Focus on:
All days
May 12, 2019
May 13, 2019
Indico style
Indico style - inline minutes
Indico style - numbered
Indico style - numbered + minutes
Indico Weeks View
Back to Conference View
Choose Timezone
Use the event/category timezone
Specify a timezone
Africa/Abidjan
Africa/Accra
Africa/Addis_Ababa
Africa/Algiers
Africa/Asmara
Africa/Bamako
Africa/Bangui
Africa/Banjul
Africa/Bissau
Africa/Blantyre
Africa/Brazzaville
Africa/Bujumbura
Africa/Cairo
Africa/Casablanca
Africa/Ceuta
Africa/Conakry
Africa/Dakar
Africa/Dar_es_Salaam
Africa/Djibouti
Africa/Douala
Africa/El_Aaiun
Africa/Freetown
Africa/Gaborone
Africa/Harare
Africa/Johannesburg
Africa/Juba
Africa/Kampala
Africa/Khartoum
Africa/Kigali
Africa/Kinshasa
Africa/Lagos
Africa/Libreville
Africa/Lome
Africa/Luanda
Africa/Lubumbashi
Africa/Lusaka
Africa/Malabo
Africa/Maputo
Africa/Maseru
Africa/Mbabane
Africa/Mogadishu
Africa/Monrovia
Africa/Nairobi
Africa/Ndjamena
Africa/Niamey
Africa/Nouakchott
Africa/Ouagadougou
Africa/Porto-Novo
Africa/Sao_Tome
Africa/Tripoli
Africa/Tunis
Africa/Windhoek
America/Adak
America/Anchorage
America/Anguilla
America/Antigua
America/Araguaina
America/Argentina/Buenos_Aires
America/Argentina/Catamarca
America/Argentina/Cordoba
America/Argentina/Jujuy
America/Argentina/La_Rioja
America/Argentina/Mendoza
America/Argentina/Rio_Gallegos
America/Argentina/Salta
America/Argentina/San_Juan
America/Argentina/San_Luis
America/Argentina/Tucuman
America/Argentina/Ushuaia
America/Aruba
America/Asuncion
America/Atikokan
America/Bahia
America/Bahia_Banderas
America/Barbados
America/Belem
America/Belize
America/Blanc-Sablon
America/Boa_Vista
America/Bogota
America/Boise
America/Cambridge_Bay
America/Campo_Grande
America/Cancun
America/Caracas
America/Cayenne
America/Cayman
America/Chicago
America/Chihuahua
America/Ciudad_Juarez
America/Costa_Rica
America/Creston
America/Cuiaba
America/Curacao
America/Danmarkshavn
America/Dawson
America/Dawson_Creek
America/Denver
America/Detroit
America/Dominica
America/Edmonton
America/Eirunepe
America/El_Salvador
America/Fort_Nelson
America/Fortaleza
America/Glace_Bay
America/Goose_Bay
America/Grand_Turk
America/Grenada
America/Guadeloupe
America/Guatemala
America/Guayaquil
America/Guyana
America/Halifax
America/Havana
America/Hermosillo
America/Indiana/Indianapolis
America/Indiana/Knox
America/Indiana/Marengo
America/Indiana/Petersburg
America/Indiana/Tell_City
America/Indiana/Vevay
America/Indiana/Vincennes
America/Indiana/Winamac
America/Inuvik
America/Iqaluit
America/Jamaica
America/Juneau
America/Kentucky/Louisville
America/Kentucky/Monticello
America/Kralendijk
America/La_Paz
America/Lima
America/Los_Angeles
America/Lower_Princes
America/Maceio
America/Managua
America/Manaus
America/Marigot
America/Martinique
America/Matamoros
America/Mazatlan
America/Menominee
America/Merida
America/Metlakatla
America/Mexico_City
America/Miquelon
America/Moncton
America/Monterrey
America/Montevideo
America/Montserrat
America/Nassau
America/New_York
America/Nome
America/Noronha
America/North_Dakota/Beulah
America/North_Dakota/Center
America/North_Dakota/New_Salem
America/Nuuk
America/Ojinaga
America/Panama
America/Paramaribo
America/Phoenix
America/Port-au-Prince
America/Port_of_Spain
America/Porto_Velho
America/Puerto_Rico
America/Punta_Arenas
America/Rankin_Inlet
America/Recife
America/Regina
America/Resolute
America/Rio_Branco
America/Santarem
America/Santiago
America/Santo_Domingo
America/Sao_Paulo
America/Scoresbysund
America/Sitka
America/St_Barthelemy
America/St_Johns
America/St_Kitts
America/St_Lucia
America/St_Thomas
America/St_Vincent
America/Swift_Current
America/Tegucigalpa
America/Thule
America/Tijuana
America/Toronto
America/Tortola
America/Vancouver
America/Whitehorse
America/Winnipeg
America/Yakutat
Antarctica/Casey
Antarctica/Davis
Antarctica/DumontDUrville
Antarctica/Macquarie
Antarctica/Mawson
Antarctica/McMurdo
Antarctica/Palmer
Antarctica/Rothera
Antarctica/Syowa
Antarctica/Troll
Antarctica/Vostok
Arctic/Longyearbyen
Asia/Aden
Asia/Almaty
Asia/Amman
Asia/Anadyr
Asia/Aqtau
Asia/Aqtobe
Asia/Ashgabat
Asia/Atyrau
Asia/Baghdad
Asia/Bahrain
Asia/Baku
Asia/Bangkok
Asia/Barnaul
Asia/Beirut
Asia/Bishkek
Asia/Brunei
Asia/Chita
Asia/Choibalsan
Asia/Colombo
Asia/Damascus
Asia/Dhaka
Asia/Dili
Asia/Dubai
Asia/Dushanbe
Asia/Famagusta
Asia/Gaza
Asia/Hebron
Asia/Ho_Chi_Minh
Asia/Hong_Kong
Asia/Hovd
Asia/Irkutsk
Asia/Jakarta
Asia/Jayapura
Asia/Jerusalem
Asia/Kabul
Asia/Kamchatka
Asia/Karachi
Asia/Kathmandu
Asia/Khandyga
Asia/Kolkata
Asia/Krasnoyarsk
Asia/Kuala_Lumpur
Asia/Kuching
Asia/Kuwait
Asia/Macau
Asia/Magadan
Asia/Makassar
Asia/Manila
Asia/Muscat
Asia/Nicosia
Asia/Novokuznetsk
Asia/Novosibirsk
Asia/Omsk
Asia/Oral
Asia/Phnom_Penh
Asia/Pontianak
Asia/Pyongyang
Asia/Qatar
Asia/Qostanay
Asia/Qyzylorda
Asia/Riyadh
Asia/Sakhalin
Asia/Samarkand
Asia/Seoul
Asia/Shanghai
Asia/Singapore
Asia/Srednekolymsk
Asia/Taipei
Asia/Tashkent
Asia/Tbilisi
Asia/Tehran
Asia/Thimphu
Asia/Tokyo
Asia/Tomsk
Asia/Ulaanbaatar
Asia/Urumqi
Asia/Ust-Nera
Asia/Vientiane
Asia/Vladivostok
Asia/Yakutsk
Asia/Yangon
Asia/Yekaterinburg
Asia/Yerevan
Atlantic/Azores
Atlantic/Bermuda
Atlantic/Canary
Atlantic/Cape_Verde
Atlantic/Faroe
Atlantic/Madeira
Atlantic/Reykjavik
Atlantic/South_Georgia
Atlantic/St_Helena
Atlantic/Stanley
Australia/Adelaide
Australia/Brisbane
Australia/Broken_Hill
Australia/Darwin
Australia/Eucla
Australia/Hobart
Australia/Lindeman
Australia/Lord_Howe
Australia/Melbourne
Australia/Perth
Australia/Sydney
Canada/Atlantic
Canada/Central
Canada/Eastern
Canada/Mountain
Canada/Newfoundland
Canada/Pacific
Europe/Amsterdam
Europe/Andorra
Europe/Astrakhan
Europe/Athens
Europe/Belgrade
Europe/Berlin
Europe/Bratislava
Europe/Brussels
Europe/Bucharest
Europe/Budapest
Europe/Busingen
Europe/Chisinau
Europe/Copenhagen
Europe/Dublin
Europe/Gibraltar
Europe/Guernsey
Europe/Helsinki
Europe/Isle_of_Man
Europe/Istanbul
Europe/Jersey
Europe/Kaliningrad
Europe/Kirov
Europe/Kyiv
Europe/Lisbon
Europe/Ljubljana
Europe/London
Europe/Luxembourg
Europe/Madrid
Europe/Malta
Europe/Mariehamn
Europe/Minsk
Europe/Monaco
Europe/Moscow
Europe/Oslo
Europe/Paris
Europe/Podgorica
Europe/Prague
Europe/Riga
Europe/Rome
Europe/Samara
Europe/San_Marino
Europe/Sarajevo
Europe/Saratov
Europe/Simferopol
Europe/Skopje
Europe/Sofia
Europe/Stockholm
Europe/Tallinn
Europe/Tirane
Europe/Ulyanovsk
Europe/Vaduz
Europe/Vatican
Europe/Vienna
Europe/Vilnius
Europe/Volgograd
Europe/Warsaw
Europe/Zagreb
Europe/Zurich
GMT
Indian/Antananarivo
Indian/Chagos
Indian/Christmas
Indian/Cocos
Indian/Comoro
Indian/Kerguelen
Indian/Mahe
Indian/Maldives
Indian/Mauritius
Indian/Mayotte
Indian/Reunion
Pacific/Apia
Pacific/Auckland
Pacific/Bougainville
Pacific/Chatham
Pacific/Chuuk
Pacific/Easter
Pacific/Efate
Pacific/Fakaofo
Pacific/Fiji
Pacific/Funafuti
Pacific/Galapagos
Pacific/Gambier
Pacific/Guadalcanal
Pacific/Guam
Pacific/Honolulu
Pacific/Kanton
Pacific/Kiritimati
Pacific/Kosrae
Pacific/Kwajalein
Pacific/Majuro
Pacific/Marquesas
Pacific/Midway
Pacific/Nauru
Pacific/Niue
Pacific/Norfolk
Pacific/Noumea
Pacific/Pago_Pago
Pacific/Palau
Pacific/Pitcairn
Pacific/Pohnpei
Pacific/Port_Moresby
Pacific/Rarotonga
Pacific/Saipan
Pacific/Tahiti
Pacific/Tarawa
Pacific/Tongatapu
Pacific/Wake
Pacific/Wallis
US/Alaska
US/Arizona
US/Central
US/Eastern
US/Hawaii
US/Mountain
US/Pacific
UTC
Save
Asia/Bangkok
English (United States)
Deutsch (Deutschland)
English (United Kingdom)
English (United States)
Español (España)
Français (France)
Italiano (Italia)
Polski (Polska)
Português (Brasil)
Türkçe (Türkiye)
Čeština (Česko)
Монгол (Монгол)
Українська (Україна)
中文 (中国)
Login
OARC 30 (Bangkok, Thailand)
from
Sunday, May 12, 2019 (8:30 AM)
to
Monday, May 13, 2019 (6:00 PM)
Monday, May 6, 2019
Tuesday, May 7, 2019
Wednesday, May 8, 2019
Thursday, May 9, 2019
Friday, May 10, 2019
Saturday, May 11, 2019
Sunday, May 12, 2019
8:30 AM
Registration
Registration
8:30 AM - 9:30 AM
Room: Ballroom 1 Foyer
9:30 AM
Introduction to DNS-OARC
-
Keith Mitchell
(
DNS-OARC
)
Introduction to DNS-OARC
(Public Workshop)
Keith Mitchell
(
DNS-OARC
)
9:30 AM - 9:45 AM
Room: Ballroom 1
9:45 AM
DNS Recursive Resolver Delegation Selection in the Wild
-
Kyle Schomp
(
Akamai Technologies
)
DNS Recursive Resolver Delegation Selection in the Wild
(Public Workshop)
Kyle Schomp
(
Akamai Technologies
)
9:45 AM - 10:15 AM
Room: Ballroom 1
DNS zones should have multiple nameservers. Combined, RFC 1034 and RFC 2182 require that zones have at least two topologically and geographically distributed nameservers. A primary reason for multiple nameservers is to increase robustness in the face of individual failures. Thus, many zones including those considered critical to many enterprises operate with a large number of NS records per zone. This provides recursive resolvers with a choice: which nameserver to contact when sending each DNS query? Previous research has studied the behavior of specific recursive resolver software in the lab and the behavior of recursive resolvers in the wild using synthetic traffic loads. This previous work shows that many recursive resolvers will attempt to home in on the lower RTT nameservers and prefer sending DNS queries to them. In this work, we look at the recursive resolvers’ choice of nameserver under production workloads of several zones important to the Akamai platform. We observe how many and how significantly recursive resolvers prefer nameservers by RTT given real world DNS query rates. We go on to consider the impact that this has on performance and security with an eye toward improvements that can be made.
10:15 AM
Developing a Testbed For Interactions Between Resolvers and the Root
-
Paul Hoffman
(
ICANN
)
Developing a Testbed For Interactions Between Resolvers and the Root
(Public Workshop)
Paul Hoffman
(
ICANN
)
10:15 AM - 10:30 AM
Room: Ballroom 1
At RSSAC's request, the RSSAC Caucus is developing a testbed to simulate resolvers interaction with the root servers. The initial areas of inquiry that were requested by RSSAC are root server selection, priming, and caching, but more areas might be tested later. The testbed will consist of copies of many versions of open source resolvers as well as the ability to test other resolver software such as Windows Server. It will also have mechanisms to model delays between a resolver and the 13 root servers, as well as different contents of the root zone (such as signing with different DNSSEC algorithms). The development of this system has started, but it is not complete. Instructions for setting up the test bed are open, and it is expected to be completed in fall 2019. This presentation covers the testbed design, components of the testbed, current status, how researchers can participate in the development of the testbed, and the plan for completing the testbed and running the first sets of simulations.
10:30 AM
Morning Break
Morning Break
10:30 AM - 11:00 AM
Room: Ballroom 1 Foyer
11:00 AM
The Modality of Mortality in Domain Names
-
Paul Vixie
(
Farsight Security
)
The Modality of Mortality in Domain Names
(Public Workshop)
Paul Vixie
(
Farsight Security
)
11:00 AM - 11:30 AM
Room: Ballroom 1
Domain names established for routine use are typically registered for one or more years, and faithfully renewed thereafter. Knowing nothing else, we'd expect that a domain existing today will still be there tomorrow. This is an expectation of 'domain continuity'. Other domains get treated as effectively being 'disposable'. Those domains get registered, quickly abused for cybercrime-related purposes (such as spamming, phishing, malware distribution, etc.), and are then abandoned after becoming unusable due to being blacklisted or 'held' by registrar action. In this study, we've obtained an ongoing feed of 'Newly Observed Domains' from Farsight Security's SIE, and then periodically probed those names from global measurement points to determine: What fraction of new domain names 'die a premature death' due to being blocklisted or suspended? What causes the 'death' of those domains? Do they mostly get blocklisted? Or do they 'die' due to action by registrars or others? What does the survival curve for those names look like over time? Are there differences between the traditional gTLDs, ccTLDs and ICANN's new gTLDs? Vixie will address these topics and make recommendations as to how to reduce domain name abuse.
11:30 AM
DNS Security: Past, Present, and Future (It’s Not Easy)
-
Ralf Weber
(
Nominum Inc
)
DNS Security: Past, Present, and Future (It’s Not Easy)
(Public Workshop)
Ralf Weber
(
Nominum Inc
)
11:30 AM - 12:00 PM
Room: Ballroom 1
DNS and security have a long sometimes adverse relationship. The last decade was mostly securing the authenticity of DNS data with DNSSEC. After several tries it got slow operator uptake even as new attacks on the DNS were discovered. After the 2014 Snowden revelations the focus shifted to securing the DNS transport channel. The formation of the IETF dprive working group brought fresh ideas and people into the DNS community and resulted in the release of DNS over TLS (RFC 7858) followed by the doh working group releasing DNS over HTTPs (RFC 8484). We’ve always had documentation or problems with definitional scope with new standards and in this case there will be a need for new operational practices. This talk will describe issues we’re likely to encounter and discuss ways we might deal with them (or not!) in the future.
12:00 PM
Who Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path
-
Chaoyi Lu
(
Tsinghua University
)
Baojun Liu
(
Tsinghua University
)
Who Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path
(Public Workshop)
Chaoyi Lu
(
Tsinghua University
)
Baojun Liu
(
Tsinghua University
)
12:00 PM - 12:30 PM
Room: Ballroom 1
DNS is a critical service for almost all Internet applications. Since almost all DNS queries are sent in plain-text, it’s possible for transparent proxies to intercept DNS queries sent to public resolvers, and surreptitiously respond using alternative resolvers instead. However, this kind of hidden interception can introduce privacy and security issues to client users. Understanding the characterizes of hidden DNS interception is by no means trivial. It’s very challenging to observe interception because we need vantages points sharing the same network with interceptors. We solved this problem by re-targeting the proxy and a popular security software used by a large number of real-world users to conduct the measurement study. In the end, we performed a first large-scale measurement study of on-path DNS interception and shed light on its scope and characterizes. In practice, we designed a novel approach to detecting interception and deployed a global measurement platform. As different transport protocols and various recursive servers are considered, our measurement study is achieved with good depth and breadth. The key observation is that, among the 3,047 ASes that we investigate, we find intercepted DNS queries in 259 ASes. Particularly, 27.9% DNS/UDP queries from China to Google Public DNS are intercepted. Our research provides a first large-scale study on DNS end-to-end violation. Our work delivers strong evidence of DNS interception and serves as strong motivation of deploying DNS-over-Encryption. After being published, our findings are reported by several well-known media, such as ACM Technews, The Register, and Hackread. Our paper also gets comments from Nick Sullivan, head of cryptography at Cloudflare, that “this paper accelerates the need to transite DNS from an unencrypted protocol to one that protected by strong encryption and authentication technologies.”
12:30 PM
Lunch Break
Lunch Break
12:30 PM - 2:00 PM
Room: Volti Restaurant
2:00 PM
Multi-signer DNSSEC Models
-
Shumon Huque
(
Salesforce
)
Jan Včelák
(
NS1
)
Multi-signer DNSSEC Models
(Public Workshop)
Shumon Huque
(
Salesforce
)
Jan Včelák
(
NS1
)
2:00 PM - 2:30 PM
Room: Ballroom 1
Many enterprises today employ the service of multiple DNS providers to operate their authoritative DNS service. Two providers are fairly typical and this allows the DNS service to survive a complete failure of any single provider. Deploying DNSSEC in such an environment can have some challenges depending on the configuration and feature set in use. In particular, large enterprises often make use of a number of non-standardized DNS features, that necessitates having each provider independently sign the DNS zone data with a coordinated set of keys. We will present several operationally viable deployment models for multi signer DNSSEC. One of the goals of this talk is to generate interest in these models and encourage managed DNS providers to support them (encouragingly, several are already planning to do so), as this will solve an important deployment hurdle for enterprise DNSSEC. Additionally, it may be possible to leverage the multi-signer models to allow non-disruptive handoff of DNSSEC signed zones from one DNS operator to another. We now have an early implementation of some of the key management mechanisms needed to deploy the multi-signer models, and will share details of the implementation.
2:30 PM
A Story on Unsupported DNSSEC Algorithms
-
Matthijs Mekking
(
ISC
)
A Story on Unsupported DNSSEC Algorithms
(Public Workshop)
Matthijs Mekking
(
ISC
)
2:30 PM - 3:00 PM
Room: Ballroom 1
RFC 6944 provides an applicability statement on algorithm implementation status for DNSSEC component software. ince its publication new DNSSEC algorithms have arrived and recommendations on existing algorithms have changed. The IETF document draft-ietf-dnsop-algorithm-update plans to obsolete RFC 6944. DNS vendors are actively following the new implementation requirements. Can we expect issues when a server has removed support for a certain algorithm when another server is still actively using it? This presentation covers the expected and observed behavior of DNS servers when interacting with DNSSEC unsupported algorithms.
3:00 PM
Signing with offline KSK in Knot DNS 2.8
-
Jaromír Talíř
(
CZ.NIC
)
Signing with offline KSK in Knot DNS 2.8
(Public Workshop)
Jaromír Talíř
(
CZ.NIC
)
3:00 PM - 3:30 PM
Room: Ballroom 1
CZ.NIC's DNSSEC operations involve signing with offline KSK. This has been traditionally managed by a set of shell scripts. DNS administrators for .CZ together with KnotDNS developers joined together to design and implement this functionality into the KnotDNS DNSSEC signer. This feature was released in KnotDNS 2.8. This presentation describes the feature in the context of current operations in .CZ.
3:30 PM
Afternoon Break
Afternoon Break
3:30 PM - 4:00 PM
Room: Ballroom 1 Foyer
4:00 PM
Seeing the effects of DNS Flag Day in action
-
Willem Toorop
(
NLnet Labs
)
Seeing the effects of DNS Flag Day in action
(Public Workshop)
Willem Toorop
(
NLnet Labs
)
4:00 PM - 4:15 PM
Room: Ballroom 1
DNS Flag Day is a collaborative effort and agreement of DNS implementers and DNS resolver operators, in which they have committed themselves to no longer provide work-arounds for non-standard compliant authoritative nameservers as of 1 February 2019. In the run-up to DNS Flag day, and as part of the outreach, the focus for measurements was always the authoritative nameservers that needed to be fixed. With this presentation we take the other perspective and have a look at public resolvers and resolver implementations. What was resolver behaviour on the Internet before DNS Flag Day, and how does the uptake of dropping work-arounds disseminate in the wild?
4:15 PM
DNS flag day 2019 panel discussion
-
Ondrej Sury
(
Internet Systems Consortium
)
John Todd
(
Quad9
)
Brian Hartvigsen
(
OpenDNS
)
Ólafur Guðmundsson
(
CloudFlare
)
Ralph Dolmans
(
NLnet Labs
)
Puneet Sood
(
Google
)
Petr Špaček
(
CZ.NIC
)
DNS flag day 2019 panel discussion
(Public Workshop)
Ondrej Sury
(
Internet Systems Consortium
)
John Todd
(
Quad9
)
Brian Hartvigsen
(
OpenDNS
)
Ólafur Guðmundsson
(
CloudFlare
)
Ralph Dolmans
(
NLnet Labs
)
Puneet Sood
(
Google
)
Petr Špaček
(
CZ.NIC
)
4:15 PM - 5:00 PM
Room: Ballroom 1
This panel discussion will focus on the 2019 DNS Flag Day effort, where vendors of major open source DNS resolvers and operators of several major public DNS resolver services committed to removing workarounds for incorrect behavior on the part of authoritative DNS servers that have failed to follow basic DNS protocol standards established two decades ago. The panel will include representatives of the software vendors and public resolver services. Topics to be discussed will include an assessment of the impact of Flag Day, lessons learned, and suggestions for what form a future flag day might take. Please [submit your questions](https://docs.google.com/forms/d/e/1FAIpQLSfXY1j4mzeEZ-U2lSuZk3OuEq3LMlUPnmdNkPhohakxTLrzuw/viewform) for discussion beforehand, it will help us to moderate the discussion.
5:00 PM
The road to the Ultimate Stub-resolver
-
Ólafur Guðmundsson
(
CloudFlare
)
The road to the Ultimate Stub-resolver
(Public Workshop)
Ólafur Guðmundsson
(
CloudFlare
)
5:00 PM - 5:30 PM
Room: Ballroom 1
Stub-resolvers do not got much attention in the DNS world. They are frequently dumb and simple, that is fine in some situations. Cloudflare operates systems all over the world that do lots of DNS requests, those requests are highly time critical with high reliability requirement. We have evolved the system from simple Unix stub resolver to resolver on each box, through a series of tiered setups. In each step of the way we tried to measure the performance impacts and document the failures we encountered on the way. In addition the modern DNS world with DNSSEC and new transports over DoT, DoH, DoQ really call for obsoleting the old style sub-resolvers. We will outline the basic operating principles for modern stub-resolvers based on our experiences, both corporate and personal, by operating or testing bind, dnssec-trigger, dnsdist, knot, stubby and unbound.
6:00 PM
Social (chargeable) Event - Cruise with food & drink
Social (chargeable) Event - Cruise with food & drink
6:00 PM - 8:30 PM
Room: NEXT2 Dock
Monday, May 13, 2019
8:30 AM
Registration
Registration
8:30 AM - 9:00 AM
Room: Ballroom 1 Foyer
9:00 AM
OpenINTEL - Creating a "long-term memory" for the global DNS
-
Willem Toorop
(
NLnet Labs
)
OpenINTEL - Creating a "long-term memory" for the global DNS
(Public Workshop)
Willem Toorop
(
NLnet Labs
)
9:00 AM - 9:30 AM
Room: Ballroom 1
In this talk we present the OpenINTEL project. The project started with the idea that we wanted to create reliable time series about the DNS once every 24 hours for as large a part of the name space as we could manage. Since we started measuring in February of 2015, we have grown our measurement to cover over 216 million domain names on a daily basis (approximately 60% of the global name space). It currently incorporates almost all gTLDs and a growing number of ccTLDs. We will explain why we want to collect this data, how we do this (responsibly) and provide examples of currently ongoing research that illustrates how this data can be used. The examples include 1) studies into DNSSEC operational practices that led to improvements in DNSSEC incentive schemes, 2) ongoing work on DNS resilience and 3) the stupidest thing we could find in a TXT record. With this talk we also hope to reach out to ccTLD operators to convince them to contribute data to our project.
9:30 AM
DNSKEY Flood what does that tell us about resolvers
-
Ólafur Guðmundsson
(
CloudFlare
)
Ray Bellis
(
Internet Systems Consortium, Inc.
)
DNSKEY Flood what does that tell us about resolvers
(Public Workshop)
Ólafur Guðmundsson
(
CloudFlare
)
Ray Bellis
(
Internet Systems Consortium, Inc.
)
9:30 AM - 10:00 AM
Room: Ballroom 1
When ICANN rolled over the KSK for the first time in October 2018 things apparently went smoothly with only a few minor incidents reported, but after a while it became evident that some resolvers did not like the rollover. This can be measured by looking at the DNSKEY queries from those resolvers which in some cases have increased by 100x at F-root. Some of those resolvers in this process expose a number of interesting behavioral patterns. In some cases this may expose the query frequency and in others the upstream selection algorithm. We will explain the patterns using data collected by a subset of F-root instances around the world and look at geographical differences. In some cases this may expose the query frequency and in others the upstream selection algorithm.
10:00 AM
KSK Rollover Post-Analysis
-
Duane Wessels
(
Verisign
)
KSK Rollover Post-Analysis
(Public Workshop)
Duane Wessels
(
Verisign
)
10:00 AM - 10:30 AM
Room: Ballroom 1
October 2018 saw the culmination of a years-long project to roll the root zone DNSSEC Key Signing Key. More recently, the old KSK was published as revoked. In this presentation we use passively and actively collected datasets to explore how validating recursive name servers were impacted by the root zone KSK rollover and revocation. This data includes RFC 8145 trust anchor signals, query traffic to root servers, and "root canary" measurements made via RIPE Atlas probes. While the rollover and revocation are generally perceived to be a non-event, our data shows some significant changes in behavior by individual DNS clients that may have impacted end user queries. These analyses and techniques may be useful in planning and conducting future KSK rollovers.
10:30 AM
Morning Break
Morning Break
10:30 AM - 11:00 AM
Room: Ballroom 1 Foyer
11:00 AM
Local DNS Policy Disclosure: Comments on Automating Policy Discovery
-
David Dagon
Local DNS Policy Disclosure: Comments on Automating Policy Discovery
(Public Workshop)
David Dagon
11:00 AM - 11:30 AM
Room: Ballroom 1
11:30 AM
What part of “NO” is so hard to understand?
-
Geoff Huston
(
APNIC
)
What part of “NO” is so hard to understand?
(Public Workshop)
Geoff Huston
(
APNIC
)
11:30 AM - 11:45 AM
Room: Ballroom 1
An examination of the DNS query profile for non-existent names, looking at the extent to which the resolver infrastructure generates synthetic re-queries for non-existent names
11:45 AM
Incentivizing the adoption of (new) standards
-
Maarten Wullink
(
SIDN
)
Incentivizing the adoption of (new) standards
(Public Workshop)
Maarten Wullink
(
SIDN
)
11:45 AM - 12:00 PM
Room: Ballroom 1
In this presentation i will discuss the incentive program of SIDN (.nl ccTLD) The goal of this program is to create incentives for registrars to implement standards such as IPv6, DMARC, STARTTLS, DKIM and SPF. Some of the points i will talk about are: - incentive rules - how we measure compliance - results See attached pdf and powerpoint for a first presentation draft.
12:00 PM
Measures against cache poisoning attacks using IP fragmentation in DNS
-
Kazunori Fujiwara
(
Japan Registry Services Co., Ltd
)
Measures against cache poisoning attacks using IP fragmentation in DNS
(Public Workshop)
Kazunori Fujiwara
(
Japan Registry Services Co., Ltd
)
12:00 PM - 12:30 PM
Room: Ballroom 1
Researchers proposed DNS cache poisoning attacks using IP fragmentation. This talk reports them and proposes feasible and adequate measures at full-service resolvers against these attacks. To protect resolvers from these attacks, avoid fragmentation (limit requestor's UDP payload size to 1220/1232), drop fragmented UDP DNS responses and use TCP at resolver side. And more, it will report current status of fragmentation and EDNS0 payload size. It is time to consider to avoid IP Fragmentation (and path MTU discovery) in DNS. It is not good that DNS is the biggest user of IP fragmentation. (draft-fujiwara-dnsop-fragment-attack)
12:30 PM
Lunch Break
Lunch Break
12:30 PM - 2:00 PM
Room: Volti Restaurant
1:30 PM
PGP signing session
-
Matthew Pounsett
(
Nimbus
)
PGP signing session
Matthew Pounsett
(
Nimbus
)
1:30 PM - 2:00 PM
Room: Ballroom 1
Please send your keys to <pgpsign@dns-oarc.net> if participating.
2:00 PM
Flamethrower: A flexible tool for DNS load and functional testing
-
Jan Včelák
(
NS1
)
Flamethrower: A flexible tool for DNS load and functional testing
(Public Workshop)
Jan Včelák
(
NS1
)
2:00 PM - 2:30 PM
Room: Ballroom 1
[Flamethrower][1] is a new DNS performance and functional testing utility. Originally envisioned as an “improved dnsperf” and allowing simulation of realistic looking traffic patterns it has become a versatile tool for DNS server development and load testing. We will discuss motivations for its existence, its features, technical architecture, and use cases. The tool has been developed at [NS1][2], has been open-sourced in January 2019, and currently lives on DNS-OARC's GitHub. [1]: https://github.com/DNS-OARC/flamethrower [2]: https://ns1.com
2:30 PM
Hyper-hyper-local root serving
-
Ray Bellis
(
Internet Systems Consortium, Inc.
)
Hyper-hyper-local root serving
(Public Workshop)
Ray Bellis
(
Internet Systems Consortium, Inc.
)
2:30 PM - 3:00 PM
Room: Ballroom 1
I've recently developed a prototype "root zone only" server which can be deployed within local networks to provide an on-site root server without putting a copy of the root zone within each recursor (c.f. RFC 7706). The software is fast, and scalable (it'll run on anything from a RPi3 up to high-end multicore servers, so long as it's running on Linux). I've also built an (almost) turn-key distribution for the Raspberry Pi, such that a root server can be turned up just by copying the binary image to an SD card, editing a text file to configure its IP address and then powering it on. This talk will introduce the concept, talk about the Linux networking stack and how packet flows are optimised on multi-core / multi-nic queue systems, and also discuss how the root zone is particularly amenable to pre-computation of answers.
3:00 PM
respdiff: Regression and interoperability testing for the Internet
-
Petr Špaček
(
CZ.NIC
)
respdiff: Regression and interoperability testing for the Internet
(Public Workshop)
Petr Špaček
(
CZ.NIC
)
3:00 PM - 3:30 PM
Room: Ballroom 1
We present open-source tool called "[respdiff][1]" which can be used for regression and interoperability testing of DNS implementations. In principle, the tool sends the very same DNS query to various implementations and compares their answers using configurable criteria. This approach, when combined with DNS resolvers connected to the Internet, allows us to detect protocol incompatibilities before a new software release is made available to users. Our approach works relatively well if a human is evaluating the test results, but automating test result evaluation proved to be more difficult. The presentation will discuss limitations of the method and solicit feedback from the audience. [1]: https://gitlab.labs.nic.cz/knot/respdiff/blob/master/README.rst
3:30 PM
Afternoon Break
Afternoon Break
3:30 PM - 4:00 PM
Room: Ballroom 1 Foyer
4:00 PM
Hold: Lightning Talks
Hold: Lightning Talks
4:00 PM - 4:45 PM
Room: Ballroom 1
Identifier Technology Health Indicators
-
Paul Hoffman
(
ICANN
)
Identifier Technology Health Indicators
Paul Hoffman
(
ICANN
)
4:00 PM - 4:05 PM
Room: Ballroom 1
4:05 PM
Oh, another DoH
-
Jaromír Talíř
(
CZ.NIC
)
Oh, another DoH
(Lightning Talks)
Jaromír Talíř
(
CZ.NIC
)
4:05 PM - 4:10 PM
Room: Ballroom 1
Few weeks ago we upgraded ODVR that CZ.NIC has operated for about 10 years. New version is based on latest Knot Resolver 4.0 and it allows to test new experimental implementation of DoH inside resolver. We have an idea that DoH may help us resurrect our popular tool DNSSEC validator.
4:10 PM
DNSCrypt
-
Brian Hartvigsen
(
OpenDNS
)
DNSCrypt
Brian Hartvigsen
(
OpenDNS
)
4:10 PM - 4:15 PM
Room: Ballroom 1
4:15 PM
DNS Flag day: kiwi flavour
-
Sebastian Castro
(
InternetnNZ
)
DNS Flag day: kiwi flavour
(Lightning Talks)
Sebastian Castro
(
InternetnNZ
)
4:15 PM - 4:25 PM
Room: Ballroom 1
Lighting talk telling the story how we mostly fixed DNS Flag day in .nz
4:25 PM
Whither DANE?
-
Shumon Huque
(
Salesforce
)
Whither DANE?
Shumon Huque
(
Salesforce
)
4:25 PM - 4:35 PM
Room: Ballroom 1
What's going on with DANE? Will it really happen? Status of protocol specifications. Where DANE has had some success. The sad saga of DANE prospects for the web.
4:45 PM
Welcome from OARC Chairman
-
Duane Wessels
(
Verisign
)
Welcome from OARC Chairman
(Public Workshop)
Duane Wessels
(
Verisign
)
4:45 PM - 4:50 PM
Room: Ballroom 1
4:50 PM
OARC Status Report
-
Keith Mitchell
(
DNS-OARC
)
OARC Status Report
(OARC Business (Open to all))
Keith Mitchell
(
DNS-OARC
)
4:50 PM - 5:10 PM
Room: Ballroom 1
5:10 PM
OARC Engineering Report
-
Matthew Pounsett
(
DNS-OARC
)
Jerry Lundström
(
DNS-OARC
)
OARC Engineering Report
(OARC Business (Open to all))
Matthew Pounsett
(
DNS-OARC
)
Jerry Lundström
(
DNS-OARC
)
5:10 PM - 5:30 PM
Room: Ballroom 1