- dns-wg - mailman.ripe.net

Re: Co-chair selection for the RIPE DNS working group
by Giuseppe Abate | Fiber Telecom 14 Oct '25

14 Oct '25

+1 for Antonio Regards *Giuseppe Abate* NOC Team Leader Phone +39 02 8994 1111 -- *FIBER TELECOM S.p.A.* · Via Caldera, 21 - 20153 Milano Italy · www.fibertelecom.com <https://www.fibertelecom.com/> · Phone +39 02 8994 1111 <https://www.youtube.com/channel/UCacxeJwRrZycr6atxCZqopw>PRIVACY <https://www.fibertelecom.com/en/privacy-policy.php> - GDPR - EU Regulation 2016/679

1 0

Should parents look for CDNSKEY or CDS, or both?
by Peter Thomassen 14 Oct '25

14 Oct '25

Dear DNS aficionados, At DNS OARC last week, a discussion emerged about a recommendation in IETF draft-ietf-dnsop-ds-automation, namely: Section 6.1: 2. Parents, independently of their preference for CDS or CDNSKEY, SHOULD require publication of both RRsets, and SHOULD NOT proceed with updating the DS RRset if one is found missing or inconsistent with the other. While this at first glance indeed may seem like a not-so-good idea, there are some arguments why the alternative may be an even worse idea. An analysis of the problem is given in Section 6.2, which for convenience I'm pasting below. It would be extremely helpful to learn what's the view of DNSOP participants on this matter, so you are invited :-) Several notes: a) The draft is only for new deployments of DS automation; it is not trying to create work for existing ones. b) The previous recommendation tells children to publish both; this one is about the parent-side enforcement. c) A misconception (to be clarified in the draft): the above does not prevent the parent from choosing a digest type that's not in CDS. It requires only that both RRsets exist and refer to the same keys, not that the parent uses the exact digest types for the DS RRset. Thanks! Peter Sheng & Thomassen Expires 9 March 2026 [Page 14] Internet-Draft DS Automation September 2025 ... 6.2. Analysis DS records can be generated from information provided either in DS format (CDS) or in DNSKEY format (CDNSKEY). While the format of CDS records is identical to that of DS records (so the record data be taken verbatim), generation of a DS record from CDNSKEY information involves computing a hash. Whether a Parent processes CDS or CDNSKEY records depends on their preference: * Conveying (and storing) CDNSKEY information allows the Parent to control the choice of hash algorithms. The Parent may then unilaterally regenerate DS records with a different choice of hash algorithm(s) whenever deemed appropriate. * Conveying CDS information allows the Child DNS operator to control the hash digest type used in DS records, enabling the Child DNS operator to deploy (for example) experimental hash digests and removing the need for registry-side changes when new digest types become available. The need to make a choice in the face of this dichotomy is not specific to DS automation: even when DNSSEC parameters are relayed to the Parent through conventional channels, the Parent has to make some choice about which format(s) to accept. Some registries have chosen to prefer DNSKEY-style input which seemingly comes with greater influence on the delegation's security properties (in particular, the DS hash digest type). It is noted that regardless of the choice of input format, the Parent cannot prevent the Child from following insecure cryptographic practices (such as insecure key storage, or using a key with insufficient entropy). Besides, as the DS format contains a field indicating the hash digest type, objectionable ones (such as those outlawed by [DS-IANA]) can still be rejected even when ingesting CDS records, by inspecting that field. The fact that more than one input type needs to be considered burdens both Child DNS operators and Parents with the need to consider how to handle this dichotomy. Until this is addressed in an industry-wide manner and one of these mechanisms is deprecated in favor of the other, both Child DNS operators and Parents implementing automated DS maintenance should act as to maximize interoperability: * As there exists no protocol for Child DNS Operators to discover a Parent's input format preference, it seems best to publish both CDNSKEY as well as CDS records, in line with [RFC7344], Section 5. The choice of hash digest type should follow current best practice [DS-IANA]. * Parents, independently of their input format preference, are advised to require publication of both CDS and CDNSKEY records, and to enforce consistency between them, as determined by matching CDS and CDNSKEY records using hash digest algorithms whose support is mandatory [DS-IANA]. (Consistency of CDS records with optional or unsupported hash digest types is not required.) Publishing the same information in two different formats is not ideal. Still, it is much less complex and costly than burdening the Child DNS operator with discovering each Parent's policy; also, it is very easily automated. Operators should ensure that published RRsets are consistent with each other. By rejecting the DS update if either RRset is found missing or inconsistent with the other, Child DNS operators are held responsible when publishing contradictory information. At the same time, Parents can retain whatever benefit their policy choice carries for them, while facilitating a later revision of that choice. This approach also simplifies possible future deprecation of one of the two formats, as no coordination or implementation changes would be needed on the child side.

1 0

DNS-WG Agenda at RIPE 91
by Moritz Müller 06 Oct '25

06 Oct '25

Dear all, The agenda for the DNS working group session on Thursday, the 23rd of October, from 11:00 till 12:30 (UTC +0300) during RIPE 91 is ready! The agenda is as follows: Welcome and announcement of the new co-chair Making LocalRoot a Best Current Practice Jim Reid TLD Resilience in the Light of Signature Validity Constraints Ulrich Wisser XoT in practice Dmytro Kohmanyuk DNS TTL Upper Limits in Practice Shane Kerr RIPE NCC DNS Update Anand Buddhdev A friendly reminder: We are still collection expressions of support (or opposition) for the new working group co-chair from the mailing list until Monday, 20 October 2025. See you all in Bucharest or online in two weeks! Cheers, Moritz, for the RIPE DNS working group co-chairs (Yevheniya, Willem and me)

1 0

Nominet DNS Fund
by Lizzie Griffiths 03 Oct '25

03 Oct '25

Hello, Nominet have launched a fund designed to support both the innovation and maintenance of open source DNS projects. We have identified your publication/newsletter as a valuable opportunity to help us reach our intended audience of applicants. We wondered whether you would consider posting some information on our behalf please. We have included some basic information below but please do let us know if you prefer a different format or need more from us. Applications are open to The Nominet DNS Fund, an initiative designed to support both the innovation and maintenance of open source projects that are vital to the internet’s infrastructure. If you or your team are working on projects that strengthen the backbone of the web, we invite you to apply for funding. Key Details * Primary goal: Fund and improve the security, long-term sustainability, and resilience of DNS open source projects. * Focus: Open source critical infrastructure components relevant to the development, deployment, and operation of the global DNS. * Funding available: £370,000 available in this round, with a maximum of £100k per applicant. * Key dates: applications open on 17th September and will close 26th October. The Nominet DNS Fund is committed to responsible, transparent support for the open source community and welcomes applications from a diverse range of contributors. Nominet operate the UK’s national domain name registry for the millions of individuals and businesses who rely on it every single day. As a public benefit company, we run .UK for the greater good, and work with our members to help bring the benefits of the internet to all. Learn more and apply here: https://nominet.uk/nominet-<https://nominet.uk/?page_id=71982>dns-fund/<https://nominet.uk/?page_id=71982> Please feel free to share this with anyone who might be interested! Lizzie Griffiths Digital Marketing Lead [cid:image001.png@01DC3444.A4561E40] Website<http://www.nominet.uk/> | Twitter<https://twitter.com/Nominet> | Facebook<https://www.facebook.com/nominet/> DD: +44 (0)7443 446701 E: lizzie.<mailto:email.here@nominet.uk>griffiths(a)nominet.uk<mailto:email.here@nominet.uk> Minerva House, Edmund Halley Road, Oxford Science Park, Oxford, OX4 4DQ, United Kingdom This message is intended exclusively for the individual(s) to whom it is addressed and may contain information that is privileged, or confidential. If you are not the addressee, you must not read, use or disclose the contents of this e-mail. If you receive this e-mail in error, please advise us immediately and delete the e-mail. Nominet UK has taken every reasonable precaution to ensure that any attachment to this e-mail has been swept for viruses. However, Nominet cannot accept liability for any damage sustained as a result of software viruses and would advise that you carry out your own virus checks before opening any attachment.

1 0

Co-chair selection for the RIPE DNS working group
by Willem Toorop 01 Sep '25

01 Sep '25

Dear All, This is a call for nominations or volunteers to co-chair the RIPE DNS working group. ************************************************************************************* *Please DO NOT reply to this message if you wish to propose a volunteer.* ************************************************************************************* Call for RIPE DNS Working Group Chair In accordance with the chair selection process we announce that the term of one of our co-chairs (Willem Toorop) will expire at the upcoming RIPE Meeting (RIPE 91, Bucharest) and we would like to invite volunteers, or nominations for someone to become a co-chair of the DNS working group. Anyone may volunteer, and anyone may be nominated by someone else (we will check with the person for acceptance). I (Willem) decided not to volunteer again for a second term to make space for others to try out this wonderful and rewarding and low-effort community position To do this, please send a mail to <dns-wg-chairs AT ripe.net> before end of Sunday 21 April 2024 (UTC). Again, please DO NOT send your volunteer/nomination to the DNS WG mailing but rather the dns-wg-chairs mail alias. It would be helpful for candidates to give some words as to why they think they ought to be a co-chair, what new ideas, or improvements they might bring, and so on. We will publish the list of volunteers, along with anything the volunteers wish to include with their nomination, to this mailing list on Monday 29 September 2025 Discussion and support (or opposition) for each candidate can then be offered on the list. At the DNS working group session at RIPE 91, Yevheniya and Moritz hope to announce consensus based on the mailing list discussion. Timeline * Monday, 18 August 2024 This call for volunteers posted to the dns-wg mail list * Sunday, 28 September 2025 Deadline for volunteers/nominations * Monday, 29 September 2025 List of candidates and call for support posted to the mail list * Monday, 20 October 2024 Deadline for showing support for candidates/volunteers on the mail list * Thursday, 15 May 2024 DNS WG session at RIPE 91 (still subject to change) References * The RIPE working group chair job description is included in ripe-692: https://www.ripe.net/publications/docs/ripe-692 * The DNS working group chair selection process is documented here: https://www.ripe.net/participate/ripe/wg/dns/dns-wg-chair-selection-process We have 3 co-chairs so the term is 3 years. * The current approach was announced on this mailing list on 2018-07-17: https://www.ripe.net/ripe/mail/archives/dns-wg/2018-July/003566.html As always, please feel free to reach out to any of the chairs directly, to us as a group at dns-wg-chairs AT ripe.net, or discuss this or any other any relevant topic on this mailing list. Willem Toorop for the RIPE DNS working group co-chairs (Yevheniya, Moritz and me)

1 2

RIPE 91 DNS-WG: Call for presentations
by Moritz Müller 01 Sep '25

01 Sep '25

Dear colleagues, It might still seem far away, but RIPE 91 in Bucharest is approaching. The RIPE 91 meeting will be held from 20th to 24th October 2025. Our working group meeting is currently scheduled for 23rd October at 11:00 am, but note that this may still change. This e-mail is our first official call for topics for the DNS working group session. From RIPE 91 onwards, all plenary and working group proposals can be submitted through the same system, Pretalx. Please submit your proposals by 15 September 2025 using the following link: https://ripe91.ripe.net/present/call-for-presentations/ Please pay special attention to the following fields: • Talk type: This field is not relevant to us. Select any option you like. Instead, make sure that you fill in the time you would need for your presentation including Q&A in the "Duration" field. • Track: Make sure that you select DNS • Duration: See "Talk type" above You can find more information on the Pretalx system here: https://ripe91.ripe.net/present/how-to-submit-a-talk/ As usual, both in-person and remote participation in the working group is possible. We plan to send out a first round of notifications beginning of September. Cheers, Moritz on behalf of the RIPE DNS Working Group co-chairs (Willem, Yevheniya and me)

2 1

ICANN Consultation: Functional Model for Root Server System Governance
by Florian Obser 28 Aug '25

28 Aug '25

Dear all, We recently shared an important update on the ICANN consultation on a proposed “Functional Model” for governance of the DNS root server system: https://mailman.ripe.net/archives/list/ripe-list@ripe.net/thread/H7H2BNMEWA… We think this is of particular interest to the DNS community and I encourage you to review the details and consider providing comments to ICANN via the Consultation Public Comment page. Best regards, Florian Obser RIPE NCC / k.root-servers.net

1 0

OARC 45 Call for Contributions
by Willem Toorop 28 Jul '25

28 Jul '25

This workshop will be a hybrid event. Date - 7-8 October 2025 Location - Stockholm, Sweden Time - Approx 10:00 CEST (08:00 UTC) - 17:00 CEST (15:00 UTC) Adjacent to Netnod Tech Meeting 2025 (9 October 2025) (https://www.netnod.se/netnod-tech-meeting-2025) Deadline for Submissions - 2025-07-29 23:59 UTC https://indico.dns-oarc.net/event/55/abstracts/ All DNS-related subjects and discussion topics are welcome although we're particularly keen to hear more about operational and security related experiences, best practices and practical advice; both for newcomers to the DNS arena and those who have been around for longer who want to learn more about new features and opportunities to improve resilience, security and privacy. (These topics we think will complement the usual high-quality data-based research submissions we always hope to receive!) If you have something interesting to share with the community that lies outside of the focus above, please don't be put off - if it's good, we'll be happy to include it. If you'd like to offer a talk, but are not quite sure what to pick, here's a non-exhaustive list of ideas: 1. *Operations & Deployment* * Configuration management, deployment processes, and interoperability experiences. * Tools, tips, and making effective use of DNS software features. 2. *Performance, Resilience & Scaling* * Provisioning, load-balancing, and planning for resilience. * DNS performance management, efficiency improvements, and metrics. * Monitoring infrastructure: log pipelines, analytics, and anomaly detection. 3. *Security, Privacy & Policy* 1. DoS attacks, DNS abuse, DNSSEC signing and validation. 2. Privacy considerations, for example: encrypted transport, qname minimization, data anonymization. 3. Relevant global and regional policies, legislation, and compliance. 4. *Research & Innovation* 1. Data-driven testing, measurement, and analysis. 2. New protocols, protocol extensions, and next-generation namespace management. 5. *Lessons & Learnings* 1. Outage experiences, recovery stories, and cautionary tales For further details please see https://www.dns-oarc.net/oarc45 Willem Toorop, for the DNS-OARC Programme Committee

1 1

Co-chair selection for the RIPE DNS working group
by Willem Toorop 22 May '25

22 May '25

Dear all, The deadline for volunteering or nominating someone for DNS working group co-chair is now over and we have received one submission in response to our call. We are overjoyed to announce that Yevheniya Nosyk volunteered for the position! Find below a few words from Yevheniya. ======================================================================== I am a cybersecurity researcher at KOR Labs, where I conduct large-scale Internet measurements with a particular focus on DNS. I obtained my Ph.D. in Cybersecurity from Université Grenoble Alpes in 2024. Over the past two years, I have presented my research at RIPE, OARC, and IETF meetings. I was awarded the IRTF Applied Networking Research Prize for my work on Extended DNS Errors. I also have experience serving on scientific conference program committees. If selected for this position, I would aim to bridge the academic and operational communities by encouraging researchers to attend RIPE meetings and present their work at the DNS WG. ======================================================================== Cheers and warm regards, Willem Toorop for the RIPE DNS working group co-chairs

3 2

RIPE 90 BoF: Authoritative Name Server BCPs
by Moritz Müller 08 May '25

08 May '25

Dear DNS-WG, We would like to inform you about a Birds of a Feather (BoF) session, discussing Authoritative Name Server BCPs at RIPE 90. The session will take place Thursday, 15 May 18:00 - 19:00 (UTC+1). Last year, the DNS Resolver Recommendations document (ripe-823) was published. Its purpose is to provide clear guidance and promote effective practices in DNS resolver operations. Such a document is still missing for authoritative name servers. In this Birds of a Feather session, we will organise a panel consisting of operators responsible for authoritative name servers at the root, TLDs and 2nd and lower level domain names. We will first discuss different aspects of TLD operations, including software choice, the use of anycast, monitoring, DNS over TLS, DNS Cookies and more. At the end of the session, we would like to get feedback from the panelists and the audience on whether there is also the need for a BCP for authoritative name server operations, if RIPE would be the right place for such a document, and if a task force should be formed. Our panelists will be: • Annand Buddhev (RIPE NCC) • Doris Hauser (nic.at) • Lars Johan Liman (Netnod) • Shane Kerr (NS1 - IBM) We hope to see you all there! — Moritz on behalf of the DNS-WG chairs

1 0