- dns-wg - mailman.ripe.net

Apple's iCloud Private Relay Service
by Andrew Campling 19 Jul '21

19 Jul '21

You'll be aware that Apple announced its Private Relay service<https://developer.apple.com/videos/play/wwdc2021/10096.%C2%A0> at WWDC last month, using Oblivious DoH to provide an additional layer of privacy for DNS queries along with other privacy-related features. Tommy Pauly of Apply joined my weekly call last Monday to run through responses to a series of questions (copy attached for reference), which may be of interest to members of this group: you can access a recording of the call via this link<https://419.consulting/encrypted-dns/f/icloud-private-relay>. Andrew Regards Andrew Campling MBA MSc DipM FRSA FCIM MIoD Liveryman Director | 419 Consulting Ltd | Tel: +44 (0) 7710 303010 | E: Andrew.Campling(a)419.Consulting<mailto:Andrew.Campling@419.Consulting>| t: @Andrew_Campling This email contains information from 419 Consulting Ltd that might be privileged or confidential. And it's only meant for the person above. If that's not you, we're sorry - we must have sent it to you by mistake. Please email us to let us know, and don't copy or forward it to anyone else. Thanks. We monitor our email systems and may record all our emails. 419 Consulting Ltd Registered in England: No 11944258 [A picture containing clipartDescription automatically generated]

1 0

Blockchain Address Transparency with DNS
by Eduardo Duarte 12 Jul '21

12 Jul '21

Dear all, [Sorry for duplicate postings!] .PT as sponsor a work on using DNS to map Blockchains addresses and I would like to share the paper with the community. It follows in attach. If you have doubts or comments please ask that I will relay it to the relevant people. ;) Best regards, -- eduardo_sign Aviso de Confidencialidade/Disclaimer: Este e-mail foi escrito de acordo com o novo acordo ortográfico. Esta mensagem é exclusivamente destinada ao seu destinatário, podendo conter informação CONFIDENCIAL, cuja divulgação está expressamente vedada nos termos da lei. Caso tenha recepcionado indevidamente esta mensagem, solicitamos-lhe que nos comunique esse mesmo facto por esta via devendo apagar o seu conteúdo de imediato. This message is intended exclusively for its addressee. It may contain CONFIDENTIAL information protected by law. If this message has been received by error, please notify us via e-mail and delete it immediately. [ Antes de imprimir esta mensagem pense no ambiente. Before printing this message, think about environment ]

1 0

OARConline 35a Workshop, September 8th, Call for Contributions now open
by Brett Carr 05 Jul '21

05 Jul '21

OARConline 35a will be an online meeting on September 8th 2021 starting at 15:00 UTC. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Deployment: Managing DNS changes and propagation, release process, change management. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: Managing service capacity, failovers, disaster recovery. As it is an online workshop, we'd like to encourage brevity; presentations will be 10 or 20 minutes (including time for questions). **Workshop Milestones:** * 30 June 2021 - Submissions open via Indico * 20 July 2021 - Deadline for submission (23:59 UTC) * 27 July 2021 - Initial Contribution list published * 10 August 2021 - Full agenda published * 24 August 2021 - Deadline for slideset submission and Rehearsal * 08 September 2021 - OARConline 35a Workshop The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc35a> DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups at DNS-OARC. See the registration page for details. To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Additional information for speakers of OARConline 35a: * your talk will be broadcast live and recorded for future reference * your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * you will be expected to attend a rehearsal on August 24th. It would be very useful to have your slides (even if draft) ready for this. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> Jan Včelák, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Brett Carr Manager DNS Engineering Nominet UK

1 0

DNSSEC algorithm roll-over of all RIPE NCC zones
by Anand Buddhdev 30 Jun '21

30 Jun '21

Dear colleagues, During the RIPE 82 Meeting, we announced that we would soon roll the keys of all our DNSSEC-signed zones to a new algorithm, ECDSAP256SHA256, as recommended by RFC 8624. We are happy to announce that we are now ready to do this. On Tuesday, 15 June 2021, we will start the roll-over of both the Key Signing Keys (KSKs) and Zone Signing Keys (ZSKs) of our zones. The process will take several days to complete. We have performed algorithm roll-over previously, when we switched from RSASHA1 to RSASHA256. We wrote a RIPE Labs article about it, wherein we observed the need to perform this roll-over conservatively, in order to accommodate strict validators:  https://labs.ripe.net/author/anandb/dnssec-algorithm-roll-over/ Therefore, our Knot DNS signer will use the conservative approach described in section 4.1.4 of RFC 6781. This approach ensures that even strict validators can continue to validate our DNSSEC-signed responses during the roll-over. If you have any questions or concerns, please send an email to dns(a)ripe.net. Regards, Anand Buddhdev RIPE NCC

2 1

Sony Wins Pirate Site Blocking Order Against DNS-Resolver Quad9
by Stephane Bortzmeyer 21 Jun '21

21 Jun '21

I think it is the first time there is a court ruling specifically against a public DNS resolver? https://torrentfreak.com/sony-wins-pirate-site-blocking-order-against-dns-r… Note the reasoning (if some german-speaking person can confirm this is a fair summary?): > One of the arguments that Sony brought up in court was that Quad9 > already blocks various problematic sites voluntarily. This is indeed common in court: either you are neutral or you are not and, in the second case, you can no longer claim you are "just an intermediary". When you start filtering DNS answers, it is hard to resist pressures to add more filtering.

2 1

New on RIPE Labs: Fragmentation, Truncation, and Timeouts - Are Large DNS Messages Falling to Bits?
by Alun Davies 16 Jun '21

16 Jun '21

Dear colleagues, Large DNS responses over UDP can lead to fragmentation, truncation, and timeouts. But how much of a problem is this actually causing in the wild? Are large DNS messages falling to bits? In this new article now available on RIPE Labs, Giovane Moura and colleagues from SIDN Labs investigate: https://labs.ripe.net/author/giovane_moura/fragmentation-truncation-and-tim… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

The 10th Registration Operations Workshop (ROW#10) | June 8th, 2020 | 13:00 - 17:00 UTC
by Edward Lewis 28 May '21

28 May '21

The 10th Registration Operations Workshop (ROW#10) | June 8th, 2020 | 13:00 - 17:00 UTC ROW#10 will take place via Zoom Webinar platform on Tuesday, June 8th, 2021, 13:00 – 17:00 UTC. Additional time zones may be checked here<https://www.timeanddate.com/worldclock/fixedtime.html?msg=ROW#10&iso=202106…>. Those interested in attending are required to register<https://regiops.net/events/row10registration/> in order to receive the access information (meeting ID and password). For details regarding the agenda, check out Marc Blanchet’s [Viagenie] recent blog post<https://www.circleid.com/posts/20210526-10th-registration-operations-worksh…> or visit https://regiops.net<https://regiops.net/>. If you have any questions, please contact us at row(a)viagenie.ca<mailto:row@viagenie.ca>. We would like to thank our ROW Series Sponsors ICANN<https://www.icann.org/> and Verisign<https://www.verisign.com/> for their continued support. ----- Here are some special tips if this is your first time using Zoom or you wish to get more familiar with its web conferencing capabilities: • Download the Zoom application to your computer or mobile phone. You can do it at https://zoom.us/download. You will also be prompted to download and install Zoom when you click the link to join. You can also run Zoom from your web browser by navigating to join.zoom.us<http://join.zoom.us/> and entering the meeting number and passcode. • Want to try it out before June 8th? Join a test meeting at https://zoom.us/test anytime to familiarize yourself with Zoom. You can also access Zoom tutorials here: https://support.zoom.us/hc/en-us/articles/201362193-How-Do-I-Join-A-Meeting- • As an attendee, you will be muted. For questions and comments, please use the Q&A feature. The session moderator will address them to the speakers on the mike as time permits. Questions that cannot be answered due to time constraints, will be answered directly in the Q&A window or by email. • You do not have to use the Zoom web conferencing platform with video to participate. There is an option to call-in only. • We will be recording this webinar, including the chat, and making it available on our website 48h after the session. ----- We look forward to seeing you online! ROW Program Committee Stay tuned for further updates! Follow @ROW_by_Viagenie<https://twitter.com/ROW_by_Viagenie?ref_src=twsrc%5Etfw> ROW website: https://regiops.net<https://regiops.net/> Contact us: row(a)viagenie.ca<mailto:row@viagenie.ca> ROW mailing list: regiops(a)googlegroups.com<mailto:regiops@googlegroups.com> ROW series: co-sponsored by Verisign<https://www.verisign.com/> & ICANN<https://www.icann.org/>, organized by Viagenie<https://viagenie.ca/> (cross-posting to multiple lists - sorry for any duplicates)

1 0

RIPE 82 DNS working group agenda
by Shane Kerr 18 May '21

18 May '21

Dear DNS Colleages, Here is the agenda for the RIPE 82 meeting of the DNS working group. Cheers, -- Shane Wednesday, 19 May at 14:30 CET A. Administrivia - Agenda bashing - Approval of previous minutes B. RIPE NCC Update, Anand Buddhdev C. Deployment of CDS/CDNSKEY, Ondřej Caletka D. Resolver Centrality, João Damas & Geoff Huston E. Dear EU: Please Don't Ruin the Root at RIPE 82, Bert Hubert Z. Any other business

2 1

European Resolver Policy Update
by Andrew Campling 13 May '21

13 May '21

When I talked about the new European Resolver Policy<https://europeanresolverpolicy.com/> at the last DNS WG meeting<https://www.ripe.net/participate/ripe/wg/active-wg/dns/remote-sessions/remo…> on 21st April, I was asked which organisations supported the policy. We've just issued a press release<https://419.consulting/encrypted-dns/f/european-resolver-policy-endorsed> detailing the first organisations to confirm their support for the policy. They include, in alphabetical order, the following: * AdGuard * DNSFilter * Farsight Security * The Internet Watch Foundation * Open-Xchange * Quad9 * Whalebone * 419 Consulting I hope this is useful, feel free to get in touch directly if you have any questions. Andrew

1 0

Fwd: [cooperation-wg] Update on NIS 2: Proposed amendments by the Parliament alter scope on (root) DNS
by Mirjam Kuehne 11 May '21

11 May '21

Dear colleagues, Please see below. This might also be interesting to the DNS WG. Kind regards, Mirjam -------- Forwarded Message -------- Subject: [cooperation-wg] Update on NIS 2: Proposed amendments by the Parliament alter scope on (root) DNS Date: Fri, 7 May 2021 12:12:06 +0200 From: Marco Hogewoning <marcoh(a)ripe.net> Reply-To: Marco Hogewoning <marcoh(a)ripe.net> To: cooperation-wg <cooperation-wg(a)ripe.net> Dear colleagues, We'd like to inform you that some changes have been proposed to NIS 2 that would accommodate some of the concerns raised by the RIPE NCC and the RIPE community. As a quick recap: the European Commission proposed an update to the Network and Information Security Directive, commonly referred to as NIS 2, which would bring the DNS root servers into scope of the directive, resulting in regulatory oversight of the DNS root server operators. Following our response on the NIS 2 proposal in the public feedback process, we reached out to a number of parties involved in the legislative process, including some members of the European Parliament, drawing attention to our concerns. The ITRE committee, which is leading this dossier in the European Parliament, yesterday published its initial report listing a number of proposed amendments. We are happy to see that it has taken on board the concerns we and other community members have raised. In particular, the committee proposes amending the scope of the directive to include: "authoritative domain name resolution services as a service procurable by third-party entities”. We realise this leaves a substantial part of the DNS in scope; however, this change would address the concerns we raised in our response by removing from scope: - DNS root operations - Small and non-commercial operators, such as people running their own DNS servers We are pleased to see these amendments and appreciate the rapporteur, MEP Groothuis, addressing our concerns. The full report is available at: https://www.europarl.europa.eu/doceo/document/ITRE-PR-692602_EN.pdf (The relevant changes are on pages 6, 27 and 57.) As a next step, the ITRE committee is provisionally scheduled to discuss this report on 27 May. We will continue to track the legislative process and keep you informed about the progress. Regards, Marco Hogewoning Manager, Public Policy and Internet Governance RIPE NCC

4 4