Archive for category Uncategorized

In this post on Twitter, Nominet IT director Simon McCalla announces that .uk is now signed.

We’ve updated the program for the daylong session “What’s Next in DNSSEC” at the FOSE conference and expo, coming up later in March.  Go here to see the current roster of speakers and topics on DNSSEC deployment in the federal government, state government, public-private systems, commercial networks and more.

Over at the Internet Systems Consortium blog, Paul Vixie has offered this post, Whither DNSCurve? to answer the question he frequently gets: “what is DNSCurve and what’s ISC’s position on it given our long involvement in DNSSEC?”  He concludes with this summation:

I want provably correct DNS content to be universally available.  Not just for me but for the entire population of the Internet.  I want to stamp out all forms of DNS intermediation whether by recursive nameserver operators or nation-states or hackers.  Because DNSSEC can do this, ISC has invested a lot of time and money over the last dozen years helping to develop DNSSEC. Because DNSCurve does not do this, and because the problems DNSCurve actually does solve are pretty well solved by UDP source port randomization and will be entirely eradicated by DNSSEC, ISC is not investing in DNSCurve at all.

Nominet has begun signing the .uk country code top-level domain this week, a process expected to conclude March 8. According to the article in PC Advisor, “Nominet will begin signing ‘.co.uk’ – comprising more than 8 million websites – later this year, working with any entity that operates a nameserver, as their software will have to be upgraded for DNSSEC.”

Shumon Huque of the University of Pennsylvania reports that the winter ESCC/Internet 2 Joint Techs meeting featured these talks focused on DNSSEC deployment:

• In a talk on the .EDU DNSSEC testbed, Huque and Larry Blunk of Merit Network reviewed DNSSEC plans and features for the .EDU top-level domain, managed by Educause; results of the domain’s DNSSEC testbed conducted by VeriSign and Educause; and how .EDU domain holders will interact with the DNSSEC enabled .EDU registration system.
• Michael Sinatra of the University of California, Berkeley, discussed DNSSEC on Campus, focusing on “real-world experience” based on UC Berkeley’s work signing zones and validating those of others, and participating in a DNSSEC testbed.
• The DNSSEC Rollout Experiences at U.S. Department of Energy National Labs panel included representatives from the Ames Laboratory; the Argonne, Brookhaven and Oak Ridge National Laboratories; and the Energy Sciences Network (ES.net), discussing DNSSEC deployment at national labs in the wake of U.S. federal government requirements.

The meeting took place in Salt Lake City, Utah, January 31-February 2.

RIPE Labs has reported the initial results from an effort to measure DNS transfer size, to determine whether larger DNSSEC responses would pose problems once the K-root begins to provide DNSSEC responses to requesting resolvers, and whether the larger responses would reach the resolvers.  From the article: “The good news is that the vast majority of measurements yield transfer sizes that will fit current DNSSEC answers from root name servers,” although “some resolvers that could experience time-outs and delays due to misconfigurations and middleware.”