- dns-wg - mailman.ripe.net

Second call for contributions to the DNS wg at RIPE75
by Dave Knight 03 Aug '17

03 Aug '17

Dear colleagues, The RIPE 75 meeting in Dubai is 12 weeks away and we’d like to form a draft agenda soon. The deadline for submissions us August 20th. Note that in accordance with Dubai Department of Tourism and Commerce Marketing (DTCM) legislation, confirmed speakers are required to submit a colour passport copy, along with a personal profile. More detail is available here: https://ripe75.ripe.net/attend/dctm-requirements <https://ripe75.ripe.net/attend/dctm-requirements> Please submit your presentation ideas, or suggestions for discussions to <dns-wg-chairs(a)ripe.net <mailto:dns-wg-chairs@ripe.net>>. Please don’t submit anything using the meeting submission web form, it’s not intended for submission of content to working groups. Thanks! dave, on behalf of the working group chairs

1 0

NSID option on the RIPE Atlas SOA measurements of the root servers
by Chris Amin 24 Jul '17

24 Jul '17

Dear colleagues, RIPE Atlas is currently running a series of DNS SOA built-in measurements* towards all of the root servers from all probes. During the recent DNS measurements hackathon** it became apparent that for some use cases it would be useful to have SOA queries from all probes with the NSID EDNS option set, in order to be able to match up responses with the particular responding instances in an anycasted (or load balanced) setup. We would like to ask for feedback on two alternative options for implementing this change. They are: 1) Enable the NSID option for the existing built-in measurements towards the nine root servers which support it. 2) Start a new set of built-in measurements towards the nine root servers which support NSID. The advantages of option (1) are that it will be possible to compare and contrast the two sets of results, and that historical data for the existing built-ins will remain consistent with the current results. A very simple analysis shows that there is no overall increase in query error rates through enabling NSID, but there are bound to be individual marginal cases where queries fail or produce different results with NSID set but succeed without it. The advantages of option (2) are that there will be no increase in result storage usage -- the current IPv4+IPv6 UDP SOA built-ins towards the nine supporting root servers adds up to about 80 results per second (~1.5% of the total results in the system). This could potentially be mitigated by reducing the frequency for these new measurements, but perhaps more important than the slightly increased load is the potential user confusion caused by generating and providing two very similar sets of measurements. Please let us know if you have any preference for which way we go on this, particularly if you have a (current or future) use case for this kind of data. Kind regards, Chris Amin RIPE NCC * https://atlas.ripe.net/docs/built-in/ ** https://labs.ripe.net/Members/becha/results-dns-measurements-hackathon

4 4

Fw: [ripe-list] RIPE Mailing List / RIPE Forum Code of Conduct
by Shane Kerr 12 Jul '17

12 Jul '17

Fellow RIPE DNS working group participants, We have adopted a Code of Conduct for RIPE mailing lists, including this one. Please refer to Hans Petter Holen's e-mail for the background and actual code. I have attached it to this e-mail. You can of course discuss the code and its adoption on this list. Please also feel free to contact Dave, Jaap, or myself (the DNS working group co-chairs) if you have any questions. Cheers, -- Shane On behalf of the DNS working group co-chairs

1 0

new KSK for the root
by Jim Reid 11 Jul '17

11 Jul '17

In case anyone missed this event, the new KSK for the root got added today. Though it’s not signing anything yet. Thanks to everone who made this happen.

1 0

Call for contributions to the RIPE 75 meeting of the DNS wg
by Dave Knight 05 Jul '17

05 Jul '17

Dear colleagues, The RIPE 75 meeting in Dubai is 16 weeks away and we’d like to form a draft agenda soon. Note that in accordance with Dubai Department of Tourism and Commerce Marketing (DTCM) legislation, confirmed speakers are required to submit a colour passport copy, along with a personal profile. More detail is available here: https://ripe75.ripe.net/attend/dctm-requirements As this information is required to be provided one month in advance of the meeting the deadline for submissions is August 20th. Please submit your presentation ideas, or suggestions for discussions to <dns-wg-chairs(a)ripe.net>. Please don’t submit anything using the meeting submission web form, it’s not intended for submission of content to working groups. Thanks! dave, on behalf of the working group chairs

1 0

New on RIPE Labs: A Virtual Canary-in-the-Coalmine for the DNSSEC Root Key Rollover
by Mirjam Kuehne 27 Jun '17

27 Jun '17

Dear colleagues, On RIPE Labs Roland van Rijswijk of SURFnet describes the DNSSEC root key rollover, why you should care about it and how you can test your resolvers: https://labs.ripe.net/Members/roland_van_rijswijk/a-virtual-canary-in-the-c… Kind regards, Mirjam Kühne RIPE NCC

1 0

New on RIPE Labs: Recursives in the Wild: Engineering Authoritative DNS Servers
by Mirjam Kuehne 26 Jun '17

26 Jun '17

Dear colleagues, By analysing how resolvers select authoritative name servers in the wild, Moritz Müller of SIDN investigated how DNS operators are able to reduce DNS response times. Please read the article on RIPE Labs: https://labs.ripe.net/Members/moritz_muller/recursives-in-the-wild-engineer… Kind regards, Mirjam Kühne RIPE NCC

1 0

Online DS and signing algorithm test
by Roland van Rijswijk - Deij 21 Jun '17

21 Jun '17

Hi all, (apologies for cross-posting) As some of you may have picked up at the last ICANN DNSSEC workshop or at DNS OARC, we've started a project to track the impact of the Root KSK rollover over the coming months (dubbed the "Root Canary" project, see also https://rootcanary.org for rudimentary info). As a spin-off of this project, NLnet Labs and SURFnet have set up an online test that determines which DS and signing algorithms the resolver(s) configured on your system support. You can find the test here: https://rootcanary.org/test.html The test includes 4 DS algorithms (SHA1, SHA256, SHA512, GOST) and all signing algorithms. It does not do a full NSEC vs. NSEC3 test, as we assume that NSEC3 support likely also means NSEC is supported. Feedback/suggestions are of course welcome , please contact me and/or Willem Toorop at NLnet Labs. Cheers, Roland -- -- Roland M. van Rijswijk - Deij -- SURFnet bv -- w: http://www.surf.nl/en/about-surf/subsidiaries/surfnet -- e: roland.vanrijswijk(a)surfnet.nl

1 0

New on RIPE Labs: Finding Open DNS Resolvers on IPv6
by Mirjam Kuehne 16 Jun '17

16 Jun '17

Dear colleagues, Please read this new article by Luuk Hendriks on how to find open DNS resolvers on IPv6: https://labs.ripe.net/Members/luuk_hendriks/finding-open-dns-resolvers-on-i… Kind regards, Mirjam Kühne RIPE NCC

1 0

APNIC and RIPE NCC Joint Research Programme
by Anand Buddhdev 08 Jun '17

08 Jun '17

Dear all, The RIPE NCC and APNIC will be carrying out research into the DNS root server system later this month. We’ve published an article on RIPE Labs providing a brief outline of the next step in the research programme. https://labs.ripe.net/Members/alun_davies/apnic-labs-research-on-dns-root-s… Best regards, Anand Buddhdev Senior Engineer, RIPE NCC

1 0