- dns-wg - mailman.ripe.net

New on RIPE Labs: DNS Root Server Transparency: K-Root, Anycast and More
by Mirjam Kuehne 13 Jan '17

13 Jan '17

Dear colleagues, Please find this new article on RIPE Labs in which we shed some light on the operational policies of K-root to clarify possible misunderstandings about how it is operated. https://labs.ripe.net/Members/emileaben/dns-root-server-transparency Kind regards, Mirjam Kuehne RIPE NCC

1 0

Call for Presentations - DNS-OARC Workshop OARC26, Madrid, 14-15 May 2017
by Shane Kerr 12 Jan '17

12 Jan '17

RIPE DNS working group participants, Here's a call for presentation for the upcoming DNS-OARC workshop. Note that this is the Monday & Tuesday after the RIPE 74 meeting in Hungary, which may be something to take into consideration when planning. Cheers, -- Shane ------------------------------------------------------------------------- [with apologies to those who see this on multiple lists] Call For Presentations The DNS-OARC 26th Workshop will take place in Madrid, Spain on May 14th and 15th 2017, the Sunday and Monday following the ICANN GDD Industry Summit 2017. The Workshop's Program Committee is now requesting proposals for presentations. This workshop intends to build from previous strong DNS-OARC workshops, where both operational content and research are welcome. All DNS-related subjects are welcome. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. A timeslot will be available for lightning talks (5-10 minutes) on Monday May 15th, for which submissions will be accepted during May 14th on a first-come first-served basis. Workshop Milestones: 6th January 2017, Call for Presentations posted and open for submissions 24th February 2017, Deadline for submission 17th March 2017, Draft Programme published 14th April 2017, Final Program published 28th April 2017, Final deadline for slideset submission Details for presentation submission will be published here: https://indico.dns-oarc.net/event/26/call-for-abstracts/ The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> We hope you will join us, Best Regards, Sue OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

3 2

DEADLINE EXTENSION until January 18: DNS Privacy Workshop
by Allison Mankin 11 Jan '17

11 Jan '17

[Apologies for possible multiple copies] We have extended the submission deadline for the NDSS DNS Privacy Workshop to Wednesday, January 18 because of the intervening holidays for many interested people. Please contact us (Sara and Allison) if you have questions. Note that the formats are flexed a bit as well: page lengths and format are flexible now and we are also willing to receive draft presentations as long as they have an abstract early in the deck. The goal of the workshop is interchange and advancing the state of play for DNS privacy and its adjacent technologies. The call for papers is here: DPRIV17 <https://www.internetsociety.org/events/ndss-symposium/ndss-symposium-2017/d…>. The deadline on the web page at NDSS hasn't been changed yet, but the submission system is set with the new deadline. Elevator pitch: DNS queries and domain names are metadata and there are many new directions (and open questions) for mitigating privacy issues for them. Location and Important dates: Workshop Location: San Diego, CA, USA Workshop date: 2017-02-26 (co-located with NDSS 2017) Submissions: 2017-01-18 anywhere-on-earth Final date for notifications and invitations to present at the workshop: 2017-02-03 Submissions may be new papers, papers already published, Short Papers, or Position Papers. Also, please contact the TPC chairs if you want to suggest a panel. Allison and Sara allison.mankin(a)gmail.com sara(a)sinodun.com ------------ *Workshop on DNS Privacy DPRIV17 (#NoMoreCowbell)* BackgroundDNS Privacy has been a growing concern of the IETF and others in the Internet engineering community for the last few years. Almost every activity on the Internet starts with a DNS query (and often several). - Those queries can reveal not only what websites an individual visits but also metadata about other services such as the domains of email contacts or chat services. - Whilst the data in the DNS is public, individual DNS transactions made by an end user *should not* be public. - Today, however DNS queries are sent in *clear text* (using UDP or TCP) which means passive eavesdroppers can observe all the DNS lookups performed. - The DNS is a globally distributed system that crosses international boundaries and often uses servers in many different countries in order to provide resilience. - It is well known that the NSA used the MORECOWBELL tool to perform mass surveillance of DNS traffic, and other surveillance techniques involving DNS almost certainly are in play today. - Some ISPs embed user information (e.g. a user ID or MAC address) within DNS queries that go to the ISP’s resolver in order to provide services such as Parental Filtering. This allows for fingerprinting of individual users. - Some CDNs embed user information (e.g. client subnets) in queries from resolvers to authoritative servers (to geo-locate end users). This allows for correlation of queries to particular subnets. - Some ISPs log DNS queries at the resolver and share this information with third-parties in ways not known or obvious to end users. The IETF's DPRIVE (*D*NS *PRIV*ate *E*xchange) Working Group has taken initial protocol steps to address these concerns (with much of the early work focussing on the stub to resolver problem), publishing DNS Privacy Considerations (RFC 7626), Specification for DNS over Transport Layer Security (RFC 7858), and The EDNS(0) Padding Option (RFC 7830), and DNS Query Name Minimisation to Improve Privacy (RFC 7816). However because of the great diversity of the DNS ecosystem, and the pervasive role of DNS and domain names in Internet applications and security, much is not fully understood or resolved. The goal of this workshop is to bring together privacy and Internet researchers with a diversity of backgrounds and views, to identify promising long-term mitigations of the broad space of DNS privacy risks.

1 0

Thread about DNS RPZ in the RIPE anti-abuse working group
by Shane Kerr 04 Jan '17

04 Jan '17

All, RPZ is a technology developed by Vernon Schryver and Paul Vixie which acts as a way to encode DNS filtering rules for resolvers in the DNS itself. There is currently a draft about this under discussion in the IETF DNS operations working group: https://tools.ietf.org/html/draft-vixie-dns-rpz https://www.ietf.org/mail-archive/web/dnsop/current/maillist.html This draft was brought up recently on the RIPE anti-abuse working group mailing list: https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2017-January/003744.h… As is typical for DNS topics, there are lots of strong opinions and some interesting technical bits. Rather than have one topic being discussed in many different places within RIPE, it probably makes sense to keep the discussion on the existing threads, or at least on those mailing lists. However I thought I would mention it here in case anyone is interested and not yet aware. Cheers, -- Shane

1 0

New on RIPE Labs: Scoring the DNS Route Server System (by Geoff Huston)
by Mirjam Kuehne 13 Dec '16

13 Dec '16

Dear colleagues, For those of you who missed this on the APNIC blog, Geoff Huston's articles about the DNS root server system are now on RIPE Labs: Scoring the DNS Root Server System https://labs.ripe.net/Members/gih/scoring-the-dns-root-server-system and Scoring the DNS Root Server System, Part 2 – A Sixth Star? https://labs.ripe.net/Members/gih/scoring-the-dns-root-server-system-part-2… Kind regards, Mirjam Kuehne RIPE NCC

1 1

New on RIPE Labs: Speculating on DNS DDoS
by Mirjam Kuehne 28 Oct '16

28 Oct '16

Dear colleagues, Please find this new article on RIPE Labs submitted by Geoff Huston: Speculating on DNS DDoS: https://labs.ripe.net/Members/gih/speculating-on-dns-ddos Kind regards, Mirjam Kuehne RIPE NCC

1 0

Verisign to provide secondary DNS services for the RIPE NCC’s zones
by Romeo Zwart 26 Oct '16

26 Oct '16

Dear colleagues, In July we published a Request for Proposals (RfP) for a trusted third party to provide secondary DNS services for the RIPE NCC's zones: https://www.ripe.net/ripe/mail/archives/dns-wg/2016-July/003303.html Following our announcement, we received three final proposals by the conclusion of the process. We selected the best fitting proposal based on the technical and non-technical requirements in the RfP document. The proposal submitted by VeriSign Sàrl (“Verisign”) was the best fit. We subsequently signed a contract with Verisign, which comes into effect before the end of this year. The contract is for the period of one year, with the intention to renew yearly. Prior to renewal, we will look at the benefits of the service and actual market situation at that time to decide on renewing the service. We'd like to express our gratitude to all parties who submitted proposals. We look forward to working with Verisign in the future. Regards, Romeo Zwart RIPE NCC

7 15

New on RIPE Labs: A Quick Look at the Attack on Dyn
by Mirjam Kuehne 24 Oct '16

24 Oct '16

Dear colleagues, We used a number of RIPE NCC tools and data sets to take a quick look at the recent DDoS attack on Dyn’s infrastructure. We wanted to see if this could be found in the data produced by the RIPE Atlas community. Please see on RIPE Labs: https://labs.ripe.net/Members/massimo_candela/a-quick-look-at-the-attack-on… Kind regards, Mirjam Kuehne RIPE NCC

1 0

co-chair appointment: yet another reminder
by Jim Reid 22 Oct '16

22 Oct '16

There’s still time for people to volunteer. But not much. Anyone who wishes to stand is leaving it rather late. They should do so before the end of this week. At present, two candidates have emerged and there have only been a few statements of support for them. This makes it a little uncomfortable to make a consensus judgement since just a handful of WG members have expressed an opinion. I’d appreciate it if more members of the WG spoke up. Vote early, vote often. :-) Not that we do voting.

2 1

Geoff Huston at ESNOG18: Why DANE?
by japi 20 Oct '16

20 Oct '16

https://youtu.be/GO2eEkeWk88 Live but just slides and audio. -- japi

1 0