Posts by matt.

Episode 49

Cricket and Matt took advantage of being in the same place for once to record the podcast, though that doesn’t stop us from forgetting which episode number we’re actually recording.  We answer four questions on subjects relating to SPF, DNSSEC, /etc/host.conf and authoritative server selection by recursive name servers.  On that last topic, Matt refers to research on server selection he contributed to and promised a link to the paper in the show notes.  The paper is “Authority Server Selection of DNS Caching Resolvers” and was published in ACM SIGCOMM Computer Communication Review (CCR), April 2012.

Play

Root DNSSEC Key Ceremony 27 Attestation


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday, October 27, I attended the Root DNSSEC Key Ceremony 27,
administered by Public Technical Identifiers (PTI), the administrator
of the IANA functions and an affiliate of ICANN, which was held in
PTI's key management facility (KMF) in Culpeper, Virginia, USA.

ICANN and PTI are in the process of rolling the root zone key-signing
key (KSK) and details about that project are available at:

https://www.icann.org/resources/pages/ksk-rollover

I attest that a new key intended to be the next root zone KSK was
generated at that ceremony, and that the following DS record
corresponds to the newly generated key:

. IN DS 20326 8 2 E06D44B80B8F1D39A95COBOD7C65D08458E880409BBC683457104237C7F8EC8D

The key will not be declared operationally ready until it is imported
into the hardware security modules (HSMs) in PTI's second KMF in El
Segundo, CA, at the next root key ceremony planned for February, 2017.
Provided that ceremony is successful and that subsequent root KSK
rollover plans proceed according to schedule, the key attested to
above will become the next root zone KSK and be used to sign the root
zone's key set on October 11, 2017.

I further attest that the ceremony followed the script published at
https://data.iana.org/ksk-ceremony/27/KC27_Script.pdf, with one minor
exception relating to the formatting of USB drives used to transport
signed material out of the ceremony room.

Disclosure: I am employed by ICANN as VP of Research and sometimes act
as a Ceremony Administrator (CA) for root key ceremonies.

Matt Larson
28 October 2017
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlgTpoMACgkQATXaA1CYG0VqFgCeINrlVQDIDAMZO0RtlftiNYMj
5CgAniFE+fdA9MQY/BE3VwG0dEvhHsU/
=sM6f
-----END PGP SIGNATURE-----

Episode 48

In Episode 48, we are pleased to welcome Bert Hubert of PowerDNS fame to the show.  We reach into the mailbag to answer Nic Waller’s question about measuring which names in a zone are actually queried, Jesus Cea asked about proving domain ownership to obtain a Let’s Encrypt certificate (which caused us to do some actual research before recording!), and long-suffering listener Yiorgos Adamopoulos gamely sent in a question about using the block chain for name resolution.  As usual, we indulge in light banter completely unrelated to DNS, this time on outrageous cell phone roaming charges and Dutch pipe organs.

 

Play

Episode 45

We’re back again, scraping the bottom of the mailbag for questions.  Erik Radde helped us out with a question on the interaction of wildcards and the search list, and Lenny Tropiano tweeted a question at Mr. DNS about Dyn’s support for a feature that provides CNAME-like semantics at a zone apex.  Along the way there were detours into the three laws of thermodynamics and, more importantly as the AI revolution grows ever closer, the three laws of robotics.

 

Play

Episode 43

In this, our holiday episode, we’re joined by returning special guest, Duane Wessels, who discusses a recent event involving the root name servers and a lot of obviously spoofed traffic, as well as his ongoing work in the IETF around DNS privacy.  We reach into the mail bag and find a question from our friend, Rob Fleischman, musing about possible additional metadata that recursive servers could send to authoritative servers.  As it happens, Duane’s also working on a DNS protocol extension directly related to Rob’s question, which he tells us about.  Finally, we end with a brief and spoiler-free discussion about The Force Awakens.

Play

Episode 42

In Episode 42, we discuss the meaning of life, the universe and everything with a very special guest, @dnsreactions, creator of the hit DNS Reactions Tumblr.  “DR”, as we call him or her (or it?), prefers to stay anonymous, so we have obscured his/her/its voice using the magic of technology.  Our long-suffering listeners submitted questions for DR, who was very accommodating.  Enjoy!

Play

Episode 41

Welcome to our special Halloween episode!  Okay, not really, but we are recording in late October…  This time we answer a record-breaking three questions from the same listener, Grant Taylor, who single-handedly supplied the material for all our tangents in this show.  We remind everyone of the dangers of cache poisoning in a discussion about CNAMEs, we strain our memories back to the early days of DNSSEC to discuss SIG(0), and we explain and opine on EDNS Client Subnet, a recent and increasingly popular DNS protocol extension.  Considering the time of year, we also lapse into a discussion of candy, specifically peanut M&Ms.

Play

Episode 37

Back after a long absence they try to avoid talking about, Cricket and Matt tackle some meat-and-potatoes questions: Why can’t one have a CNAME with other records at a domain name? Are registrars buying up expired domain names? How can one make a name server generate answers dynamically?  Listen as Matt embarrasses himself by forgetting the name of the Registry-Registrar Protocol (RRP), the predecessor to the Extensible Provisioning Protocol (EPP), used today between registrars and registries.  Cricket’s memory is working fine, though, as he dredges up a reference to lbnamed, a simple, Perl-based name server now remembered only by Google and DNS geeks.  And as usual, there are tangents: the episode winds up with an impromptu discussion of standing desks and how Matt is an effective but not-at-all-subtle choral conductor.

Play

Episode 31

In this, their inaugural episode for 2013, Cricket and Matt answer a question from the mysterious “Joe” (if that is his real name) about the differences between BIND’s stub zone and conditional forwarding features, prompting some reminiscing about the good old days of BIND 8.  This episode is the third in which we tackle questions from apparent long-time listener Yiorgos Adamopoulos, who wonders about the various features of dig and if Mr. DNS still writes code.

Play

Root DNSSEC Key Attestation

On June 16, 2010, I witnessed the generation of the first root zone key-signing key in the first key ceremony held by ICANN, the IANA functions operator, at its key ceremony facility in Culpeper, VA.  I attest that the following DS record corresponds to the key generated at that ceremony:

. IN DS 19036 8 2  49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5

The canonical location of the root zone trust anchor information is http://data.iana.org/root-anchors. Also included there are supporting material and explanatory documentation.

A PGP-signed version of this attestation is available here.

Matt Larson
July 16, 2010