- dns-wg - mailman.ripe.net

New on RIPE Labs: How to Choose DNS TTL Values
by Mirjam Kuehne 27 Sep '19

27 Sep '19

Dear colleagues, There is no consensus on how to choose DNS time-to-live (TTL) values for domain names. Yet, TTLs are incredibly important, given that they indirectly control how long resolvers cache records, directly influencing user experience. Read more in this new article by Giovane Moura on RIPE Labs: https://labs.ripe.net/Members/giovane_moura/dns-ttl-values-what-value-is-th… Kind regards, Mirjam Kühne RIPE NCC

1 0

Call for volunteers for RIPE DNS working group co-chair
by Dave Knight 14 Sep '19

14 Sep '19

Dear Colleagues, This is a call for volunteers to co-chair the RIPE DNS working group. *********************************************************************** Please do NOT reply to this message if you wish to propose a volunteer. *********************************************************************** Call for RIPE DNS Working Group Chair ------------------------------------- In accordance with the chair selection process we announce that the term of one of our co-chairs (Shane Kerr) will soon expire and we would like to invite volunteers, or nominations for someone to become a co-chair of the DNS working group. Note that having so far served only one term, in accordance with the selection process Shane may volunteer to serve a second. Anyone may volunteer, and anyone may be nominated by someone else. To do this, please send a mail to <dns-wg-chairs(a)ripe.net> before Monday 30th September 2019. It would be helpful for candidates to give the some words as to why they think they ought to be a co-chair, what new ideas, or improvements they might bring, and so on. We will publish the list of volunteers, along with anything the volunteers to include with their nomination, to this mailing list on Tuesday 1st October 2019. Discussion and support (or opposition) for each candidate can then be offered on the list. At the DNS working group session at RIPE 79 in Rotterdam, Dave and João will announce consensus based on the mailing list discussion. Timeline -------- Sat 14 Sep This call for volunteers posted to the dns-wg mail list Mon 30 Sep Deadline for volunteers Tue 01 Oct List of volunteers and call for support posted to the mail list Mon 14 Oct Deadline for showing support for volunteers on the mail list Wed 16 Oct DNS WG session References ---------- The RIPE working group chair job description is included in ripe-692: https://www.ripe.net/publications/docs/ripe-692 The DNS working group chair selection process is documented here: https://www.ripe.net/participate/ripe/wg/dns/dns-wg-chair-selection-process We have 3 co-chairs so the term is 3 years. The current approach was announced on this mailing list on 2018-07-17: https://www.ripe.net/ripe/mail/archives/dns-wg/2018-July/003566.html As always, please feel free to reach out to any of the chairs directly, to us as a group at dns-wg-chairs(a)ripe.net, or discuss this or any other any relevant topic on this mailing list. Kind regards, dave

1 0

RIPE 79 DNS working group agenda
by Shane Kerr 12 Sep '19

12 Sep '19

Colleagues, Here's the agenda for the DNS working group session at RIPE 79 in Rotterdam. We're meeting on Wednesday 16 October from 09:00 to 10:30. 1. Administrivia 5 minutes 2. Benchmarking and Optimizing DNS resolvers on the ISP level by Petr Špaček 20 minutes 3. XFR-over-TLS - Making Zone Transfers Private by Sara Dickinson 10 minutes 4. Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web by Austin H. Hounsel 20 minutes 5. RIPE NCC DNS Report by Florian Obser 10 minutes 6. The Resolvers We Use by Geoff Huston 15 minutes 7. Challenges of DNSSEC signing a F5 BigIP GTM hosted zone by Sara Dickinson 10 minutes X. AOB -- The RIPE DNS Working Group Chairs Dave, João, and Shane

1 0

New on RIPE Labs: Measuring the Impact of DNS Flag Day
by Mirjam Kuehne 23 Aug '19

23 Aug '19

Dear colleagues, In the lead up to DNS Flag Day on 1 February 2019, the focus for measurements has been the authoritative nameservers that needed to be fixed. In this article, Willem Toorop, Mortiz Müller and Taejoong Chung look at resolvers and resolver implementations — what was resolver behaviour on the Internet before DNS Flag Day, and how does the uptake of dropping workarounds disseminate in the wild? https://labs.ripe.net/Members/willem_toorop/measuring-the-impact-of-dns-fla… Kind regards, Mirjam Kühne RIPE NCC

1 0

Call for contributions to the RIPE 79 meeting of the dns-wg
by Dave Knight 26 Jul '19

26 Jul '19

Colleagues, The RIPE 79 meeting in Rotterdam is just 11 weeks away and we’d like to form our agenda. Please submit your presentation ideas, or suggestions for discussions to <dns-wg-chairs(a)ripe.net>. Please don’t submit anything using the meeting submission web form, it’s not intended for submission of content to working groups. Thanks! dave, for the working group chairs

1 0

New on RIPE Labs: Hackathon at African Internet Summit (Measuring DNS and DoH)
by Mirjam Kuehne 09 Jul '19

09 Jul '19

Dear colleagues, The ISOC African regional bureau has been organising hackathons at the last three editions of the Africa Internet Summit. This year there was a track on "Measuring DNS and DoH". Here is a report on the event and it's outcomes: https://labs.ripe.net/Members/willem_toorop/hackathon-africa-internet-summi… Kind regards, Mirjam Kühne RIPE NCC

1 0

Call for Presentations: 31st DNS-OARC Workshop, Austin, Texas, Oct 31 - Nov 01 2019
by Dave Knight 28 Jun '19

28 Jun '19

Colleagues, The 31st DNS-OARC Workshop will take place at the JW Marriott Austin in Austin, Texas, USA on October 31st and November 1st 2019. It is co-located with and will take place right after NANOG 77 (Oct 27th to Oct 30th 2019). The Workshop's Program Committee is now requesting proposals for presentations. All DNS-related subjects are welcome. A time slot will also be available for lightning talks (5-10 minutes each) on day two of the workshop, for which submissions will be accepted just before the start of the workshop and until the start of the morning break on day two. There will be an OARC Business and AGM session during the workshop, which will be for OARC Members only. If you are an OARC member and have a sensitive topic that you wish to present during that session those can be accommodated. Workshop Milestones: 25 Jun 2019 - Submissions open via Indico 16 Aug 2019 - Deadline for submission (midnight CDT) 28 Aug 2019 - Initial Contribution list published 28 Sep 2019 - Full agenda published 18 Oct 2019 - Deadline for slideset submission 31 Oct 2019 - Workshop Details for presentation submission are published here: <https://indico.dns-oarc.net/event/32/call-for-abstracts/> The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> Dave Knight, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

NCC reverse delegation criteria
by Jonas Frey 13 Jun '19

13 Jun '19

Hello all, as for this topic, i have started the discussion on the members-discuss list. So far it seems there are various opinions about this topic. From the replys i have received it seems these are: - Dont run a open resolver, let RIPE block - Dont run a open resolver, let RIPE warn - Run a open resolver and secure it propely, RIPE pass - Dont check anything, RIPE pass - Let RIPE check for amplification level, decide on that The main question is if RIPE should prohibit technically valid configurations. IMO: if the open resolver+auth. resolver is considered a bad setup (for operational reasons/resilience or whatever) then that should be left up to the company running it (as possible impact is limited to that - besides amplification). (However there seem to be huge controversal thoughts about this, i.e. if dividing both functions is still neccessary in 2019) As previously noted most (if not all) ccTLD registrys do not block when a open recursor is found. (C/N/O: Verisign pass, EU EURID: pass, DE DE- NIC: pass with warn). Now that these ccTLDs deal with *alot* more nameservers than RIPE (probably), why would it make sense for RIPE to force a block of them? -- Mit freundlichen Grüßen / Best regards, Jonas Frey ---------------------------------------------------------------- Probe Networks Jonas Frey e-Mail: jf(a)probe-networks.de Auf Strützberg 26 D-66663 Merzig Tel: +(49) (0) 6861 90897-00 Fax: +(49) (0) 6861 90897-99 Internet: www.probe-networks.de Hotline: 0800 1656531 ---------------------------------------------------------------- Diese E-Mail enthaelt moeglicherweise vertrauliche und/oder rechtlich geschuetzte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist strengstens untersagt. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the contents of this e-mail is strictly prohibited. ------------------------------------------

11 25

RIPE NCC's reverse DNS delegation process and stats
by Anand Buddhdev 12 Jun '19

12 Jun '19

Dear colleagues, As requested, here is some information about the reverse DNS delegation process applied by the RIPE NCC. We perform pre-delegation checks with a local instance of Zonemaster, which is DNS delegation testing software that was developed by AFNIC and IIS. The software performs the following tests: https://github.com/zonemaster/zonemaster/tree/master/docs/specifications/te… Test results are classified into one of five levels of severity: INFO, NOTICE, WARNING, ERROR, or CRITICAL. This classification is governed by a policy, and ours follows the default Zonemaster profile here: https://github.com/zonemaster/zonemaster-engine/blob/master/share/profile.j… According to this policy, a name server offering recursion is classified as ERROR. When we perform pre-delegation tests, the request is rejected if any of the test results are classified at the ERROR or CRITICAL levels. We have the results of pre-delegation tests going back to 30 June 2017. Between then and now, we rejected 5,125 delegation requests for 1,833 zones because at least one of the name servers of a zone was an open recursor. It's worth noting that these requests may have been rejected for other reasons in addition to this one, and there were multiple requests for some zones, which accounts for the imbalance between the two numbers. Finally, before Zonemaster we used software called DNScheck, which was developed by IIS. This also checked for open recursive name servers and classified this condition as an error. Regards, Anand Buddhdev RIPE NCC

1 0

NCC reverse delegation criteria
by Måns Nilsson 11 Jun '19

11 Jun '19

Recently, a discussion regarding the checks performed by the NCC before reverse delegation is made came up on the members-discuss list. It was concluded that this should be discussed here rather than there. The members archive might not be available to all, so I'll try to summarize. Please add your take on summary if you find mine lacking. The questioned practice was that the NCC rejects the delegation request if the target server is found to be an open recursor. Some participants argued that this is not a technical problem, and some said yes it is. Some held that the NCC has no authority blocking a request, but it was argued that every delegation is subject to RFC 1591 responsibilites. For starters, are the delegation requirements described somewhere? Best regards, -- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE SA0XLR +46 705 989668 In 1962, you could buy a pair of SHARKSKIN SLACKS, with a "Continental Belt," for $10.99!!

9 12