DNSSEC - The NLnet Labs Blog

Sign in Subscribe

DNSSEC

A collection of 11 posts

Hope Is Not a Strategy

Hope Is Not a Strategy

Open source software is often the unglamorous workhorse in your server rack, the silent operator in your stack, and the punk soul in your operations pipeline. It's thoroughly tested and trusted for all the right reasons. But when your business depends on it, you still need a lifeline.

The Illusion of Five Nines

The Illusion of Five Nines

In most industries, service providers boast about five nines availability — 99.999%. That sounds impressive: just five minutes of downtime per year. But DNS isn’t like most industries. For top-level domains, downtime is not acceptable. If a registry goes dark, hospitals, banking systems, and e-commerce all go offline with

The DNSSEC Illusion: 16 TLDs revealed the hidden fragility in DNSSEC ops

The DNSSEC Illusion: 16 TLDs revealed the hidden fragility in DNSSEC ops

For years, a European TLD ran their DNSSEC toolchain without incident. Everything “just worked.” Updates were rare, and no one touched the setup. Then their only DNSSEC expert left. What looked like stability turned out to be fragility. The system wasn’t resilient — it was dependent on one person’s

Zone verification, the feature formerly known as CreDNS, formerly known as dnSƧexy

Zone verification, the feature formerly known as CreDNS, formerly known as dnSƧexy

NLnet Labs is pleased to announce version 4.6.0 of NSD. This release integrates and revives zone verification, a feature previously shipped in a separate product called CreDNS, which had its last release (0.2.10) in June 2012.

Supporting DNSSEC Key Signing Ceremonies

Supporting DNSSEC Key Signing Ceremonies

Over the past decade, uptake of DNSSEC has grown significantly. The vast majority of top-level domains (TLDs) is now DNSSEC-signed. While key signing ceremonies are now deployed in many places in the DNSSEC community, what is lacking is a common approach, especially related to tooling.

SAD DNS and NLnet Labs DNS software

SAD DNS and NLnet Labs DNS software

Update 18 November 2021: we are aware of the follow-up paper published by the researchers. The text below remains accurate for Unbound users. Please note that Unbound 1.13.2 and newer has IPv6 PMTU disabled for UDP. During the ACM CCS conference 2020, held November 9-13, researchers from UC

Sunrise DNS over TLS, sunset DNSSEC?

Sunrise DNS over TLS, sunset DNSSEC?

Is DNSSEC still needed when you get your DNS over TLS?

Bringing DNS Security and Privacy to the End User

Bringing DNS Security and Privacy to the End User

How the getdns API project helps to achieve the goal of DNSSEC validation and DANE authentication at the end-points.

Algorithm Rollover in OpenDNSSEC 1.3

Algorithm Rollover in OpenDNSSEC 1.3

Roll to a new algorithm securely with OpenDNSSEC 1.3.x if you are clever about it and don’t mind some manual intervention.

Hackathon at TNW-2014

Hackathon at TNW-2014

At NLnet Labs we believe that DNSSEC allows for security innovations that will change the global security and privacy landscape.

RRL SLIP and Response Spoofing

RRL SLIP and Response Spoofing

By Wouter Wijngaards The recent disclosure by ANSSI (CVE-2013–5661) notes problems with RRL Slip and response spoofing. This document explains explains the tradeoffs. Other documents with advice: * French announcement from ANSSI: http://www.certa.ssi.gouv.fr/site/CERTA-2013-AVI-506/index.html * Dutch vuln announcement: https://www.ncsc.nl/.../NCSC-2013-0597.