October 2025 - dns-wg - mailman.ripe.net

More Than 70% of DNS Root Queries Are Junk
by Hank Nussbacher 10 Nov '25

10 Nov '25

https://pulse.internetsociety.org/blog/more-than-70-of-dns-root-queries-are… Regards, Hank

19 33

Re: [Ext] Welcome to our new co-chair
by Ulrich Wisser 30 Oct '25

30 Oct '25

Thank you, for the warm welcome! I hope to get up-to-speed on all the policies and procedures soon to be able to help out at least a little bit. Kind regards /Ulrich On 2025-10-24, 19:01, "Moritz Müller via dns-wg" <dns-wg(a)ripe.net <mailto:dns-wg@ripe.net>> wrote: Hi all, We welcome Ulrich as our new co-chair! Many thanks again to Willem for his great work. And thanks to the DNS-WG for expressing their support for either of the two candidates and joining our meeting at RIPE 91. Cheers, Moritz, on behalf of the current DNS-WG co-chairs (Yevheniya and me)

1 0

Magic line of 2000 root servers was reached!
by Marco Davids (SIDN) 30 Oct '25

30 Oct '25

Worth noting: As of tonight, the magic line of 2000 root servers has been crossed: https://root-servers.org Congrats y'all! -- Marco Davids Research Engineer SIDN | Meander 501 | 6825 MD | Postbus 5022 | 6802 EA | ARNHEM T +31 (0)26 352 55 00 | www.sidnlabs.nl | X/Twitter: @marcodavids https://ipv6.camp/@marcodavids | Matrix: @marco:sidnlabs.nl Nostr: 11ed01ff277d94705c2931867b8d900d8bacce6f27aaf7440ce98bb50e02fb34

1 0

Welcome to our new co-chair
by Moritz Müller 24 Oct '25

24 Oct '25

Hi all, We welcome Ulrich as our new co-chair! Many thanks again to Willem for his great work. And thanks to the DNS-WG for expressing their support for either of the two candidates and joining our meeting at RIPE 91. Cheers, Moritz, on behalf of the current DNS-WG co-chairs (Yevheniya and me)

1 0

Co-chair selection process
by Moritz Müller 17 Oct '25

17 Oct '25

Dear DNS-WG, This is a friendly reminder that the DNS WG Chair Selection Process is indeed a selection process. As the serving DNS-WG co-chairs we will not count votes, but we will judge whether we have working group consensus for one of the candidates. We will base our judgement on the support expressed by members of the RIPE community. Please feel free to raise any questions or concerns here or by sending a direct mail to the DNS-WG co-chairs. Some more details on the process here: https://www.ripe.net/community/wg/active-wg/dns/dns-wg-chair-selection-proc… Cheers, Moritz, for the RIPE DNS working group co-chairs (Willem, Yevheniya and me)

3 3

Co-chair support for Antonio Prado
by Pasquale Troccoli | TSI 17 Oct '25

17 Oct '25

I support Antonio Prado as a RIPE DNS-wg co-chair [signature_704674138] Troccoli Sistemi Integrati Tel.: +39 0500980378 P.IVA: 01304240771

1 0

Co-chair selection for the RIPE DNS working group
by Yevheniya Nosyk 16 Oct '25

16 Oct '25

Dear colleagues, I am glad to announce that we have 2 candidates for the co-chair position that will become vacant at RIPE 91. We will now collect expressions of support (or opposition) from the mailing list until Monday, 20 October 2025, and will announce the results on Thursday, 23 October 2025 during the DNS working group session at the RIPE 91. Our candidates are, in the order received: ***************************************** Name: Antonio Prado Nominated by: self-nomination Statement of Antonio: I would like to put my name forward as a volunteer for the position of co-chair of the RIPE DNS Working Group. I have been active in the RIPE community for several years, serving on the RIPE Programme Committee since 2018 and contributing regularly with talks on DNS, BGP, and Internet governance. My professional background is in Internet infrastructure, where I work closely with independent ISPs and research institutions, with a focus on DNS operations, security, and resilience. In addition to my operational work, I have written both academic and popular articles, as well as books – among them "BGP from Theory to Practice", which I co-authored. These activities reflect my ongoing interest in making complex technical topics accessible to different audiences, something I believe is important also in the context of a working group. If selected as co-chair, I would like to continue the WG’s tradition of being a space for both deep technical exchange and open community dialogue. In particular, I would focus on: - fostering participation from operators of all sizes, especially smaller ISPs that often remain underrepresented; - strengthening the link between DNS operations and broader topics such as security, resilience, and regulatory developments; - supporting collaboration across different communities and helping to bring new contributors into the WG. I see this role not only as a way to give back to the RIPE community, but also as an opportunity to help ensure the DNS WG remains a relevant and inclusive forum for the years to come. ***************************************** Name: Ulrich Wisser Nominated by: David Huberman Statement of Ulrich: Currently I work as technical engagement manager Europe for ICANN. Before that I have worked at .se for 15 years as developer and DNS expert where I among other things implemented DNSSEC in all production systems. I have served as co-chair for the Centr-Tech working group, have been on the DNS-OARC program committee and still organize the tech track of the Nordic Domain Days. In my spare time I read sci-fi, dabble with home-automation and I throw people (I am a licensed judo instructor). ***************************************** Best regards, Yevheniya, for the RIPE DNS working group co-chairs (Willem, Moritz and me)

15 16

DNS co-chair
by Lara Giovannozzi 16 Oct '25

16 Oct '25

I support Antonio as a RIPE DNS-wg co-chair -- Laragio

1 0

I supporti Antonio
by Nicola Pasin 15 Oct '25

15 Oct '25

I support Antonio as a RIPE DNS-wg co-chair Best Regards Cordiali Saluti Nicola Pasin Boxxapps Srl -- * * *Viale della Stazione, 2 - 30020 Marcon (VE) - Pec: boxxapps(a)legalmail.it <mailto:boxxapps@legalmail.it> -** Email: info(a)boxxapps.com <mailto:info@boxxapps.com> - **Tel. 0413090915 - *www.boxxapps.com* <https://www.boxxapps.com/>* *Il contenuto di questa e-mail inclusi i suoi allegati è riservato e fornito solo a scopo confidenziale e informativo al destinatario o destinatari di posta elettronica. La presente comunicazione non costituisce in alcun caso un'offerta o un'accettazione legalmente vincolante da parte di Boxxapps S.r.l. e non costituisce nessun impegno da parte della medesima azienda. Si informa chi legge il presente avviso – se non è l’effettivo destinatario o se la presente comunicazione è pervenuta per errore – che è proibito leggere, copiare, usare o diffondere il contenuto di questa mail e degli eventuali documenti allegati senza autorizzazione ai sensi dell'art. 616 del Codice Penale (Violazione, sottrazione e soppressione di corrispondenza) e ai sensi del Regolamento Europeo (UE) 2016/679 del Parlamento Europeo relativo alla protezione delle persone fisiche con riguardo al trattamento dei dati personali, nonché, del D.Lgs. 196/2003 così come modificato dal D.Lgs. 101/2018. Si comunica che il Vostro indirizzo mail è in nostro possesso in quanto da Voi fornitaci tramite comunicazione scritta, telefonica, telematica o direttamente oralmente e la sicurezza del suo utilizzo all’interno della nostra organizzazione è garantito dai nostri processi informativi e procedurali conformi alle norme che prevedono l’applicazione di adeguate misure di sicurezza tecniche ed organizzative costantemente aggiornate. Le comunicazioni o i documenti inviati alla presente casella mail potrebbero essere visti da soggetti appartenenti alla nostra organizzazione per sole finalità inerenti all’attività aziendale o per garantire la sicurezza informatica dei nostri sistemi, pertanto non è garantita la totale riservatezza. Nel caso in cui abbiate ricevuto questo messaggio per errore, Vi preghiamo di comunicarcelo e di distruggere immediatamente il documento senza farne copia.***

1 0

I support Antonio as a RIPE DNS-wg co-chair
by Rosario Tarantino 15 Oct '25

15 Oct '25

3 2

DNS co chair
by Marco Neroni 15 Oct '25

15 Oct '25

I support Antonio as a RIPE DNS-wg co-chair KR Marco Neroni

2 1

Co-chair: I support Antonio
by Arturo BIANCHI 14 Oct '25

14 Oct '25

Hi, *I support Antonio Prado as a RIPE DNS-wg co-chair!* Looking forward to meeting you all next week in Bucharest ;-) 73, Arturo @ RINUX.

1 0

I support Antonio as a RIPE DNS-wg co-chair
by Roberto Chines 14 Oct '25

14 Oct '25

-- Roberto

1 0

Support for Antonio Prado
by Natale Tarantino 14 Oct '25

14 Oct '25

I support Antonio as a RIPE DNS-wg co-chair

1 0

Support for Antonio Prado
by Matteo Battaglia 14 Oct '25

14 Oct '25

I support Antonio as a RIPE DNS-wg co-chair

1 0

support for Antonio Prado
by Salvatore Patti 14 Oct '25

14 Oct '25

+1 for Antonio

1 0

support for Antonio Prado
by Victor Bolaños Guerra 14 Oct '25

14 Oct '25

+1 for Antonio -- Víctor Bolaños Training Manager & Consultant +34 911 88 03 66 +34 605 75 90 75 <https://www.linkedin.com/in/victorbguerra/> <https://telegram.me/vitokosk8> fibercli.com lo0.es <https://www.lo0.es/> Este mensaje va dirigido, de manera exclusiva, a su destinatario y puede contener información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por Ley. En caso de haber recibido este mensaje por error, le rogamos que de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley. En aras del cumplimiento del Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, puede ejercer los derechos de acceso, rectificación, cancelación, limitación, oposición y portabilidad de manera gratuita mediante correo electrónico a: lopd(a)fibercli.com

1 0

support for Antonio Prado
by Sandro Facondini 14 Oct '25

14 Oct '25

I support Antonio Prado as a RIPE DNS-wg co-chair, thank you! -- Sandro Facondini CTO TeleneT RSM AS196874

1 0

Re: Co-chair selection for the RIPE DNS working group
by Giuseppe Abate | Fiber Telecom 14 Oct '25

14 Oct '25

+1 for Antonio Regards *Giuseppe Abate* NOC Team Leader Phone +39 02 8994 1111 -- *FIBER TELECOM S.p.A.* · Via Caldera, 21 - 20153 Milano Italy · www.fibertelecom.com <https://www.fibertelecom.com/> · Phone +39 02 8994 1111 <https://www.youtube.com/channel/UCacxeJwRrZycr6atxCZqopw>PRIVACY <https://www.fibertelecom.com/en/privacy-policy.php> - GDPR - EU Regulation 2016/679

1 0

Should parents look for CDNSKEY or CDS, or both?
by Peter Thomassen 14 Oct '25

14 Oct '25

Dear DNS aficionados, At DNS OARC last week, a discussion emerged about a recommendation in IETF draft-ietf-dnsop-ds-automation, namely: Section 6.1: 2. Parents, independently of their preference for CDS or CDNSKEY, SHOULD require publication of both RRsets, and SHOULD NOT proceed with updating the DS RRset if one is found missing or inconsistent with the other. While this at first glance indeed may seem like a not-so-good idea, there are some arguments why the alternative may be an even worse idea. An analysis of the problem is given in Section 6.2, which for convenience I'm pasting below. It would be extremely helpful to learn what's the view of DNSOP participants on this matter, so you are invited :-) Several notes: a) The draft is only for new deployments of DS automation; it is not trying to create work for existing ones. b) The previous recommendation tells children to publish both; this one is about the parent-side enforcement. c) A misconception (to be clarified in the draft): the above does not prevent the parent from choosing a digest type that's not in CDS. It requires only that both RRsets exist and refer to the same keys, not that the parent uses the exact digest types for the DS RRset. Thanks! Peter Sheng & Thomassen Expires 9 March 2026 [Page 14] Internet-Draft DS Automation September 2025 ... 6.2. Analysis DS records can be generated from information provided either in DS format (CDS) or in DNSKEY format (CDNSKEY). While the format of CDS records is identical to that of DS records (so the record data be taken verbatim), generation of a DS record from CDNSKEY information involves computing a hash. Whether a Parent processes CDS or CDNSKEY records depends on their preference: * Conveying (and storing) CDNSKEY information allows the Parent to control the choice of hash algorithms. The Parent may then unilaterally regenerate DS records with a different choice of hash algorithm(s) whenever deemed appropriate. * Conveying CDS information allows the Child DNS operator to control the hash digest type used in DS records, enabling the Child DNS operator to deploy (for example) experimental hash digests and removing the need for registry-side changes when new digest types become available. The need to make a choice in the face of this dichotomy is not specific to DS automation: even when DNSSEC parameters are relayed to the Parent through conventional channels, the Parent has to make some choice about which format(s) to accept. Some registries have chosen to prefer DNSKEY-style input which seemingly comes with greater influence on the delegation's security properties (in particular, the DS hash digest type). It is noted that regardless of the choice of input format, the Parent cannot prevent the Child from following insecure cryptographic practices (such as insecure key storage, or using a key with insufficient entropy). Besides, as the DS format contains a field indicating the hash digest type, objectionable ones (such as those outlawed by [DS-IANA]) can still be rejected even when ingesting CDS records, by inspecting that field. The fact that more than one input type needs to be considered burdens both Child DNS operators and Parents with the need to consider how to handle this dichotomy. Until this is addressed in an industry-wide manner and one of these mechanisms is deprecated in favor of the other, both Child DNS operators and Parents implementing automated DS maintenance should act as to maximize interoperability: * As there exists no protocol for Child DNS Operators to discover a Parent's input format preference, it seems best to publish both CDNSKEY as well as CDS records, in line with [RFC7344], Section 5. The choice of hash digest type should follow current best practice [DS-IANA]. * Parents, independently of their input format preference, are advised to require publication of both CDS and CDNSKEY records, and to enforce consistency between them, as determined by matching CDS and CDNSKEY records using hash digest algorithms whose support is mandatory [DS-IANA]. (Consistency of CDS records with optional or unsupported hash digest types is not required.) Publishing the same information in two different formats is not ideal. Still, it is much less complex and costly than burdening the Child DNS operator with discovering each Parent's policy; also, it is very easily automated. Operators should ensure that published RRsets are consistent with each other. By rejecting the DS update if either RRset is found missing or inconsistent with the other, Child DNS operators are held responsible when publishing contradictory information. At the same time, Parents can retain whatever benefit their policy choice carries for them, while facilitating a later revision of that choice. This approach also simplifies possible future deprecation of one of the two formats, as no coordination or implementation changes would be needed on the child side.

1 0

DNS-WG Agenda at RIPE 91
by Moritz Müller 06 Oct '25

06 Oct '25

Dear all, The agenda for the DNS working group session on Thursday, the 23rd of October, from 11:00 till 12:30 (UTC +0300) during RIPE 91 is ready! The agenda is as follows: Welcome and announcement of the new co-chair Making LocalRoot a Best Current Practice Jim Reid TLD Resilience in the Light of Signature Validity Constraints Ulrich Wisser XoT in practice Dmytro Kohmanyuk DNS TTL Upper Limits in Practice Shane Kerr RIPE NCC DNS Update Anand Buddhdev A friendly reminder: We are still collection expressions of support (or opposition) for the new working group co-chair from the mailing list until Monday, 20 October 2025. See you all in Bucharest or online in two weeks! Cheers, Moritz, for the RIPE DNS working group co-chairs (Yevheniya, Willem and me)

1 0

Nominet DNS Fund
by Lizzie Griffiths 03 Oct '25

03 Oct '25

Hello, Nominet have launched a fund designed to support both the innovation and maintenance of open source DNS projects. We have identified your publication/newsletter as a valuable opportunity to help us reach our intended audience of applicants. We wondered whether you would consider posting some information on our behalf please. We have included some basic information below but please do let us know if you prefer a different format or need more from us. Applications are open to The Nominet DNS Fund, an initiative designed to support both the innovation and maintenance of open source projects that are vital to the internet’s infrastructure. If you or your team are working on projects that strengthen the backbone of the web, we invite you to apply for funding. Key Details * Primary goal: Fund and improve the security, long-term sustainability, and resilience of DNS open source projects. * Focus: Open source critical infrastructure components relevant to the development, deployment, and operation of the global DNS. * Funding available: £370,000 available in this round, with a maximum of £100k per applicant. * Key dates: applications open on 17th September and will close 26th October. The Nominet DNS Fund is committed to responsible, transparent support for the open source community and welcomes applications from a diverse range of contributors. Nominet operate the UK’s national domain name registry for the millions of individuals and businesses who rely on it every single day. As a public benefit company, we run .UK for the greater good, and work with our members to help bring the benefits of the internet to all. Learn more and apply here: https://nominet.uk/nominet-<https://nominet.uk/?page_id=71982>dns-fund/<https://nominet.uk/?page_id=71982> Please feel free to share this with anyone who might be interested! Lizzie Griffiths Digital Marketing Lead [cid:image001.png@01DC3444.A4561E40] Website<http://www.nominet.uk/> | Twitter<https://twitter.com/Nominet> | Facebook<https://www.facebook.com/nominet/> DD: +44 (0)7443 446701 E: lizzie.<mailto:email.here@nominet.uk>griffiths(a)nominet.uk<mailto:email.here@nominet.uk> Minerva House, Edmund Halley Road, Oxford Science Park, Oxford, OX4 4DQ, United Kingdom This message is intended exclusively for the individual(s) to whom it is addressed and may contain information that is privileged, or confidential. If you are not the addressee, you must not read, use or disclose the contents of this e-mail. If you receive this e-mail in error, please advise us immediately and delete the e-mail. Nominet UK has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, Nominet cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.

1 0