- dns-wg - mailman.ripe.net

Resolve DNS Queries Based on Source IPs in BIND (NEED ADVISE)
by Md. abdullah Al naser 19 Nov '19

19 Nov '19

Hi everyone, I hope you all are fine. I am new in the mailing list and looking for an advise. If this mailing-list is not suitable for my below query then please pardon me. I am stuck in a situation and looking for a solution. My scenario is like below. I want to block some websites for my all users. For example:www.abc.comwww.xyz.cometc I did it using Response Policy Zone (RPZ) in BIND. response-policy {zone "rpz";};rrset-order { order cyclic; }; zone "rpz" { type master; allow-query { any; }; file "/etc/bind/rpz.db"; }; In my RPZ zone file I created CNAME entries for above mentioned FQDNs which have been pointed to discard.websites.com www.abc.com IN CNAME discard.websites.com.;www.xyz.com IN CNAME discard.websites.com.; And later on, in websites.com zone file (which is another fake zone) I created an A record for discard.websites.com which has been pointed to 192.168.127.127 (a fake IP). discard IN A 192.168.127.127; In this way all the dns requests from my all users for above mentioned sites are resolved to 192.168.127.127 and the real websites are unreachable. (N.B. I am not worry about the situation when users change their DNS IP to any open resolver and can access the websites.) Everything was going fine. By this time another requirement came into the picture. Now I need to block the mentioned websites for some specific users (based on source IP). So in my RPZ configuration I specified the users source IP block like below. zone "rpz" { type master; allow-query { 192.168.10.0/24; }; file "/etc/bind/rpz.db"; }; At this point the dns queries from the specified block 192.168.10.0/24 are resolved to my fake ip and all other requests from rest of IP blocks are dropped (as expected as per configuration). But I want to do like this, the dns queries from 192.168.10.0/24 blocks will be matched with RPZ zone and other requests from rest of IPs will bypass the RPZ configuration and will match my general "allow-query {any;}" statement mentioned in named.conf file. Will the logic work as I stated above?? Any comments from the experts will be great for me. (N.B. I came to know that, resolving different IP based on different source can be possible in KNOT DNS, but I would be happy to do it in BIND (if possible). Thanks & Regards, Md. Abdullah Al NaserDhaka, Bangladesh

2 1

New on RIPE Labs: Analysing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web
by Mirjam Kuehne 28 Oct '19

28 Oct '19

Dear colleagues, For those of you who missed Austin Hounsel's presentation at RIPE 79, here is his article on RIPE Labs: Analysing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web https://labs.ripe.net/Members/austin_hounsel/analysing-the-costs-and-benefi… Kind regards, Mirjam Kühne RIPE NCC

1 0

Draft minutes from the DNS working group at RIPE 78
by Shane Kerr 18 Oct '19

18 Oct '19

DNS Colleagues, Draft minutes from the DNS working group at RIPE 78 are available here: https://www.ripe.net/participate/ripe/wg/dns/minutes/dns-working-group-minu… Please send any corrections to the DNS working group chairs at <dns-wg-chairs(a)ripe.net>. Cheers, -- Dave, João, and Shane RIPE DNS Working Group Chairs

4 3

FOSDEM 2020 DNS Developer Room Call for Participation
by Pieter Lexis 16 Oct '19

16 Oct '19

Hello DNS WG! tl;dr Please consider submitting a presentation for the DNS devroom at FOSDEM 2020. More details: Every year, developers from all over Europe (and some from farther away) meet in Brussels to discuss Open Source software and many other topics. After a successful and packed DNS devroom (track) at FOSDEM 2018 and 2019, we are happy to announce a half-day DNS devroom at FOSDEM 2020. As with the last years, we hope to host talks anywhere from hardcore protocol stuff, to practical sessions for programmers that are not directly involved with DNS but may have to deal with DNS in their day to day coding or system administrators responsible for DNS infrastructure. We have been allotted a room on Saturday 1 February 2020. We expect to schedule 30 minutes per talk, including questions, but if you need more or less time, we can discuss this. If you have something you’d like to share with your fellow developers, please head to pentabarf at https://penta.fosdem.org/submission/FOSDEM20. Examples of topics are measuring, monitoring, DNS libraries, anecdotes on how you’ve (ab)used the DNS, and group discussions of upcoming technologies. Here’s the 2019 schedule, for your inspiration: https://archive.fosdem.org/2019/schedule/track/dns/ . The deadline for submission is December 1st 2019. If you have a FOSDEM pentabarf account from a previous year, please use that account. Reach out to dns-devroom-manager(a)fosdem.org if you run into any trouble. See you there! Cheers, The FOSDEM 2020 DNS Devroom organizers P.S. Apologies to those receiving multiple copies of these emails. -- Pieter Lexis PowerDNS.COM BV -- https://www.powerdns.com

1 0

Call for Presentations: 32nd DNS-OARC Workshop, San Francisco, CA, Feb 08 2020
by Dave Knight 12 Oct '19

12 Oct '19

Colleagues, The 32nd DNS-OARC Workshop will take place at the Hyatt Regency San Francisco in San Francisco, California, USA on February 8th 2020. It is co-located with and will take place right before NANOG 78 (Feb 10th to Feb 12th 2020). The Workshop's Program Committee is now requesting proposals for presentations. All DNS-related subjects are welcome. Workshop Milestones: • 28 Sep 2019 - Submissions open via Indico • 07 Dec 2019 - Deadline for submission (23:59 PT) • 05 Sep 2019 - Initial Contribution list published • 03 Jan 2020 - Full agenda published • 24 Jan 2020 - Deadline for slideset submission • 08 Feb 2020 - Workshop Details for presentation submission are published here: <https://indico.dns-oarc.net/event/33/call-for-abstracts/> The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. If you have questions or concerns you can contact the Programme Committee via submissions(a)dns-oarc.net OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings. Dave, for the DNS-OARC Programme Committee

1 0

RIPE 79 DNS working group agenda, v3
by Shane Kerr 06 Oct '19

06 Oct '19

Colleagues, Here's an updated updated agenda for DNS working group session at RIPE 79 in Rotterdam. We're meeting on Wednesday 16 October from 09:00 to 10:30. 1. Administrivia 5 minutes 2. Benchmarking and Optimizing DNS resolvers on the ISP level by Petr Špaček 20 minutes 3. Challenges and Successes of DNSSEC Signing an F5 BigIP DNS Hosted Zone by Neda Kianpour and Tyler Shaw 10 minutes 4. Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web by Austin H. Hounsel 20 minutes 5. RIPE NCC DNS Report by Florian Obser 10 minutes 6. The Resolvers We Use by Geoff Huston 15 minutes 7. XFR-over-TLS - Making Zone Transfers Private by Allison Mankin 10 minutes X. AOB - EDDI (https://www.encrypted-dns.org) (Jim Reid) See you in 10 days, -- The RIPE DNS Working Group Chairs Dave, João, and Shane

1 0

RIPE 79 DNS working group agenda, v2
by Shane Kerr 06 Oct '19

06 Oct '19

Colleagues, Here's an updated agenda for DNS working group session at RIPE 79 in Rotterdam. We're meeting on Wednesday 16 October from 09:00 to 10:30. 1. Administrivia 5 minutes 2. Benchmarking and Optimizing DNS resolvers on the ISP level by Petr Špaček 20 minutes 3. XFR-over-TLS - Making Zone Transfers Private by Allison Mankin 10 minutes 4. Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web by Austin H. Hounsel 20 minutes 5. RIPE NCC DNS Report by Florian Obser 10 minutes 6. The Resolvers We Use by Geoff Huston 15 minutes 7. Challenges and Successes of DNSSEC Signing an F5 BigIP DNS Hosted Zone by Neda Kianpour and Tyler Shaw 10 minutes X. AOB - EDDI (https://www.encrypted-dns.org) (Jim Reid) See you in 10 days, -- The RIPE DNS Working Group Chairs Dave, João, and Shane

1 0

New on RIPE Labs: Centralised DoH is bad for Privacy, in 2019 and beyond
by Mirjam Kuehne 04 Oct '19

04 Oct '19

Dear colleagues, Bert Hubert wrote an interesting article about centralised DNS over HTTPS (DoH) and why it is bad for privacy: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privac… Kind regards, Mirjam Kühne RIPE NCC

1 0

Volunteer to co-chair the DNS wg
by Dave Knight 01 Oct '19

01 Oct '19

Colleagues, The nomination period for the RIPE DNS working group chair selection finished yesterday. We received just one nomination, from Shane Kerr: > From: Shane Kerr <shane(a)time-travellers.org> > Subject: [dns-wg-chair] Consideration for a second 3 year term > Date: September 29, 2019 at 3:21:28 PM EDT > To: dns-wg-chairs(a)ripe.net > > > Colleagues, > > Please consider me for a second 3-year term as a co-chair of the RIPE DNS working group. > > I think that the working group has had interesting and helpful presentations and discussions during my time as co-chair, due in part to the work of my co-chairs and myself on organizing and hosting sessions, as well as overseeing the mailing list. > > If selected again you have my commitment for the next 3-years. > > As always, yours in DNS, > > -- > Shane Please offer whatever support (or opposition) you have for Shane on the list. Thank you Shane for volunteering! dave

9 8

New on RIPE Labs: How to Choose DNS TTL Values
by Mirjam Kuehne 27 Sep '19

27 Sep '19

Dear colleagues, There is no consensus on how to choose DNS time-to-live (TTL) values for domain names. Yet, TTLs are incredibly important, given that they indirectly control how long resolvers cache records, directly influencing user experience. Read more in this new article by Giovane Moura on RIPE Labs: https://labs.ripe.net/Members/giovane_moura/dns-ttl-values-what-value-is-th… Kind regards, Mirjam Kühne RIPE NCC

1 0