- dns-wg - mailman.ripe.net

revised agenda for RIPE71
by Jim Reid 11 Nov '15

11 Nov '15

The agenda for next week's meeting has been updated. Here's the latest version. Please note that things are not finalised and there might be further tweaks to the agenda or running order. # # $Id: agenda,v 1.7 2015/11/11 14:08:51 jim Exp $ # FIRST SESSION A. Usual Administrivia 5 mins Agenda bashing Minutes of previous meeting Review of Action Items B. NCC Report 15 mins Anand Buddhdev C. Measuring the impact of IPv6 resolver preference 20 mins Chris Baker, Dyn D. Impact of DNS over TCP - a resolver point of view 15 mins Joao Damas, Bondis The impact two very different aspects of the life of a recursive server were examined for this project: queries to authoritative servers as well as the queries from stub resolvers. Traffic from two different ISP's recursive resolvers was captured to analyse the potential impact on the servers of long lived TCP sessions, investigating the effect of timeout settings, the total number of simultaneous connections that would be kept open and the potential benefits of connection reuse as proposed in the current version of draft-ietf-dnsop-5966bis, with the intent of offering simulated operational advice, based on observed traffic. E. Integration testing of DNS Recursive servers 15 mins Ondřej Surý, CZ.NIC A generic testing framework was produced as a part of developing the Knot Resolver. This framework is written in python and can use UNIX domain sockets to bypass the underlying physical network. F .nl Open DNS datasets and Statistics 10 mins Marco Davids, SIDN SIDN makes available aggregated datasets from .NL authoritative servers to the Internet/Research/DNS communities. It includes visualizations of the DNS-traffic for .nl, as well as statistics on domain registrations, DNS queries, DNSSEC usage, plus layer-3 and layer-4 information. The datasets (starting from May 2014) are updated on a daily basis. They are provided in JSON-format and can be found on https://stats.sidnlabs.nl. G. Discussion of latest SSAC recommendations 10 mins SSAC Stuckee SECOND SESSION H. Discovery method for a validating stub resolver 20 mins Xavier Gorjón, NLnetLabs This research project aims to develop a discovery method to ensure DNSSEC information can be delivered to the end host. It used RIPE ATLAS to study the current state of DNSSEC aware and DNSSEC validating resolvers, and define a course of action from that information. The project explored a novel method to discover the capabilities of the ISP's recursive resolver and bypass incompetent Customer-premises equipment (CPE) middle-boxes to target the often more capable ISP's resolver directly. I. DNSSEC for Legacy Applications 15 mins Willem Toorop, NLnetLabs Validating stub resolvers are hampered by middle boxes (typically CPE) that corrupt the path from the stub to the recursive resolver. Using the getdns library and the Linux/Unix name resolution framework, libnss_getdns provides (stub-level) DNSSEC validation for legacy applications. This module can work around broken middle boxes by double checking bogus answers. It also offers in-path signalling of DNSSEC failure for http, informing the end-user why validation failed and giving them control of deciding how to deal with that. J. Implementation challenges of geographic split-horizon DNS 20 mins Jan Včelák, CZ.NIC There are multiple ways to find a network service according to a client's geographic location. One possibility is to perform a split-horizon at the DNS level. The presentation will briefly inform about existing approaches, problems introduced by this mechanism, possible solutions of these problems, and experience we gained when implementing this feature into Knot DNS. K. Root Zone KSK rollover 30 mins Roy Arends, IANA L. WG Co-chair appointment 5 mins M. AOB

1 0

New on RIPE Labs: DNSSEC Algorithm Roll-over
by Mirjam Kuehne 06 Nov '15

06 Nov '15

Dear colleagues, Rolling over the algorithm (usually to a stronger variant) used to sign a DNS zone isn't as easy as regular key roll-overs. This is because some DNSSEC validators are less forgiving than others, and fail validation unless the right combination of keys and signatures is present in a zone. This new article on RIPE Labs describes our experiences with DNSSEC algorithm roll-over: https://labs.ripe.net/Members/anandb/dnssec-algorithm-roll-over We hope that our experience will help others who may be considering doing this. Kind regards, Mirjam Kuehne RIPE NCC

1 0

Co-chair nomination
by Joe Abley 23 Oct '15

23 Oct '15

Hi all, I would like to nominate Dave Knight as co-chair of the DNS working group. Dave has had root on more root servers than anybody else in the world, was a driving force for the deployment of DNSSEC in the ORG registry, was part of the team that deployed DNSSEC in the root zone and sits on the board of DNS-OARC and is well-known and active in the RIPE community. In his copious spare time he leads the effort for global deployment of Dyn's DNS platform. Joe

7 6

draft agenda for Bucharest
by Jim Reid 22 Oct '15

22 Oct '15

Colleagues, here's the draft agenda for RIPE71. Please note that this is subject to change, most likely in the running order. A definitive agenda will be circulated in a couple of weeks. I'll remind you all that the WG co-chair appointment process is under way. There's still time for volunteers to come forward. It would be nice to see more statements of support for those who have volunteered too. Hope to see you all in sunny Bucharest next month. # # $Id: agenda,v 1.6 2015/10/21 22:01:47 jim Exp $ # FIRST SESSION A. Usual Administrivia 5 mins Agenda bashing Minutes of previous meeting Review of Action Items B. NCC Report 15 mins Anand Buddhdev C. Measuring the impact of IPv6 resolver preference 20 mins Chris Baker, Dyn D. Impact of DNS over TCP - a resolver point of view 20 mins Joao Damas, Bondis The impact two very different aspects of the life of a recursive server were examined for this project: queries to authoritative servers as well as the queries from stub resolvers. Traffic from two different ISP's recursive resolvers was captured to analyse the potential impact on the servers of long lived TCP sessions, investigating the effect of timeout settings, the total number of simultaneous connections that would be kept open and the potential benefits of connection reuse as proposed in the current version of draft-ietf-dnsop-5966bis, with the intent of offering simulated operational advice, based on observed traffic. E. Integration testing of DNS Recursive servers 15 mins Ondřej Surý, CZ.NIC A generic testing framework was produced as a part of developing the Knot Resolver. This framework is written in python and can use UNIX domain sockets to bypass the underlying physical network. F. Discussion of latest SSAC recommendations 15 mins SSAC Stuckee SECOND SESSION G. Discovery method for a validating stub resolver 20 mins Xavier Gorjón, NLnetLabs This research project aims to develop a discovery method to ensure DNSSEC information can be delivered to the end host. It used RIPE ATLAS to study the current state of DNSSEC aware and DNSSEC validating resolvers, and define a course of action from that information. The project explored a novel method to discover the capabilities of the ISP's recursive resolver and bypass incompetent Customer-premises equipment (CPE) middle-boxes to target the often more capable ISP's resolver directly. H. DNSSEC for Legacy Applications 15 mins Willem Toorop, NLnetLabs Validating stub resolvers are hampered by middle boxes (typically CPE) that corrupt the path from the stub to the recursive resolver. Using the getdns library and the Linux/Unix name resolution framework, libnss_getdns provides (stub-level) DNSSEC validation for legacy applications. This module can work around broken middle boxes by double checking bogus answers. It also offers in-path signalling of DNSSEC failure for http, informing the end-user why validation failed and giving them control of deciding how to deal with that. I. Implementation challenges of geographic split-horizon DNS 20 mins Jan Včelák, CZ.NIC There are multiple ways to find a network service according to a client's geographic location. One possibility is to perform a split-horizon at the DNS level. The presentation will briefly inform about existing approaches, problems introduced by this mechanism, possible solutions of these problems, and experience we gained when implementing this feature into Knot DNS. J. Root Zone KSK rollover 30 mins Roy Arends, IANA K. WG Co-chair appointment 5 mins L. AOB

1 0

co-chair nomination and appointment reminder
by Jim Reid 20 Oct '15

20 Oct '15

Colleagues, here's a reminder that there is still time to nominate candidates. Please post statements of support on the list for those who have been nominated. This will help the disintersted co-chairs make a consensus judgement about who should be appointed. If there's no clear consensus, it will be necessary to make a choice at random from the consensus-tied candidates. I hope it doesn't become necessary to use that option. So please speak up!

1 0

New on RIPE Labs: Researching F-root Anycast Placement Using RIPE Atlas
by Mirjam Kuehne 14 Oct '15

14 Oct '15

Dear colleagues, Please find a new article on RIPE Labs: https://labs.ripe.net/Members/ray_bellis/researching-f-root-anycast-placeme… In order to expand the reach of F-root, Ray Bellis looked at where queries to F-root are coming from and where it would make most sense to place new nodes. As a first step, Ray looked at the existing nodes to see how they behave and if there is anything that can be improved. He used RIPE Atlas to do this. Kind regards, Mirjam Kuehne RIPE NCC

8 10

DNS-WG Co-chair nomination
by Piotr Strzyzewski 13 Oct '15

13 Oct '15

Dear DNS-WG Members I would like to nominate for the vacant co-chair seat Ondřej Caletka from CESNET. I have already asked Ondřej if he has any objections and he agreed to be nominated. I believe that Ondřej with his strong technical background and experience with DNS will be a valuable asset to the WG. Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

2 1

Co-chair appointment process: 2015 call for volunteers/nominees
by Jim Reid 12 Oct '15

12 Oct '15

Colleagues, you will be aware that we have adopted a procedure for the regular appointment of a WG co-chair. It is now going to be invoked for the first time. If you are interested in helping to run the WG, now's your chance to step forward. The main responsibility for a co-chair is to prepare the agenda for WG sessions by identifying potential speakers and discussion topics. There are also some obligations for the Policy Development Process but these are not so significant for the DNS WG because it rarely makes DNS policy. Further details of a WG Chair's responsibilities are in RIPE Document 542. If anyone is interested in volunteering and needs more info about what that entails, feel free to contact any or all of Jaap, Peter or myself. The barriers for entry are zero. Anyone can volunteer simply by posting to the list. You can nominate anyone, including yourself. It might be helpful for candidates to give the WG an explanation of why they have been nominated, what fresh ideas or suggestions they have, possible improvements to WG activities, etc, etc. Members of the WG can express their support (or not) for those who volunteer. The WG will decide by consensus on the list who gets appointed. If there is no consensus, the consensus tied candidates will draw lots. The aim is to have a co-chair appointed by this process at the meeting in Bucharest.

4 5

New on RIPE Labs: Iran and K-root - The Rest of the Story
by Mirjam Kuehne 01 Oct '15

01 Oct '15

Dear colleagues, We took a look at the effect of the K-root node in Iran in order to augment the picture provided by Dyn Research in a recent blog post. Please find the results on RIPE Labs: https://labs.ripe.net/Members/emileaben/iran-and-k-root-the-rest-of-the-sto… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Last Call for presentations and Draft programme for RIPE 71
by Benno Overeinder 27 Sep '15

27 Sep '15

Colleagues, A list of currently accepted RIPE 71 presentations is now published at: https://ripe71.ripe.net/programme/ There are still few slots remaining for a final RIPE 71 programme and RIPE Programme Committee will accept new proposals until 11 October 2015. This is our last call for you to submit your proposals. You can find the CFP for RIPE 71 below, or at https://ripe71.ripe.net/submit-topic/cfp/, for your proposals for plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings. Kind regards, Benno Overeinder RIPE PC Chair https://www.ripe.net/participate/meetings/ripe-meetings/pc ---------------------------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 71 will take place from 16-20 November 2015 in Bucharest, Romania. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 71. See the full descriptions of the different presentation formats, https://ripe71.ripe.net/submit-topic/presentation-formats/. Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than 11 October 2015. Proposals submitted after this date will be considered depending on the remaining available space in the programme. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity in operations - Commercial transactions of IPv4 addresses - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour - Lightning talks: 10 minutes The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe71.ripe.net/submit-topic/submission-form/. - Lightning talks should also be submitted using the meeting submission system (https://ripe71.ripe.net/submit-topic/submission-form/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice---in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. - Due to potential technical issues, presenters/panellists should be physically present at the RIPE Meeting. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

3 2