September 2026 - dns-wg - mailman.ripe.net

Reminder: Root KSK Rollover on 11 October 2026 – Check Your Trust Anchors
by Andres Pavez 24 Sep '26

24 Sep '26

Hi everyone, The next Root Zone Key Signing Key (KSK) rollover is scheduled for 11 October 2026. Operators of DNSSEC-validating resolvers should verify that KSK-2024 (Key Tag 38696) is present in their trust anchor configuration before the rollover. Information and resources, including technical guidance, FAQs, and the rollover timeline, are available on the 2026 Root KSK Rollover page: https://www.icann.org/resources/pages/ksk-rollover-en We encourage you to share questions, observations, or experiences before, during, and following the rollover on the KSK Rollover mailing list: https://lists.icann.org/postorius/lists/ksk-rollover.icann.org Thank you for your continued participation and support in helping ensure a smooth rollover. Best regards, -- Andres Pavez Cryptographic Key Manager

2 1

How safe are our domain names from US sanctions?
by Timo Hilbrink 16 Sep '26

16 Sep '26

Hi all, As we all know, the DNS infrastructure has been built to be decentralised and resilient, so that its functionality does not depend on a single continent, country or government. But what if your gTLD domain name can be wiped out of the DNS by a single government? This is exactly what happened to Autistici/Inventati (A/I), an Italian non-profit, volunteer-run service provider that caters to hundreds of activist groups around the world. They have operated using the autistici.org domain name for the past 25 years. On August 26, the Office of Foreign Assets Control (OFAC) at the US Department of the Treasury included them in their list of “Specially Designated Global Terrorists” (SDGT). On August 28, PIR, the US headquartered registry operator for the .org TLD, placed autistici.org on status severHold, effectively wiping it from the DNS. This all happened without A/I committing any crime, neither in Italy nor in the US, and without any prosecutor ever indicting them either for felonies or misdemeanors. Simply the fact they provided services to certain activist groups that may be labeled as controversial or extremist by some authorities, was enough to place the whole provider on the SDGT list. In this case it was PIR (created by ISOC) that acted on the sanctions imposed by OFAC, although PIR still hasn't officially released any statement about this. A lot of organisations with an .org domain name are now very concerned about the future of their domains, but .org is not the only large gTLD that is run by a US based registry operator, both .net and .com are operated by Verisign, which is also headquartered in the US. So we can not rule out that something similar could happen to other domains. As an example: Just over two weeks ago, the US Department of the Treasury has begun "Operation Economic Outcast: an unprecedented, whole-of-government, economic campaign against the Islamic Republic of Iran and its enablers. The Treasury is significantly expanding sanctions risk for those who continue to choose to do business with Iran." What if RIPE NCC would be classified as an organisation that provides services to sanctioned entities, could that mean that ripe.net gets put on serverHold? Should we still depend so heavily on US based gTLD registry operators? For more background on the A/I case, see: https://www.article19.org/resources/usa-terrorism-designation-has-global-co… https://keepitfree.ai/ https://www.inventati.org/ Timo

5 4

Re: How safe are our domain names from US sanctions?
by Joe Abley 15 Sep '26

15 Sep '26

On 15 Sep 2026, at 08:47, Named T. Relay via dns-wg <dns-wg(a)ripe.net> wrote: > For decentralization's sake, i make the suggestion to move one of > the three main TLD's (.net, .com, .org) under Europa's management. > This might distribute and improve legal stability of the DNS ecosystem. > (And if this is not possible, that is indicative of a problem with DNS!) I assume you are at least partially trolling, but no doubt there is an undercurrent of (understandable) community outrage that would like to imagine you were not. Problems abound at the intersection of jurisdiction and topology. Much like choosing a week for a global meeting that does not conflict with anybody's holiday, it is difficult to imagine a solution here that mitigates every theoretical problem. And if you could find such a unicorn on a Friday, chances are good it would not last through the weekend. I appreciate the DNS is often the default solution to every problem, but, really, not this one. This time the DNS is just a symptom. Joe

2 1

Call for Presentations (deadline approaching fast)
by Ulrich Wisser 07 Sep '26

07 Sep '26

Dear DNS working group, A short reminder that RIPE 93 will be held from 26 to 30 October 2026 in Sofia, Bulgaria. Our working group session is currently scheduled for 29 October at 11:00 local time, but please note that this may still change. This email is our official call for topics for the DNS Working Group session. Since RIPE 91, all plenary and working group proposals have been submitted through the same system, Pretalx. Please submit your proposals by 15 September 2026 using the following link: https://pretalx.ripe.net/ripe-93/cfp Alternatively, you may still send your proposals directly to us at <dns-wg-chairs AT ripe.net>. If you are using Pretalx, please pay special attention to the following fields: • Talk type: "Lightning talk" or "Talk" • Track: "DNS WG" • Duration: Time in minutes for the presentation and Q&A. This may differ from the default duration for the selected talk type. You can find more information about the Pretalx system here: https://ripe93.ripe.net/present/how-to-submit-a-proposal/ As usual, participation in the working group session is possible both in person and remotely. We plan to send out the first round of notifications at the end of September 2026. Cheers, RIPE DNS Working Group co-chairs (Marc, Ulrich and Yevheniya)

1 0