- dns-wg - mailman.ripe.net

Root zone operational announcement: introducing ZONEMD for the root zone
by Wessels, Duane 12 Sep '23

12 Sep '23

I am pleased to announce that Message Digests for DNS Zones, also known as ZONEMD, will be added to the root zone later this year. This feature, specified in RFC 8976, adds cryptographic data protections to the zone as a whole, allowing the recipient to verify the authenticity of the zone’s contents. ZONEMD will be added to the root zone using a phased approach. On September 13, 2023, a ZONEMD record will make its first appearance in the root zone. At this time the Hash Algorithm field will be set to a private use algorithm number, making the ZONEMD record deliberately unverifiable. On December 6, 2023, the ZONEMD record will be published with the SHA-384 Hash Algorithm, thereby making it verifiable. We expect no operational impacts for end users. ZONEMD does not affect root zone queries and responses. The root server operators have agreed to not alter their zone ingestion processes for at least a year after ZONEMD is first introduced. Anyone that downloads the root zone file from www.internic.net or rs.internic.net should be aware that it will include the new ZONEMD resource record in its native presentation format starting on September 6th. Please feel free to follow up with any questions or concerns. References and further reading: [1] RFC 8976: “Message Digest for DNS Zones”, https://www.rfc-editor.org/rfc/rfc8976 [2] Root Server Operators Statement on adding ZONEMD to the root zone, https://root-servers.org/media/news/2022-08-Statement_on_ZONEMD.pdf [3] RZERC003: “Adding Zone Data Protections to the Root Zone”, https://www.icann.org/uploads/ckeditor/rzerc-003-en.pdf [4] Verisign Blog: “Adding ZONEMD Protections to the Root Zone”, https://blog.verisign.com/security/root-zone-zonemd/ [5] APNIC Ping Podcast episode “Adding ZONEMD protections to the root zone”, https://blubrry.com/ping_podcast/108940688/adding-zonemd-protections-to-the… DW

1 1

EDU zone operational announcement: DNSSEC algorithm rollover
by Wessels, Duane 12 Sep '23

12 Sep '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Verisign is pleased to announce that an algorithm 13 (ECDSA) DS record has been published for the EDU zone, and the algorithm 8 record has been removed. Over the next few days, the algorithm 8 DNSKEY records will be removed from the EDU zone, followed by the removal of algorithm 8 signatures. We continue to expect no operational impacts for end users, but please feel free to reach out to us with concerns or any observations of anomalous behavior related to this algorithm rollover. DW -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBCAAGBQJlAIwcAAoJEGyZpGmowJiNEj4H/R07bC4outa2znVIh7BIsolu mamlG2+NlOBmdAOTzk8vdmoUMy11RHeG0W+6o6oQS9gALUgj4shxPF5z+Je0R6Us Y54HDnE4mi1KAGKOtg/AE5RYCZeA/rhLk/qxRnLiUBtlmuRwMpjkJ5k+viCEFVX+ IyZPWEJyDSC8bFx4LThYt7AP093r74vjKHa2wMffa+3VHZgrEpHReL6Na149+u3L Idb1In9cCs6nYFp/DuMopdVHy3EqK6psPSCt7jCG27qAtM4+ormsCPYYo4KI7RUo lF7X2SdDmVUfoL4lzrLUzl7MFBxJxNYCt/yPvN/VBLw2Yby2AhPHVQt7lpjIQXo= =/uAl -----END PGP SIGNATURE-----

1 0

Invitation: RIPE NCC Open House Series on Community Projects Fund Updates - September 2023
by Alastair Strachan 07 Sep '23

07 Sep '23

Dear colleagues, For over 30 years, the RIPE NCC has been an essential part of the Internet technical community. Seven years ago, we took our commitment a step further by introducing the Community Projects Fund. This initiative was designed to tackle the funding challenges faced by many noteworthy projects in our community. We're thrilled to bring you updates on the incredible progress these initiatives have made. We warmly invite you to attend our upcoming RIPE NCC Open House Series, focusing on the advancements made by last year’s Community Projects Fund recipients. In each session, the project teams will offer presentations summarising their journey and current status, followed by a Q&A session during which you can engage directly with them. Wednesday, 13 September 2023, 13:30 - 14:30 UTC 1. Elevating Demand-side Cybersecurity Through Business Procurement - Wout de Natris 2. DNS Research Federation - Internet Standards Observatory - Carolina Caeiro Thursday, 21 September 2023, 10:00 - 11:30 UTC 1. Foundation for Research and Technology - Hellas (FORTH) - ARTEMIS Lite - George Nomikos 2. Grenoble Alps University - fpdns2: DNS Fingerprinting Tool - Maciej Korczyński, Ph.D. 3. University of Aberdeen - Can We Extend IPv6? - A Measurement Project - Ana Custura Wednesday, 27 September 2023, 10:00 - 11:30 UTC 1. iNGO European Media Platform - Internet Identifiers in Time of War - Oksana Prykhodko 2. Aristotle University of Thessaloniki - AI4NetMon 2.0 - Pavlos Sermpezis 3. deSEC e.V. - deSEC: Secure DNSSEC Hosting - Peter Thomassen For more information on these upcoming events and how to register, please see here: https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-se… Kind Regards Alastair Strachan RIPE NCC

1 0

EDU zone operational announcement: DNSSEC algorithm rollover
by Wessels, Duane 05 Sep '23

05 Sep '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Verisign will soon begin the transition to DNSSEC algorithm 13 (ECDSA) for the EDU zone. Over the next few days, algorithm 13 signatures will start to appear in the zone, followed by the algorithm 13 DNSKEY records. We expect the DS record for the EDU zone to change from algorithm 8 to algorithm 13 between September 12-15. Additional information can be found at our blog post and DNS-OARC presentation URLs below: https://blog.verisign.com/security/dnssec-algorithm-update/ https://indico.dns-oarc.net/event/47/contributions/1012/ We expect no operational impacts for end users, but please feel free to reach out to us with concerns or any observations of anomalous behavior related to this algorithm rollover. DW -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBCAAGBQJk90tSAAoJEGyZpGmowJiNynsIAIWBx6Gc8CyOl0pcr65a3aUh FnrrteufEs1KvNk+HtexDs8opUGz8sKf4zG/ABj4NtTQFRwsvD/nxh8q+fnu4Vci niSPbJLZcadY+344FioGNE4/jE28jKmItx7fFmTBoaBcF5iy1aS5xSh4vOA6fcSy snJeYd6VsnrezK6IujgmiqAg7iLwl+YHvPnu8lJuXEpUPqBmO/EEHZPn7oEps8Xf A8duusfKIvP6zrIF0vnnqwS0TgUpTdam5MGtVAkv+JUlpzRmqAYNcQd872nYUVIp 5qZ1R+pjHsngwe+8pf/LQtpYwKjaiP06CUbZH8hlg3ioDWSLEAjs0NEgb45Wmhw= =Wi2m -----END PGP SIGNATURE-----

1 0

Call for nominations/volunteers to co-chair the RIPE DNS working group.
by Joao Luis Silva Damas 05 Sep '23

05 Sep '23

Dear Colleagues, This is a call for nominations or volunteers to co-chair the RIPE DNS working group. ************************************************************************************* Please DO NOT reply to this message if you wish to propose a volunteer. ************************************************************************************* Call for RIPE DNS Working Group Chair ------------------------------------------------------ In accordance with the chair selection process we announce that the term of one of our co-chairs (Joao Damas) will expire at the upcoming RIPE Meeting (RIPE 87, near Rome) and we would like to invite volunteers, or nominations for someone to become a co-chair of the DNS working group. Anyone may volunteer, and anyone may be nominated by someone else (we will check with the person for acceptance). Note that having served two terms, in accordance with the selection process Joao is not eligible. To do this, please send a mail to <dns-wg-chairs AT ripe.net <mailto:dns-wg-chairs@ripe.net>> before end of Sunday 5 November 2023 (UTC). Again, please DO NOT send your volunteer/nomination to the DNS WG mailing but rather the dns-wg-chairs mail alias. It would be helpful for candidates to give some words as to why they think they ought to be a co-chair, what new ideas, or improvements they might bring, and so on. We will publish the list of volunteers, along with anything the volunteers wish to include with their nomination, to this mailing list on Monday 6 November 2023. Discussion and support (or opposition) for each candidate can then be offered on the list. At the DNS working group session at RIPE 87, Moritz and Wilhelm hope to announce consensus based on the mailing list discussion. Timeline ———— Tuesday, 5 September 2023 This call for volunteers posted to the dns-wg mail list Sunday, 5 November 2023 Deadline for volunteers/nominations Monday, 6 November 2023 List of candidates and call for support posted to the mail list Monday, 27 November 2023 Deadline for showing support for candidates/volunteers on the mail list Tuesday, 28 November 2023 DNS WG session at RIPE 87 References ---------- The RIPE working group chair job description is included in ripe-692: https://www.ripe.net/publications/docs/ripe-692 The DNS working group chair selection process is documented here: https://www.ripe.net/participate/ripe/wg/dns/dns-wg-chair-selection-process We have 3 co-chairs so the term is 3 years. The current approach was announced on this mailing list on 2018-07-17: https://www.ripe.net/ripe/mail/archives/dns-wg/2018-July/003566.html As always, please feel free to reach out to any of the chairs directly, to us as a group at dns-wg-chairs AT ripe.net <mailto:dns-wg-chairs@ripe.net>, or discuss this or any other any relevant topic on this mailing list.

1 0

DNS and K-root Quarterly Planning Q3 2023
by Paul de Weerd 27 Jun '23

27 Jun '23

Dear colleagues, The DNS Services quarterly plans, including K-root, are published on our website: https://www.ripe.net/support/documentation/quarterly-planning/dns-and-k-root For this quarter, we'll continue with our day-to-day operations and update the operating system of some of our DNS servers. We also plan on deploying a new AuthDNS core site in Asia. We hope that by providing these plans, we can better inform the community of the ongoing developments on the DNS services we operate and get feedback on our work. If you have any input on these plans or suggestions for future work, please reach out to us. Kind regards, Paul de Weerd RIPE NCC

1 0

OARC 41 - Call for Contribution -- deadline extension
by Hazel 09 Jun '23

09 Jun '23

Deadline for OARC 41 abstract submission is extended to June 20th, 23:59 UTC. Please note that, we are looking for contributions and remote participation is actively supported ********************************* OARC 41 will be a two-day hybrid meeting and the tentative dates are 6th and 7th September to be co-located with ICANN DNS Symposium in Da Nang, Vietnam. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either 10 or 20 minutes in length (plus 5 minutes for Q&A). Proposals for in-person lightning presentations will be opened at the Workshop. Workshop Milestones: 2023-04-16 Submissions open via Indico 2023-06-20 Deadline for submission (23:59 UTC) 2023-06-27 Preliminary list of contributions published 2023-07-11 Full agenda published 2023-08-08 Deadline for slideset submission and Rehearsal 2023-09-06 OARC 41 Workshop - Day1 2023-09-07 OARC 41 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc41> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Example guidelines for presentation slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 41 - your talk will be broadcast live and recorded for future reference - your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting - Remote speakers have mandatory rehearsal on 2023-08-08 at 14:00 UTC. It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net Hazel Smith, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

OARC 41 - Call for Contribution
by Hazel 23 May '23

23 May '23

OARC 41 will be a two-day hybrid meeting and the tentative dates are 6th and 7th September to be co-located with ICANN DNS Symposium in Asia. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either 10 or 20 minutes in length (plus 5 minutes for Q&A). Proposals for in-person lightning presentations will be opened at the Workshop. *Workshop Milestones:* 2023-04-16 Submissions open via Indico 2023-06-10 Deadline for submission (23:59 UTC) 2023-06-27 Preliminary list of contributions published 2023-07-11 Full agenda published 2023-08-08 Deadline for slideset submission and Rehearsal 2023-09-06 OARC 41 Workshop - Day1 2023-09-07 OARC 41 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc41> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Example guidelines for presentation slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 41 - your talk will be broadcast live and recorded for future reference - your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting - *Remote speakers have mandatory rehearsal on 2023-08-08 at 14:00 UTC.* It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net Hazel Smith, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

DNSSEC and DHCP
by Julian Fölsch 23 May '23

23 May '23

Hi, First of all: If you think, I should discuss this somewhere else, please tell me. :) During my quest to get my SSH client to use SSHFP records and not annoy me with trust questions anymore, I fell into the rabbit hole that is DNSSEC. Our domain already uses DNSSEC, so I only had to set up the resolver in our office and my PC to verify it. This however had the side effect that child zones that are not signed were no longer resolving so I thought "Lets just sign them. Can't be that hard, right?" I was very wrong. One of the child zones is for hosts using DHCP and is managed by dnsmasq that unfortunately can't sign the zone. But it can do zone transfers. So we tried a setup using opendnssec as a signing proxy that transfers the zone to an unbound. Unfortunately this has proven unreliable at best and broken at worst so I am looking to replace that. I was just looking around for a DHCP server that directly can sign the zone but I was unable to find something so far. So I was wondering how other people are doing this. Are you signing DHCP zones? Would you recommend (not) doing it? If you are doing it, how are you doing it? Kind regards, Julian PS: If you are at RIPE86 I also would be happy to discuss this in person :) -- Julian Fölsch Arbeitsgemeinschaft Dresdner Studentennetz (AG DSN) Teamsprecher Computing Tel.: +49 351 271816 69 E-Mail: julian.foelsch(a)agdsn.de StuRa der TU Dresden Helmholtzstr. 10 01069 Dresden

4 4

Proposed Service Criticality Forms
by Paul de Weerd 15 May '23

15 May '23

Dear Colleagues, During the DNS WG session at RIPE 84 in May, we discussed the Service Criticality Framework (https://ripe84.ripe.net/wp-content/uploads/presentations/101-101-Technology… and https://ripe84.ripe.net/archives/video/811). We mentioned that we would like the Working Group's input on the criticality ratings for K-Root and AuthDNS. We have completed the forms internally and would like to share them with you. We hope to receive your feedback by 23 December. Best regards, Paul de Weerd RIPE NCC

1 1