- dns-wg - mailman.ripe.net

Announcement of ICANN DNS Symposium
by Matt Larson 03 Feb '17

03 Feb '17

(This email is sent from my personal account because that's how I'm subscribed, and I apologize if you receive multiple copies.) Dear colleagues, I'd like to invite you to the first-ever ICANN DNS Symposium, which will be held in Madrid, Spain, on Saturday, 13 May 2017. ICANN's Office of the CTO hopes to make the ICANN DNS Symposium a regular event for the DNS technical community with changing themes covering different aspects of DNS. For this initial event, we are focusing on DNS-related activities within ICANN. There will be presentations relating to DNS research, security, root server operations, IANA and more. Multiple ICANN departments will present, including the Office of the CTO, DNS Engineering (responsible for L-root operations), PTI/IANA and the Global Domains Division (gTLDs). Our goal is to be transparent with the community about DNS activities happening at ICANN and solicit feedback and suggestions. More information about the Symposium is available at https://www.icann.org/ids. A welcome reception will be held on Friday evening, 12 May. Also, please note that the Symposium is colocated with several other events: - ICANN GDD Industry Summit (9-11 May) (https://www.icann.org/gddsummit) - The 6th Registration Operations Workshop (12 May) (http://regiops.net) - ICANN DNS Symposium (13 May) (https://www.icann.org/ids) - OARC 26 (DNS-OARC Workshop) (14-15 May) (https://indico.dns-oarc.net/event/26) All events will be held in the same venue, Hotel NH Collection Madrid Eurobuilding, Calle de Padre Damián, 23, 28036, Madrid, Spain. Register for the Symposium now at https://registration.icann.org/register.php?id=dns-symposium-2017. I hope to see you in Spain! Matt -- Matt Larson <matt.larson(a)icann.org> VP of Research, Office of the CTO, ICANN +1 240 459-9562 (mobile)

1 0

Call for presentations RIPE 74
by Benno Overeinder 24 Jan '17

24 Jan '17

Dear colleagues, Please find the CFP for RIPE 74 below or at https://ripe74.ripe.net/submit-topic/cfp/. The deadline for submissions is *12 March 2017*. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings. Kind regards, Benno Overeinder RIPE PC Chair https://ripe74.ripe.net/programme/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 74 will take place from 8-12 May 2017 in Budapest, Hungary. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 74. See the full descriptions of the different presentation formats, https://ripe74.ripe.net/submit-topic/presentation-formats/. Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than 12 March 2017. Proposals submitted after this date will be considered depending on the remaining available space in the programme. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour - Lightning talks: 10 minutes total for both presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe74.ripe.net/submit-topic/submission-form/. - Lightning talks should also be submitted using the meeting submission system (https://ripe74.ripe.net/submit-topic/submission-form/) and can be submitted any time up to and including the meeting week. Allocation of lightning talks will start a few days before the meeting, and will continue throughout the meeting. During the meeting, they may be announced on the day before the talk or even on the same day as the talk. - Lightning talks should also be submitted using the meeting submission system (https://ripe74.ripe.net/submit-topic/submission-form/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. - Due to potential technical issues, presenters/panellists should be physically present at the RIPE Meeting. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

Service outage at two K-root nodes
by Anand Buddhdev 21 Jan '17

21 Jan '17

Dear colleagues, We have been upgrading the operating system and name server software on all K-root servers. The process has mostly gone quite well, but we have had an unfortunate incident. Two of the newly upgraded nodes had been accidentally announcing the K-root prefixes even though the name server software on them was not running. This means that queries sent to these two servers between 12 and 19 January were not answered. The affected nodes are in Belgrade and Reykjavik. We estimate the percentage of queries lost to be 0.3%. Normally, failure of the name server would result in automatic withdrawal of the prefix announcements. However, this failure was caused by a flaw in the deployment process, which did not activate the correct software components in the right sequence. We have identified this issue and fixed it, so that this failure cannot happen with any future installations or upgrades. We apologise for any inconvenience caused. If you have any specific questions please send email to <dns(a)ripe.net>. Regards, Anand Buddhdev RIPE NCC

2 1

New on RIPE Labs: DNS Root Server Transparency: K-Root, Anycast and More
by Mirjam Kuehne 13 Jan '17

13 Jan '17

Dear colleagues, Please find this new article on RIPE Labs in which we shed some light on the operational policies of K-root to clarify possible misunderstandings about how it is operated. https://labs.ripe.net/Members/emileaben/dns-root-server-transparency Kind regards, Mirjam Kuehne RIPE NCC

1 0

Call for Presentations - DNS-OARC Workshop OARC26, Madrid, 14-15 May 2017
by Shane Kerr 12 Jan '17

12 Jan '17

RIPE DNS working group participants, Here's a call for presentation for the upcoming DNS-OARC workshop. Note that this is the Monday & Tuesday after the RIPE 74 meeting in Hungary, which may be something to take into consideration when planning. Cheers, -- Shane ------------------------------------------------------------------------- [with apologies to those who see this on multiple lists] Call For Presentations The DNS-OARC 26th Workshop will take place in Madrid, Spain on May 14th and 15th 2017, the Sunday and Monday following the ICANN GDD Industry Summit 2017. The Workshop's Program Committee is now requesting proposals for presentations. This workshop intends to build from previous strong DNS-OARC workshops, where both operational content and research are welcome. All DNS-related subjects are welcome. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. A timeslot will be available for lightning talks (5-10 minutes) on Monday May 15th, for which submissions will be accepted during May 14th on a first-come first-served basis. Workshop Milestones: 6th January 2017, Call for Presentations posted and open for submissions 24th February 2017, Deadline for submission 17th March 2017, Draft Programme published 14th April 2017, Final Program published 28th April 2017, Final deadline for slideset submission Details for presentation submission will be published here: https://indico.dns-oarc.net/event/26/call-for-abstracts/ The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> We hope you will join us, Best Regards, Sue OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

3 2

DEADLINE EXTENSION until January 18: DNS Privacy Workshop
by Allison Mankin 12 Jan '17

12 Jan '17

[Apologies for possible multiple copies] We have extended the submission deadline for the NDSS DNS Privacy Workshop to Wednesday, January 18 because of the intervening holidays for many interested people. Please contact us (Sara and Allison) if you have questions. Note that the formats are flexed a bit as well: page lengths and format are flexible now and we are also willing to receive draft presentations as long as they have an abstract early in the deck. The goal of the workshop is interchange and advancing the state of play for DNS privacy and its adjacent technologies. The call for papers is here: DPRIV17 <https://www.internetsociety.org/events/ndss-symposium/ndss-symposium-2017/d…>. The deadline on the web page at NDSS hasn't been changed yet, but the submission system is set with the new deadline. Elevator pitch: DNS queries and domain names are metadata and there are many new directions (and open questions) for mitigating privacy issues for them. Location and Important dates: Workshop Location: San Diego, CA, USA Workshop date: 2017-02-26 (co-located with NDSS 2017) Submissions: 2017-01-18 anywhere-on-earth Final date for notifications and invitations to present at the workshop: 2017-02-03 Submissions may be new papers, papers already published, Short Papers, or Position Papers. Also, please contact the TPC chairs if you want to suggest a panel. Allison and Sara allison.mankin(a)gmail.com sara(a)sinodun.com ------------ *Workshop on DNS Privacy DPRIV17 (#NoMoreCowbell)* BackgroundDNS Privacy has been a growing concern of the IETF and others in the Internet engineering community for the last few years. Almost every activity on the Internet starts with a DNS query (and often several). - Those queries can reveal not only what websites an individual visits but also metadata about other services such as the domains of email contacts or chat services. - Whilst the data in the DNS is public, individual DNS transactions made by an end user *should not* be public. - Today, however DNS queries are sent in *clear text* (using UDP or TCP) which means passive eavesdroppers can observe all the DNS lookups performed. - The DNS is a globally distributed system that crosses international boundaries and often uses servers in many different countries in order to provide resilience. - It is well known that the NSA used the MORECOWBELL tool to perform mass surveillance of DNS traffic, and other surveillance techniques involving DNS almost certainly are in play today. - Some ISPs embed user information (e.g. a user ID or MAC address) within DNS queries that go to the ISP’s resolver in order to provide services such as Parental Filtering. This allows for fingerprinting of individual users. - Some CDNs embed user information (e.g. client subnets) in queries from resolvers to authoritative servers (to geo-locate end users). This allows for correlation of queries to particular subnets. - Some ISPs log DNS queries at the resolver and share this information with third-parties in ways not known or obvious to end users. The IETF's DPRIVE (*D*NS *PRIV*ate *E*xchange) Working Group has taken initial protocol steps to address these concerns (with much of the early work focussing on the stub to resolver problem), publishing DNS Privacy Considerations (RFC 7626), Specification for DNS over Transport Layer Security (RFC 7858), and The EDNS(0) Padding Option (RFC 7830), and DNS Query Name Minimisation to Improve Privacy (RFC 7816). However because of the great diversity of the DNS ecosystem, and the pervasive role of DNS and domain names in Internet applications and security, much is not fully understood or resolved. The goal of this workshop is to bring together privacy and Internet researchers with a diversity of backgrounds and views, to identify promising long-term mitigations of the broad space of DNS privacy risks.

1 0

Thread about DNS RPZ in the RIPE anti-abuse working group
by Shane Kerr 04 Jan '17

04 Jan '17

All, RPZ is a technology developed by Vernon Schryver and Paul Vixie which acts as a way to encode DNS filtering rules for resolvers in the DNS itself. There is currently a draft about this under discussion in the IETF DNS operations working group: https://tools.ietf.org/html/draft-vixie-dns-rpz https://www.ietf.org/mail-archive/web/dnsop/current/maillist.html This draft was brought up recently on the RIPE anti-abuse working group mailing list: https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2017-January/003744.h… As is typical for DNS topics, there are lots of strong opinions and some interesting technical bits. Rather than have one topic being discussed in many different places within RIPE, it probably makes sense to keep the discussion on the existing threads, or at least on those mailing lists. However I thought I would mention it here in case anyone is interested and not yet aware. Cheers, -- Shane

1 0

New on RIPE Labs: Scoring the DNS Route Server System (by Geoff Huston)
by Mirjam Kuehne 13 Dec '16

13 Dec '16

Dear colleagues, For those of you who missed this on the APNIC blog, Geoff Huston's articles about the DNS root server system are now on RIPE Labs: Scoring the DNS Root Server System https://labs.ripe.net/Members/gih/scoring-the-dns-root-server-system and Scoring the DNS Root Server System, Part 2 – A Sixth Star? https://labs.ripe.net/Members/gih/scoring-the-dns-root-server-system-part-2… Kind regards, Mirjam Kuehne RIPE NCC

1 1

New on RIPE Labs: Speculating on DNS DDoS
by Mirjam Kuehne 28 Oct '16

28 Oct '16

Dear colleagues, Please find this new article on RIPE Labs submitted by Geoff Huston: Speculating on DNS DDoS: https://labs.ripe.net/Members/gih/speculating-on-dns-ddos Kind regards, Mirjam Kuehne RIPE NCC

1 0

Verisign to provide secondary DNS services for the RIPE NCC’s zones
by Romeo Zwart 26 Oct '16

26 Oct '16

Dear colleagues, In July we published a Request for Proposals (RfP) for a trusted third party to provide secondary DNS services for the RIPE NCC's zones: https://www.ripe.net/ripe/mail/archives/dns-wg/2016-July/003303.html Following our announcement, we received three final proposals by the conclusion of the process. We selected the best fitting proposal based on the technical and non-technical requirements in the RfP document. The proposal submitted by VeriSign Sàrl (“Verisign”) was the best fit. We subsequently signed a contract with Verisign, which comes into effect before the end of this year. The contract is for the period of one year, with the intention to renew yearly. Prior to renewal, we will look at the benefits of the service and actual market situation at that time to decide on renewing the service. We'd like to express our gratitude to all parties who submitted proposals. We look forward to working with Verisign in the future. Regards, Romeo Zwart RIPE NCC

7 15