- dns-wg - mailman.ripe.net

17 June online RIPE DNS working group session
by Shane Kerr 10 Jun '20

10 Jun '20

Dear RIPE DNS Working Group, We have a RIPE DNS working group scheduled for 17 June. This one will be back at our normal time of 15:00 CEST / 13:00 UTC. We're continuing our mix of topics that are relevant right now as well as ones that involve a a longer time frame. Agenda: The NXNSAttack Vulnerability Ralph Dolmans, NLnetLabs, and Lior Shafir, Tel Aviv University The Impact of Post Quantum Cryptography on DNSSEC Moritz Müller, SIDN Here is the Zoom session information: Topic: DNS Working Group - Meeting Time: Jun 17, 2020 03:00 PM Amsterdam Join Zoom Meeting https://ripe.zoom.us/j/95128617451?pwd=VldsdFZEUFAvQTVVVWN0MDkrd3lHZz09 Meeting ID: 951 2861 7451 Password: 386451 One tap mobile +31207947345,,95128617451# Netherlands +31202410288,,95128617451# Netherlands Dial by your location +31 20 794 7345 Netherlands +31 20 241 0288 Netherlands +31 20 794 0854 Netherlands +31 20 794 6519 Netherlands +31 20 794 6520 Netherlands +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma) +1 301 715 8592 US (Germantown) +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +1 646 558 8656 US (New York) Meeting ID: 951 2861 7451 Find your local number: https://ripe.zoom.us/u/aqyjKJgxn Join by SIP 95128617451(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (EMEA) 103.122.166.55 (Australia) 209.9.211.110 (Hong Kong SAR) 64.211.144.160 (Brazil) 69.174.57.160 (Canada) 207.226.132.110 (Japan) Meeting ID: 951 2861 7451 Password: 386451 I look forward to seeing y'all there. Cheers, -- Shane

1 0

New on RIPE Labs: Managing the Trust Anchor of the DNS against Adversity
by Mirjam Kuehne 09 Jun '20

09 Jun '20

Dear colleagues, Kim Davies, President of PTI and Vice President of IANA Services for ICANN describes recent and new challenges when managing the DNS trust anchor: https://labs.ripe.net/Members/mirjam/managing-the-trust-anchor-of-the-dns-a… This article is an updated version of a presentation Kim recently gave to the DNS Working Group about DNSSEC Root Key Signing Key (KSK) ceremonies, the challenges to run those ceremonies and some thoughts on how to improve the processes in the future. Kind regards, Mirjam Kühne RIPE NCC

1 0

27 May online RIPE DNS working group session
by Shane Kerr 25 May '20

25 May '20

Dear RIPE DNS Working Group, We have a RIPE DNS working group session scheduled for 7 May. NOTE: This is at a different time than the previous two sessions. We will have this session at 13:00 CEST / 11:00 UTC. Agenda: DNS and IPv6 João Damas, APNIC and Geoff Huston, APNIC Changes to .ORG Signing Joe Abley, PIR and Suzanne Woolf, PIR Here is the Zoom session information: Topic: DNS Working Group - Meeting Time: May 27, 2020 01:00 PM Amsterdam Join Zoom Meeting https://ripe.zoom.us/j/94381810950?pwd=MGVOUm9MZmNxZktqUGgyVktMaEVKQT09 Meeting ID: 943 8181 0950 Password: 768956 One tap mobile +31202410288,,94381810950# Netherlands +31207940854,,94381810950# Netherlands Dial by your location +31 20 241 0288 Netherlands +31 20 794 0854 Netherlands +31 20 794 6519 Netherlands +31 20 794 6520 Netherlands +31 20 794 7345 Netherlands +1 253 215 8782 US (Tacoma) +1 301 715 8592 US (Germantown) +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) Meeting ID: 943 8181 0950 Find your local number: https://ripe.zoom.us/u/abfDz9nHl0 Join by SIP 94381810950(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (EMEA) 103.122.166.55 (Australia) 209.9.211.110 (Hong Kong China) 64.211.144.160 (Brazil) 69.174.57.160 (Canada) 207.226.132.110 (Japan) Meeting ID: 943 8181 0950 Password: 768956 I look forward to seeing y'all there! Cheers, -- Shane

1 1

DNSSEC Validation Failures for RIPE NCC Zones
by Anand Buddhdev 25 May '20

25 May '20

Dear colleagues, Yesterday afternoon (21 May 2020), our DNSSEC signer rolled the Zone Signing Keys (ZSKs) of all the zones we operate. Unfortunately, a bug in the signer caused it to withdraw the old ZSKs soon after the new keys began signing the zones. Validating resolvers may have experienced some failures if they had cached signatures made by the old ZSKs. We apologise for any operational problems this may have caused. We are looking at the issue with the developers of our Knot DNS signer to prevent such an occurrence in the future. Regards, Anand Buddhdev RIPE NCC

2 1

New on RIPE Labs: NXNSAttack: Upgrade Resolvers to Stop New Kind of Random Subdomain Attack
by Mirjam Kuehne 21 May '20

21 May '20

Dear colleagues, This article by Petr Špaček of CZ.NIC describes a newly discovered DNS protocol vulnerability that affects all recursive DNS resolvers. NXNSAttack allows the execution of random subdomain attacks using the DNS delegation mechanism, resulting in a big packet amplification factor. Please read more about this on RIPE Labs: https://labs.ripe.net/Members/petr_spacek/nxnsattack-upgrade-resolvers-to-s… Kind regards, Mirjam Kühne RIPE NCC

5 4

New on RIPE Labs: The BGP Tuner: Intuitive Anycast Management
by Mirjam Kuehne 19 May '20

19 May '20

Dear colleagues, DNS operators have very few intelligent real-time tools that enable them to monitor their anycast services, for instance during a DDoS attack. In this post, Joao M. Ceron, Network Security Research Engineer at SIDN Labs, describes the challenges associated with measuring anycast services and propose a tool called the BGP Tuner. By using that open-source tool, operators can see in advance how changes in their BGP policies may impact the traffic load distribution over the anycast sites. Please find more details on RIPE Labs: https://labs.ripe.net/Members/joao_m_ceron/the-bgp-tuner-intuitive-anycast-… Kind regards, Mirjam Kühne RIPE NCC

1 0

OARC Online 32a Workshop, June 9th, Call for contributions
by Dave Knight 07 May '20

07 May '20

Hi all, OARC is hosting an online meeting on June 9th, 17:00-19:00 UTC. The Programme Committee are seeking contributions from the community. All DNS-related subjects are welcome, but we're particularly interested in content which is timely and operationally relevant in light of the COVID-19 pandemic. Suggestions for discussion topics would also be good. As the session is limited to 2 hours we'd like to encourage brevity, presentations ought to be no longer than 20 minutes, not including time for questions. Subject areas we are looking for include the following, but not limited to: * data on traffic growthx * operational scaling and availability challenges * infrastructure and skills bottlenecks * supply chain challenges * personnel & infrastructure protection * security/disinformation threats, public education * ideas that are helping * lessons learned * information from official channels * universal access inequities **Workshop Milestones:** * 7 May 2020 - Submissions open via Indico * 21 May 2020 - Deadline for submission (23:59 UTC) * 28 May 2020 - Initial Contribution list published * 02 Jun 2020 - Full agenda published * 04 Jun 2020 - Deadline for slideset submission * 09 Jun 2020 - OARC (online) 32a Workshop Details for presentation submission are published at: <https://www.dns-oarc.net/oarc32a> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Additional information for speakers of OARC (online) 32a: * your talk will be live broadcast and recorded for future reference * your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> Dave Knight, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.

1 0

Correction: May 6th Online dns-wg session
by Dave Knight 05 May '20

05 May '20

Apologies, please disregard my previous message, the dns-wg online session is on Wednesday May 6th, not May 7th. This is a reminder for the dns-wg online session we will have on Wednesday May 6th at 15:30 CEST. Here's the agenda and Zoom details for the upcoming session 6 May: RIPE DNS Working Group - May 6, 2020 3:30 PM CEST (Amsterdam) Agenda: Effect of a global pandemic on DNS utilization Steve DeJong, Neustar COVID-19 influence on resolver traffic Peter van Dijk, PowerDNS Pieter Lexis, PowerDNS Join Zoom Meeting: https://ripe.zoom.us/j/92457259361?pwd=cElZU2dWTjB0N3JYaWVJZlc2T1BhQT09 Meeting ID: 924 5725 9361 Password: 379388 One tap mobile: +31207947345,,92457259361# Netherlands +31202410288,,92457259361# Netherlands Dial by your location +31 20 794 7345 Netherlands +31 20 241 0288 Netherlands +31 20 794 0854 Netherlands +31 20 794 6519 Netherlands +31 20 794 6520 Netherlands +1 301 715 8592 US +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) +1 253 215 8782 US Meeting ID: 924 5725 9361 Find your local number: https://ripe.zoom.us/u/ahMe5oL66 Join by SIP 92457259361(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 221.122.88.195 (China) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (EMEA) 103.122.166.55 (Australia) 209.9.211.110 (Hong Kong China) 64.211.144.160 (Brazil) 69.174.57.160 (Canada) 207.226.132.110 (Japan) Meeting ID: 924 5725 9361 Password: 379388 This is a RIPE community meeting the all RIPE meeting participation rules apply, including the RIPE code of conduct. Future sessions: May 27, 2020 at 3:30 PM CEST (Amsterdam) Jun 17, 2020 at 3:30 PM CEST (Amsterdam) Call for contributions: We are currently seeking content for the June 17 meeting and beyond. Presentations and suggestions for discussion topics are always welcome, recent operational experiences and observations are particularly encouraged. Please send your ideas to the DNS WG Chairs at <dns-wg-chair(a)ripe.net>. Kind regards, Dave Knight, for the DNS WG chairs.

1 0

Reminder: May 7th Online dns-wg session
by Dave Knight 05 May '20

05 May '20

This is a reminder for the dns-wg online session we will have on Wednesday May 7th at 15:30 CEST. Here's the agenda and Zoom details for the upcoming session 6 May: RIPE DNS Working Group - May 6, 2020 3:30 PM CEST (Amsterdam) Agenda: Effect of a global pandemic on DNS utilization Steve DeJong, Neustar COVID-19 influence on resolver traffic Peter van Dijk, PowerDNS Pieter Lexis, PowerDNS Join Zoom Meeting: https://ripe.zoom.us/j/92457259361?pwd=cElZU2dWTjB0N3JYaWVJZlc2T1BhQT09 Meeting ID: 924 5725 9361 Password: 379388 One tap mobile: +31207947345,,92457259361# Netherlands +31202410288,,92457259361# Netherlands Dial by your location +31 20 794 7345 Netherlands +31 20 241 0288 Netherlands +31 20 794 0854 Netherlands +31 20 794 6519 Netherlands +31 20 794 6520 Netherlands +1 301 715 8592 US +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) +1 253 215 8782 US Meeting ID: 924 5725 9361 Find your local number: https://ripe.zoom.us/u/ahMe5oL66 Join by SIP 92457259361(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 221.122.88.195 (China) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (EMEA) 103.122.166.55 (Australia) 209.9.211.110 (Hong Kong China) 64.211.144.160 (Brazil) 69.174.57.160 (Canada) 207.226.132.110 (Japan) Meeting ID: 924 5725 9361 Password: 379388 This is a RIPE community meeting the all RIPE meeting participation rules apply, including the RIPE code of conduct. Future sessions: May 27, 2020 at 3:30 PM CEST (Amsterdam) Jun 17, 2020 at 3:30 PM CEST (Amsterdam) Call for contributions: We are currently seeking content for the June 17 meeting and beyond. Presentations and suggestions for discussion topics are always welcome, recent operational experiences and observations are particularly encouraged. Please send your ideas to the DNS WG Chairs at <dns-wg-chair(a)ripe.net>. Kind regards, Dave Knight, for the DNS WG chairs.

1 0

RIPE Labs article about the first RIPE DNS Working Group virtual meeting
by Shane Kerr 29 Apr '20

29 Apr '20

Fellow DNS folks, I wrote a short article for RIPE Labs covering both the first RIPE DNS Working Group virtual meeting and also our plans for more going forward. https://labs.ripe.net/Members/shane/dns-is-virtually-awsome Cheers, -- Shane

1 0