- dns-wg - mailman.ripe.net

RIPE NCC Authoritative and Secondary DNS services on Monday 14 December
by Romeo Zwart 11 Jan '16

11 Jan '16

Dear colleagues, Yesterday, Monday 14 December 2015, RIPE NCC Authoritative DNS services were functioning in a severely degraded state during parts of the day. This was due to an attack on one of the ccTLDs for which the NCC hosts a secondary DNS service. The attack traffic started around 08:00 UTC. RIPE NCC staff applied various countermeasures during the day. These mitigations were effective for some time. However, after implementing each of these mitigations, the traffic patterns were modified to evade them. Towards the end of the day, the volume of the attack traffic targeted at our servers had increased to such a level that it was overloading our incoming links and our mitigation measures were no longer sufficiently effective. At that time we were forced to contact our upstream peers to assist us with mitigation measures. Apart from the ccTLD service for the attacked domain, normal services were restored at around 18:30 UTC. The attack is ongoing, and we continue with mitigation measures in order to provide the best service possible under the circumstances. We note that attacks like this rely on spoofing source addresses in the attack packets. Therefore, Source Address Validation and BCP-38 should be used wherever possible to reduce the ability to abuse networks to transmit spoofed source packets. Kind regards, Romeo Zwart

6 10

PTR-Queries asking for type A or AAAA
by Max Grobecker 10 Jan '16

10 Jan '16

Hello, today I noticed, that my DNS servers are getting a noticable amount of DNS queries for my IPv4 reverse zone, asking for type A or AAAA. Example with tcpdump: 22:22:06.019962 IP 160.45.8.8.45341 > 172.29.56.218.53: 34558 [1au] A? y.x.144.217.in-addr.arpa. (57) 22:22:06.129485 IP 160.45.41.8.55855 > 172.29.56.218.53: 12449% [1au] A? y.x.144.217.in-addr.arpa. (57) 22:22:12.571720 IP 160.45.113.3.11019 > 172.29.56.218.53: 15364 [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:22:13.571228 IP 160.45.41.4.57403 > 172.29.56.218.53: 11276 [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:22:14.561769 IP 160.45.113.3.1159 > 172.29.56.218.53: 16591% [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:22:17.172626 IP 160.45.8.8.34605 > 172.29.56.218.53: 10352 [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:22:17.281042 IP 160.45.41.8.56158 > 172.29.56.218.53: 32812% [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:30:09.386217 IP 134.169.34.26.52144 > 172.29.56.218.53: 29463% [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:30:09.539619 IP 134.169.34.56.59778 > 172.29.56.218.53: 63208% [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:30:09.699493 IP 134.169.34.26.63325 > 172.29.56.218.53: 25399% [1au] A? y.x.144.217.in-addr.arpa. (57) 22:30:09.859583 IP 134.169.34.56.41423 > 172.29.56.218.53: 23848% [1au] A? y.x.144.217.in-addr.arpa. (57) 22:30:19.200884 IP 139.17.128.10.65059 > 172.29.56.218.53: 37206 [1au] AAAA? y.x.144.217.in-addr.arpa. (57) 22:30:20.694596 IP 213.136.95.10.42215 > 172.29.56.218.53: 13396% [1au] A? y.x.144.217.in-addr.arpa. (57) The top queries are for the IP address of my NTP pool server, the other one is for the IP of my primary DNS server. These are originating from several IP addresses, sometimes also Google DNS and DNS resolvers of universities. I've never suffered any problems with my PTR zone and there are enough legitimate queries to prove me that the zone is working as it should... Is this "normal background noise" or could that be caused by a malformed DNS zone? Or is anyone else seeing those weird queries? Thanks! Greetings from Wuppertal Max

4 3

Meanwhile, at ICANN...
by Shane Kerr 06 Jan '16

06 Jan '16

All, Not necessarily RIPE Database related, but I thought I'd point out that ICANN is considering replacing WHOIS for gTLD: https://www.icann.org/news/announcement-2016-01-04-en Cheers, -- Shane

3 2

Algorithm Upgrade for RIPE NCC DNS Zones
by Anand Buddhdev 21 Dec '15

21 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear colleagues, All the zones maintained by the RIPE NCC are signed with the RSA/SHA1 algorithm. At the RIPE 70 meeting we committed to upgrade the algorithm of all our zones. We required an updated version of our signer software that could sign a zone with two different algorithms at the same time. We then needed to test it, to ensure that we could switch algorithms without causing major validation errors. We published a RIPE Labs article about our experiences here: https://labs.ripe.net/Members/anandb/dnssec-algorithm-roll-over We are happy to announce that we are now ready to roll the keys of all our zones and sign them with the RSA/SHA256 algorithm. We will follow the process described in the RIPE Labs article. We plan to begin the roll-over on Monday, 30 November 2015. We would still like to exercise caution, so we will not roll the keys of all zones at the same time. We will do this in batches, starting with a small number of reverse DNS zones of the RIPE Meeting address space. If you have any questions, please send an email to <dns(a)ripe.net>. Regards, Anand Buddhdev RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWVuZ8AAoJEBXgoyUMySoFoHYP+weE0kP6hkbeRJLDO610v612 ZyE81BkNQs6LE/lufAyMLkA36b3J9mVvDcmc2ciuRWdFLef3Z4XD2X+BG0mAAJgM cy4nD7Hx+6m9h3nGGT62CJTneXXNMyqzozcQIDdEyau8qUVM91/SgDFgBJWmnMML JC34hXWb5au5S+Bus/Vaq4iMtROQAq3F6xXR4xiEQoU+XwbOLkWU6WjqwCaJfYZ5 UBaQtpdcqNOjKXyVlDoF6LJnxgxW3kXMi98FEQ8Ye0oYri/h98gdt6BWYfhf5kTY aU7RTAJ2V0ksOVmipSQIT5KkrmV3mwOiuAWjVJYaVJWxmYoHdyMlhtHpUJT4LV1P KvN/XXSZdjBawCNib8zjFFXb79cFRBZ8PMm55W5pcwYNipAK71mlmhEIop8PX3ee oYwU1MzxNoREP3zYWWgolJhhzJsGpZP1ceRJwI4pKQpz4xFju0tJHBQAHICI8Z1R yinf2H0rYPKKyaBNt9aYB/LsTGdh+ccIl4o4/Ep4sc102cemT11mf4QYCeYUIjZW wULcgf4L7d8m3NCa33i5zX44TlQ7xTjdW4m60auSdaRjlUsLTewYkAkrhC5G+aZP oA4RYJVwi0dSbw62S03+MN2senWgSfZe85jqgMX24u/W7XNp59va9wA8nPVJVPl/ XbAQ69qXXKbldMdI4CI2 =/Pwl -----END PGP SIGNATURE-----

2 3

13 new zones added to DNSMON
by Vesna Manojlovic 21 Dec '15

21 Dec '15

1 0

New on RIPE Labs: DNS Censorship (DNS Lies) As Seen By RIPE Atlas
by Suzanne Taylor Muzzin 11 Dec '15

11 Dec '15

Dear colleagues, In this latest RIPE Labs article, Stéphane Bortzmeyer examines whether RIPE Atlas probes can see evidence of Internet censorship via “lying” DNS resolvers: https://labs.ripe.net/Members/stephane_bortzmeyer/dns-censorship-dns-lies-s… <https://labs.ripe.net/Members/stephane_bortzmeyer/dns-censorship-dns-lies-s…> Kind regards, Suzanne Taylor Muzzin RIPE NCC

1 0

Root DNS events of 30 November 2015 and 1 December
by Romeo Zwart 08 Dec '15

08 Dec '15

Dear colleagues, The root DNS operators have shared a report about the events observed at the root on 30 November and 1 December. The report is available here: http://root-servers.org/news/events-of-20151130.txt As mentioned earlier on this list, the RIPE NCC will separately also publish a report about our observations at the K-root servers. Please do note that this separate report will also be limited in the level of operational detail that we can share. Kind regards, Romeo

1 0

TTM and TTM-based DNSMON visualisations coming to an end
by Romeo Zwart 08 Dec '15

08 Dec '15

Dear colleagues, In July 2014 the RIPE NCC ended its data collection for the Test Traffic Measurement (TTM) project. Visualisations of the TTM data collected until that date, and of the DNSMON data collected via the TTM servers, were kept active for interested parties until now. We plan to stop providing visualisations of the old TTM and DNSMON data as of 1 January 2016. Of course the current DNSMON service (https://dnsmon.ripe.net) based on RIPE Atlas, will not be impacted in any way by this change. Raw data from TTM and TTM-based DNSMON will remain available from the RIPE NCC upon request. We welcome your feedback. Please send any feedback you have to <romeo.zwart(a)ripe.net> directly, or alternatively send your comments to the DNS WG mailing list. Kind regards, Romeo Zwart

1 0

finalising the RIPE Documents on DNSMON and ccTLD service
by Jim Reid 07 Dec '15

07 Dec '15

There have been no further comments on the draft documents since the RIPE meeting in Bucharest. We can declare victory and get these published/adopted. Some minor tweaks were suggested when the drafts were originally circulated for comment. Romeo has taken account of these and will incorporate these into the final versions. My thanks to Romeo for his patience and hard work on these documents and to the WG.

1 0

New on RIPE Labs: DomainMON in RIPE Atlas
by Mirjam Kuehne 03 Dec '15

03 Dec '15

Dear colleagues, A few weeks ago we gave you a heads up about a new visualisation tool in RIPE Atlas called DomainMON, and we're pleased to announce that this is now available for all RIPE Atlas users with available credits. Please find more details on RIPE Labs: https://labs.ripe.net/Members/suzanne_taylor_muzzin/ripe-atlas-domainmon-is… Kind regards, Mirjam Kuehne RIPE NCC

1 0