasing DNS server efficiency. * *Security*: DoS experience, attacks on the DNS, DNSSEC signing and validation. * *Privacy*: Encrypted transports, qname minimization, data anonymization. * *Resilience*: Provisioning planning, load-balancing services, features (e.g. serve-stale) For further details please see https://www.dns-oarc.net/oarc44 Willem Toorop, for the DNS-OARC Programme Committee

1 0

Upcoming changes to the DNSSEC root trust anchor
by Andres Pavez 05 Nov '24

05 Nov '24

Dear Colleagues, We are reaching out to inform you of important changes to the DNSSEC trust anchor in the root zone. If you manage a validating DNS resolver or a tool that interacts with the DNS root zone you might need to change your software to handle the changes. This letter provides a summary of the upcoming changes and gives pointers to resources that describe them in detail. *Upcoming addition of the KSK-2024 trust anchor* On January 11, 2025, a new trust anchor, codenamed KSK-2024, will appear in the root zone for the global DNS. This key was generated earlier this year and will co-exist with the current trust anchor, codenamed KSK-2017. The new DNSKEY record is: . 172800 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/c idltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHb GiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+s iFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqp dVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ 1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUe ayffKC73PYc= As a result of this addition, some DNS responses may be larger during the transition period. If your software uses the RFC 5011 process for managing trust anchors, KSK-2024 will be automatically trusted about one month after its introduction to the root zone. There are two important planned dates: * October 11, 2026: KSK-2024 will begin signing the root zone. * January 11, 2027: KSK-2017 is scheduled to be revoked. For a detailed description of the rollover process, please refer to https://www.iana.org/dnssec/files *New trust anchor file* IANA has issued a new trust anchor file using the updated XML format described in https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7958bis/ , which has recently been approved to be published as an RFC. The new trust anchor file contains additional data that was not provided in previous versions of the file. If your software or processes use the IANA trust anchor file (published at https://data.iana.org/root-anchors/root-anchors.xml ), you should ensure you have processes to retrieve it regularly (such as weekly) and check your systems can process the revised format of the file. *Keep in touch* Operational announcements regarding trust anchors and rollovers are published on the root-dnssec-announce mailing list at https://lists.icann.org/postorius/lists/root-dnssec-announce.icann.org/ . A separate ksk-rollover mailing list is a forum for discussion specific to rollovers can be found at https://lists.icann.org/postorius/lists/ksk-rollover.icann.org/ . Best regards, -- Andres Pavez Cryptographic Key Manager

1 0

DNS Resolver Recommendations in Practice BoF session
by Willem Toorop 12 Oct '24

12 Oct '24

Dear all, There will be a *DNS Resolver Recommendations in Practice* BoF session on Thursday the 31st of October from 18:00 till 19:00. This will be a panel session in which the operational practices of some resolver operators will be measured against the recommendations from ripe-823 <https://www.ripe.net/publications/docs/ripe-823/>. Currently we have representatives for the resolvers from UltraDNS public, Quad9, SURF and DNS4EU! The session will be chaired by Shane Kerr. We had a similar panel session <https://ripe88.ripe.net/archives/video/1323/> during the DNS working group meeting at RIPE 88. It was a huge success, however the available time for it within the DNS working group session was too little. Because of this, we repeat the same formula, but this time in a BoF slot, which allows for one hour! We also have more resolver representative this time from a diverse range of type of organizations. Very much looking forward to this session and to see you all in Prague! Cheers and regards, Willem Toorop

2 2

RIPE 89 DNS working group agenda
by Willem Toorop 12 Oct '24

12 Oct '24

Dear all, The agenda for the for the DNS working group session on Wednesday the 30^th of October from 9:00 till 10:30 during the RIPE 89 in Prague is ready! The agenda is as follows: * *Welcome* [3 min] Moritz Müller (SIDN Labs, University of Twente) * *Announcing the next DNS Hackathon* [3 min] Vesna Manojlovic (RIPE NCC) * *DarkDNS: Revisiting the Value of Rapid Zone Update* [15 min] Raffaele Sommese (University of Twente) * *Update of the HU registry DNS zone generation and signer systems* [15 min] Tamás Csillag (PCH) * *Extended DNS Errors - Unlocking the Full Potential of DNS Troubleshooting* [20 min] Yevheniya Nosyk (Université Grenoble Alpes) * *The Rise and Fall of an Undelegated Domain: the Impact of a Global Misconfiguration* [ 20 min] Roy Arends (ICANN) * *DNS Update from the RIPE NCC* [10 min] Anand Buddhdev (RIPE NCC) Also note that there will be a *DNS Resolver Recommendations in Practice* BoF session on Thursday the 31^st of October^from 18:00 till 19:00. This will be a panel session in which the operational practices of some resolver operators will be measured against the recommendations from ripe-823 <https://www.ripe.net/publications/docs/ripe-823/>. Currently we have representatives for the resolvers from UltraDNS public, Quad9, SURF and DNS4EU! The session will be chaired by Shane Kerr. See you all in Prague in 2 weeks! Cheers and regards, Willlem Toorop on behalf of the RIPE DNS working group co-chairs

1 0