- dns-wg - mailman.ripe.net

Announcement - DNS flag day on 2019-02-01
by Petr Špaček 14 Jun '18

14 Jun '18

Dear DNS operators, you might be interested in information about "DNS flag day" coordinated by open-source DNS vendors and is planned for 2019-02-01 (February 1st 2019). Further information can be found on https://dnsflagday.net/ Please post comments related to content of the web site or similar as Github issues: https://github.com/dns-violations/dnsflagday I hope you find the information useful. -- Petr Špaček @ CZ.NIC

3 2

Re: [dns-wg] [dns-operations] Announcement - DNS flag day on 2019-02-01
by Florian Weimer 14 Jun '18

14 Jun '18

* Mark Andrews: >> On 14 Jun 2018, at 6:51 am, Florian Weimer <fw(a)deneb.enyo.de> wrote: >> >> * Petr Špaček: >> >>> you might be interested in information about "DNS flag day" coordinated >>> by open-source DNS vendors and is planned for 2019-02-01 >>> (February 1st 2019). >>> >>> Further information can be found on >>> https://dnsflagday.net/ >> >> Is there still no reduction of EDNS buffer size to around 1200 bytes? >> Isn't it time after ten years to address that particular >> vulnerability? > > If you are talking about fragmentation reassembly attacks you need to > use something with a cryptographic hash independent of EDNS. Or you can avoid fragmentation in the first place, which includes ignoring ICMP Fragmentation Needed But DF Bit Set messages. Unbound does that if you tell it to use it a buffer size which is sufficiently small. Theoretically, even with a 1200-byte EDNS buffer size, there could be IPv4 network paths which trigger fragmentation, but those will be unusual. Another benefit of this change is that many of the ENDS-related problems go away.

1 0

New on RIPE Labs: Dissecting DNS Defenses During DDoS Attacks
by Mirjam Kuehne 31 May '18

31 May '18

Dear colleagues, Please read this new article by Giovane Moura on RIPE Labs: Dissecting DNS Defenses During DDoS Attacks https://labs.ripe.net/Members/giovane_moura/dissecting-dns-defenses-during-… Kind regards, Mirjam Kühne RIPE NCC

1 0

Announcement - Joint CENTR-Tech / DNS-OARC Workshop, Amsterdam, NL, 13th/14th October 2018
by Anand Buddhdev 22 May '18

22 May '18

[with apologies to those who see this on multiple lists] The 29th DNS-OARC Workshop will be a joint workshop combined with CENTR-Tech and will take place at the Hotel Okura, Amsterdam, Netherlands, on October 13th and 14th 2018. Workshop Milestones: 01 May 2018 - Workshop Announcement 01 Jun 2018 - Submissions and Registrations open via Indico 13 Jul 2018 - Deadline for submission 17 Aug 2018 - Contribution list published 14 Sep 2018 - Full agenda published 06 Oct 2018 - Deadline for slideset submission 13 Oct 2018 - Workshop Anand Buddhdev, on behalf of the joint Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor.

1 0

New on RIPE Labs: Securing DNS Across all of my Devices
by Mirjam Kuehne 17 May '18

17 May '18

Dear colleagues, Please find this new article by Scott Helme on RIPE Labs in which he describes how he is securing the DNS across all of his devices with Pi-Hole + DNS-over-HTTPS + 1.1.1.1: https://labs.ripe.net/Members/scott_helme/securing-dns-across-all-of-my-dev… Kind regards, Mirjam Kühne RIPE NCC

3 2

Revised Draft agenda DNS WG @ RIPE 76
by Joao Damas 03 May '18

03 May '18

Dear all, Here is the *revised* draft agenda and meeting information for the DNS Working Group at the upcoming RIPE 76 meeting in Marseilles (you have already registered, right?) DNS WG at RIPE 76 Slots: Wednesday 16th: 9:00-10:30 Wednesday 16th: 14:00-15:30 Agenda: Administrivia (5 min) Petr Spacek (CZ.NIC): NSEC aggressive caching measurements (30 min) Joao Damas + Geoff Huston (APNIC): Measuring ATR (30 min) Baptiste Jonglez (IMAG): High-performance DNS over TCP (30 min) Moritz Muller (SIDN): DNSSEC rollovers (30 min) RIPE NCC: (15 min) - Colin Petrie(RIPE NCC): Deploying DNS over TLS for the RIPE Meeting - Anand Buddhev: Status report, DNS @ the RIPE NCC Vicky RIsk (ISC): A survey on DNS Privacy(15 min) Sara Dickinson (Sinodun): ‘Latest measurements on DNS Privacy (15 min) Willem Toroop (NLNetLabs): Sunrise DNS-over-TLS! Sunset DNSSEC? - Who needs reasons, when you've got hero?" (20 min) AOB(0-5 min) See you all soon Joao Damas DNS-WG co-chair

1 0

Deletion of ns-v6.ripe.net
by Anand Buddhdev 25 Apr '18

25 Apr '18

Dear colleagues, The RIPE NCC provides secondary DNS for some reverse DNS zones using a server called ns.ripe.net. In the early days of IPv6, this server was also given another name, ns-v6.ripe.net, and some users used this name in their IPv6 reverse DNS zones. Last year, we contacted these users and asked them to switch to the name ns.ripe.net instead. This makes the RIPE NCC's pre-delegation checks and provisioning system simpler. Now that the name ns-v6.ripe.net is no longer in use by anyone, we are going to delete it from the ripe.net zone. We will do this on Thursday, 26 April. If you have any questions or concerns about this, please send an email to <dns(a)ripe.net>. Regards, Anand Buddhdev RIPE NCC

6 13

New on RIPE Labs: Introducing 'tdns': the Teachable Authoritative DNS Server
by Mirjam Kuehne 20 Apr '18

20 Apr '18

Dear colleagues, Please read this new article by Bert Hubert on RIPE Labs where he introduces the Teachable Authoritative DNS Server (tdns): https://labs.ripe.net/Members/bert_hubert/introducing-tdns-the-teachable-au… Kind regards, Mirjam Kühne RIPE NCC

1 0

DNS WG @RIPE76 - draft agenda
by Joao Damas 12 Apr '18

12 Apr '18

Dear all, Here is the draft agenda and meeting information for the DNS Working Group at the upcoming RIPE 76 meeting in Marseilles (you have already registered, right?) DNS WG at RIPE 76 Slots: Wednesday 16th: 9:00-10:30 Wednesday 16th: 14:00-15:30 Agenda: Administrivia (5 min) Petr Spacek (CZ.NIC): NSEC aggressive caching measurements (30 min) Joao Damas + Geoff Huston (APNIC): Measuring ATR (30 min) Baptiste Jonglez (IMAG): High-performance DNS over TCP (30 min) Moritz Muller (SIDN): DNSSEC rollovers (30 min) Colin Petrie(RIPE NCC): Deploying DNS over TLS for the RIPE Meeting (15 min) Vicky RIsk (ISC): A survey on DNS Privacy(15 min) AOB(0-5 min) See you all soon Joao Damas DNS-WG co-chair

1 0

New on RIPE Labs: Bang for the Buck: the Adoption of DNSSEC and Return on Investment
by Mirjam Kuehne 04 Apr '18

04 Apr '18

Dear colleagues, In this interesting article on RIPE Labs Rene Bakker explains how economic decisions influence the adoption of DNSSEC: Bang for the Buck: the Adoption of DNSSEC and Return on Investment https://labs.ripe.net/Members/rene_bakker/bang-for-the-buck-the-adoption-of… Kind regards, Mirjam Kühne RIPE NCC

1 0