- dns-wg - mailman.ripe.net

RIPE 93: DNS WG session agenda
by Yevheniya Nosyk 09 Oct '26

09 Oct '26

Dear all, The preliminary agenda for the DNS working group session at RIPE 93 has now been published: https://ripe93.ripe.net/programme/meeting-plan/sessions/156/ Our session is currently scheduled for Thursday, 29 October, from 11:00 to 12:30 (UTC +0200). The agenda is as follows: - Welcome - Post-Quantum DNSSEC at Cloudflare Joe Abley, Cloudflare - PQC for DNSSEC: a format size analysis on Falcon signatures Ginevra Fabrizio, University of Twente - Local root: the traffic trade-off between root queries and root zone distribution Willem Toorop, NLnet Labs - RIPE NCC DNS Update Leon Grasmeijer, RIPE NCC - Closing notes and AOB See you all in Sofia or online! Cheers, Yevheniya, on behalf of the RIPE DNS working group co-chairs (Marc, Ulrich and me)

1 0

KSK Rollover - Please help
by Ulrich Wisser 09 Oct '26

09 Oct '26

Hi, Maybe some of you have already seen Geoff blog post from yesterday. https://ispcol.potaroo.net/2026-10/kskroll.html On his list of networks that are not prepared for the KSK Rollover this Sunday are a few from the Ripe service region. I was hoping that this list might reach these people or someone on the list knows someone … If needed, feel free to forward my contact details. I am happy to explain what needs to be done and why. Please have look at the list below. Thanks /Ulrich Anybody on this list need to update their list of trust anchors immediately! AS CC KSK-2024 Tests Validating RFC8509 KSK-2024 NOT KSK-2024 Name 205368 AM 38.60% 4,227 4,209 2,349 536 852 Fnet, Armenia 24812 UA 32.00% 10,791 3,437 1,322 205 436 HomeNet, Ukraine 39065 UA 26.10% 1,701 1,666 1,238 193 546 Southern Telecommunication s, Ukraine 33915 NL 12.70% 170,615 19,642 13,292 1,328 9,105 Vodafone Libertel, Netherlands 12969 IS 10.00% 4,567 4,520 3,954 331 2,979 Vodafone, Iceland 16019 CZ 8.20% 45,089 43,692 32,266 1,885 21,166 Vodafone-CZ, Czechia 15547 CH 4.00% 3,011 2,967 2,508 78 1,865 Netplus, Switzerland 6661 LU 1.50% 10,391 10,197 9,132 113 7,493 LU - POST, Luxembourg 29244 BG 0.70% 33,217 33,072 23,809 102 14,943 Telenor BG-AS, Bulgaria 56665 LU 0.60% 3,790 3,727 3,273 15 2,625 Proximus, Luxembourg 57293 AZ 0.50% 19,186 19,133 14,531 48 10,412 Telekom MMC, Azerbaijan 327697 RE 0.40% 1,883 1,876 1,450 4 1,045 TELCO OI , Reunion

4 3

IMPORTANTE | Atualização do endereço de e-mail / Email address update
by Joao Pagaime 09 Oct '26

09 Oct '26

1 0

Reminder: Root KSK Rollover on 11 October 2026 – Check Your Trust Anchors
by Andres Pavez 24 Sep '26

24 Sep '26

Hi everyone, The next Root Zone Key Signing Key (KSK) rollover is scheduled for 11 October 2026. Operators of DNSSEC-validating resolvers should verify that KSK-2024 (Key Tag 38696) is present in their trust anchor configuration before the rollover. Information and resources, including technical guidance, FAQs, and the rollover timeline, are available on the 2026 Root KSK Rollover page: https://www.icann.org/resources/pages/ksk-rollover-en We encourage you to share questions, observations, or experiences before, during, and following the rollover on the KSK Rollover mailing list: https://lists.icann.org/postorius/lists/ksk-rollover.icann.org Thank you for your continued participation and support in helping ensure a smooth rollover. Best regards, -- Andres Pavez Cryptographic Key Manager

2 1

How safe are our domain names from US sanctions?
by Timo Hilbrink 16 Sep '26

16 Sep '26

Hi all, As we all know, the DNS infrastructure has been built to be decentralised and resilient, so that its functionality does not depend on a single continent, country or government. But what if your gTLD domain name can be wiped out of the DNS by a single government? This is exactly what happened to Autistici/Inventati (A/I), an Italian non-profit, volunteer-run service provider that caters to hundreds of activist groups around the world. They have operated using the autistici.org domain name for the past 25 years. On August 26, the Office of Foreign Assets Control (OFAC) at the US Department of the Treasury included them in their list of “Specially Designated Global Terrorists” (SDGT). On August 28, PIR, the US headquartered registry operator for the .org TLD, placed autistici.org on status severHold, effectively wiping it from the DNS. This all happened without A/I committing any crime, neither in Italy nor in the US, and without any prosecutor ever indicting them either for felonies or misdemeanors. Simply the fact they provided services to certain activist groups that may be labeled as controversial or extremist by some authorities, was enough to place the whole provider on the SDGT list. In this case it was PIR (created by ISOC) that acted on the sanctions imposed by OFAC, although PIR still hasn't officially released any statement about this. A lot of organisations with an .org domain name are now very concerned about the future of their domains, but .org is not the only large gTLD that is run by a US based registry operator, both .net and .com are operated by Verisign, which is also headquartered in the US. So we can not rule out that something similar could happen to other domains. As an example: Just over two weeks ago, the US Department of the Treasury has begun "Operation Economic Outcast: an unprecedented, whole-of-government, economic campaign against the Islamic Republic of Iran and its enablers. The Treasury is significantly expanding sanctions risk for those who continue to choose to do business with Iran." What if RIPE NCC would be classified as an organisation that provides services to sanctioned entities, could that mean that ripe.net gets put on serverHold? Should we still depend so heavily on US based gTLD registry operators? For more background on the A/I case, see: https://www.article19.org/resources/usa-terrorism-designation-has-global-co… https://keepitfree.ai/ https://www.inventati.org/ Timo

5 4

Re: How safe are our domain names from US sanctions?
by Joe Abley 15 Sep '26

15 Sep '26

On 15 Sep 2026, at 08:47, Named T. Relay via dns-wg <dns-wg(a)ripe.net> wrote: > For decentralization's sake, i make the suggestion to move one of > the three main TLD's (.net, .com, .org) under Europa's management. > This might distribute and improve legal stability of the DNS ecosystem. > (And if this is not possible, that is indicative of a problem with DNS!) I assume you are at least partially trolling, but no doubt there is an undercurrent of (understandable) community outrage that would like to imagine you were not. Problems abound at the intersection of jurisdiction and topology. Much like choosing a week for a global meeting that does not conflict with anybody's holiday, it is difficult to imagine a solution here that mitigates every theoretical problem. And if you could find such a unicorn on a Friday, chances are good it would not last through the weekend. I appreciate the DNS is often the default solution to every problem, but, really, not this one. This time the DNS is just a symptom. Joe

2 1

Call for Presentations (deadline approaching fast)
by Ulrich Wisser 07 Sep '26

07 Sep '26

Dear DNS working group, A short reminder that RIPE 93 will be held from 26 to 30 October 2026 in Sofia, Bulgaria. Our working group session is currently scheduled for 29 October at 11:00 local time, but please note that this may still change. This email is our official call for topics for the DNS Working Group session. Since RIPE 91, all plenary and working group proposals have been submitted through the same system, Pretalx. Please submit your proposals by 15 September 2026 using the following link: https://pretalx.ripe.net/ripe-93/cfp Alternatively, you may still send your proposals directly to us at <dns-wg-chairs AT ripe.net>. If you are using Pretalx, please pay special attention to the following fields: • Talk type: "Lightning talk" or "Talk" • Track: "DNS WG" • Duration: Time in minutes for the presentation and Q&A. This may differ from the default duration for the selected talk type. You can find more information about the Pretalx system here: https://ripe93.ripe.net/present/how-to-submit-a-proposal/ As usual, participation in the working group session is possible both in person and remotely. We plan to send out the first round of notifications at the end of September 2026. Cheers, RIPE DNS Working Group co-chairs (Marc, Ulrich and Yevheniya)

1 0

Stale IPv6 glue in the root zone for four ccTLDs
by Patrik Wallstrom 25 Aug '26

25 Aug '26

Hi, In a recent run of my gonemaster analysis of all the TLDs, I just discovered that four ccTLDs has stale glue in the root for the RIPE nameservers, https://gonemaster.evilbit.de/analysis/tags/OUT_OF_BAILIWICK_ADDR_MISMATCH?… It's for the ccTLDs ne, ps, sd, and tj, which as the nameservers [ne|ps|sd|tj].cctld.authdns.ripe.net that all have old glue. I have not seen this before, but also I have just updated the testcase specification for this specifically, as the root does not always give all the glue from the root. Just a heads up to whoever manages this glue. / Patrik

5 4

Fwd: Draft liaison statement on Public ENUM under e164.arpa for the September 2026 ITU-T Study Group 2 meeting
by Hisham Ibrahim 17 Aug '26

17 Aug '26

Dear colleagues, I am sharing this message the DNS, Database, RIPE NCC Services Working Group mailing lists to ensure all relevant working groups are informed. If you wish to share thoughts in response, please reply to the thread on the RIPE NCC coop-WG mailing list. Regards Hisham ---------- Forwarded message --------- From: Hisham Ibrahim <HMI(a)ripe.net> Date: Mon, 17 Aug 2026 at 17:40 Subject: Draft liaison statement on Public ENUM under e164.arpa for the September 2026 ITU-T Study Group 2 meeting To: <cooperation-wg(a)ripe.net> Dear colleagues, Following the earlier discussions on Public ENUM under e164.arpa, I have prepared the following draft liaison statement for the September 2026 ITU-T Study Group 2 meeting. In my draft I tried to: - clarify the RIPE NCC’s position following SG2-C-0196*, - support the confirmation of the revised interim procedures**, - outline how the responses to TSB Circular 123*** could inform the treatment of individual delegations, - and provide an updated overview of the operational status of the current delegations. I would appreciate feedback on my draft and I would appreciate it if you could share any comments or concerns, particularly on the technical, procedural or governance aspects, by 25 August, so that the RIPE NCC can incorporate the feedback before finalizing the submission. Many thanks in advance for your review. Regards, Hisham * https://www.ripe.net/media/documents/ENUM_liaison_statement_ITU_T_SG2.pdf ** https://www.itu.int/en/ITU-T/inr/enum/Pages/procedures.aspx *** https://www.itu.int/md/T25-TSB-CIR-0123/en To: ITU-T Study Group 2, September 2026 Meeting Title: RIPE NCC liaison statement on ENUM (e164.arpa) Dear colleagues, The RIPE NCC thanks ITU-T Study Group 2, the Telecommunication Standardization Bureau, the Internet Architecture Board, Member States and ENUM delegation operators for their continued engagement concerning Public ENUM under e164.arpa. The RIPE NCC operates the e164.arpa zone as the IAB’s designated operator under the established coordination arrangements involving the IAB, ITU-T and the RIPE NCC. 1. RIPE NCC position At the February 2026 meeting of Study Group 2, the RIPE NCC submitted contribution SG2-C-0196. The contribution arose from an operational question concerning support for ENUM domain objects through the Registration Data Access Protocol, but also raised broader questions concerning the future status of ENUM and e164.arpa. Following subsequent engagement with the IAB, ENUM delegation operators and members of the RIPE community, the RIPE NCC recognizes that those broader questions did not accurately reflect the established distribution of responsibilities. This statement therefore clarifies and supersedes the relevant parts of SG2-C-0196. For the avoidance of doubt, the RIPE NCC supports the continued operation of Public ENUM under e164.arpa and is not proposing its closure. SG2-C-0196 no longer represents a request for Study Group 2 to determine the technical or architectural future of ENUM or e164.arpa. Any future consideration of a system-wide change would require coordination involving the IAB, the relevant IETF and ITU-T processes, the RIPE NCC and affected stakeholders. 2. Operational status and revised procedures The RIPE NCC has reviewed the 46 current delegations recorded in the RIPE Database. Of these, 23 showed no DNS issue at the top delegation level, 17 appeared non-operational and six showed partial DNS issues. These findings identify a registry-maintenance and data-accuracy issue. They do not provide a sufficient basis for a system-wide conclusion concerning Public ENUM or e164.arpa. The RIPE NCC therefore welcomes the revised Interim procedures for Geographic Country Codes (ENUM administration ad interim) contained in TD423 Rev.1/PLEN. The revised procedures provide an appropriate mechanism for addressing individual non-operational or expired temporary delegations while preserving functioning delegations and the ability of Member States to confirm, update, withdraw or subsequently restore their delegations. Responses to TSB Circular 123 may provide useful information concerning the status and intentions of individual national delegations. The RIPE NCC considers that such information should inform individual cases under the revised procedures, rather than a system-wide conclusion concerning Public ENUM or e164.arpa. 3. Request to Study Group 2 The RIPE NCC respectfully invites Study Group 2 to: - confirm that the revised procedures contained in TD423 Rev.1/PLEN will come into force at the September 2026 meeting and will provide the applicable mechanism for addressing individual non-operational or expired temporary delegations; and - continue coordination with the IAB, the RIPE NCC, the relevant IETF processes and affected stakeholders on any broader questions concerning the technical or long-term status of ENUM and e164.arpa. Once the revised procedures come into force, the RIPE NCC intends to apply them systematically and transparently, including by refreshing its technical assessment, engaging with relevant delegation operators where possible and submitting substantiated cases to TSB. The question of Registration Data Access Protocol support is separate from the continued operation of Public ENUM and will be considered through the appropriate technical and community processes. The RIPE NCC remains committed to working constructively with Study Group 2, TSB, the IAB, Member States, delegation operators and the RIPE community to maintain e164.arpa in a stable, accurate and technically sound manner.

1 0

DNS Resolver Recommender
by Richter, Robert 14 Aug '26

14 Aug '26

Hello everybody! We built the tool “DNS Resolver Recommender”: * https://dns.diic-hpi.org It is a small DoH measurement tool that should catch DNS behavior from the user’s browser. It measures a list of 200+ public DoH resolvers for both cached and uncached domains and recommends the best one for the user. Upon opt-in, we also collect the (anonymized) measurement data for research (see the Privacy Disclosure<https://dns.diic-hpi.org/privacy.html>). We made every effort to collect only data that maintains privacy. In the future, we also want to release snapshots of our data to the community. Therefore, I am writing to this mailing list: We would greatly appreciate it if you tried the tool and, if you feel comfortable, also activate the opt-in to support our research work. Thank you in advance! Best regards, Robert

4 3