Introduction to DNS-OARC

• Keith Mitchell (DNS-OARC)

Room: Bayview Room Introduction to DNS-OARC.

DNSSEC Recursive Resolution From the Ground Up (Public Workshop)

• Brian Somers (OpenDNS, FreeBSD)

Room: Bayview Room RFC4033 introduced DNSSEC back in 2005. There are now many recursive resolver implementations which have evolved over the past 15 years, but implemeneting something from scratch can be a dangerous path. Are our RFCs clear? Are all of the "understood" pitfalls clear? This talk looks at OpenDNS/Cisco's path to DNSSEC support in their recursive resolver. It goes from understanding the protocol to coming up with a development and deploy strategy. Preparing the existing DNSSEC-unaware codebase was a difficult step, as was arranging our task board so that we could parallelize development. The implications of NSEC and NSEC3 were unexpected and the effect of wildcard records on validation behaviour was a surprise. There were even several points were RFCs were simply mis-read, causing turmoil way down the road (repeat something often enough and we all believe it's the truth!). Finally, executing on our deployment strategy didn't play out as expected. Maybe our path is unsurprising, but it's a story worth telling!

The Different Ways of Minimizing ANY (Public Workshop)

• Edward Lewis (ICANN)

Room: Bayview Room The DNS Protocol has features that have grown to become liabilities. The query type "ANY" is one. Earlier this year a published RFC document describes how a DNS server may respond to such queries while reducing the liability. But the document does not define a definitive means for a server to signal that it is differing from the original protocol. This presentation measures of the impact of having no definitive means specified and examines the "fear, uncertainty, and doubt" of lacking explicit signals.

DNS response rate speedup by using XDP (Public Workshop)

• Libor Peltan (CZ.NIC)

Room: Bayview Room For an authoritative DNS server, high response rate is not only useful to serve many clients, but also to withstand some flood attack attempts. While the basic answering routines are well optimized in most open-source DNS servers, profiling disclosed that 30% to 70% of CPU time of a highly-loaded server is spent on network I/O. It's not that Linux syscalls would be ineffectively implemented, but they do too much: firewall, routing, queuing, etc. Using Berkeley Packet Filter, we can capture DNS-over-UDP packets before they arrive to Linux network stack, while passing the other traffic to the stack. Further, using eXpress Data Path, we can process the captured packets in our DNS application, and send the responses also bypassing the Linux stack. In my talk, I will summarize the feature design, examine the obvious and hidden limitations, and share practical experiences from implementing XDP in Knot DNS authoritative server.

Motives and Methods for Managed Private Network DNS (Public Workshop)

• Paul Vixie (Farsight Security)

Room: Bayview Room With Resolverless DNS, and before that DNS over HTTPS, and soon HTTP/3 (QUIC), the web industry is making a very strong attempt to completely control the DNS metadata required for web browsers to reach web services. While there are some political aspects to this redrawing of the DNS resolution path, there are also security implications for operators of managed private networks which are not public, are not regulated, and have no "customers". These operators have reasons they consider important for keeping DNS resolution out of the hands of device, browser, and other app makers. In this presentation, Dr. Vixie will enumerate the DNS-related risks posed to operators of managed private networks by the increasing dominance of DNS-related web industry ambitions. Some proposals will be described as to the costs and benefits of absolute insistence upon local network control over DNS resolution.

DNS Encryption Operational Experience and Insights (Public Workshop)

• Ralf Weber (Akamai Technologies)
• Mark Dokter (Akamai)

Room: Bayview Room ISPs play an essential role in the internet ecosystem and the new DNS encryption protocols change the landscape, introducing numerous new architectural and operational issues for their DNS resolution infrastructure. This presentation will cover deployment practices based on early implementations at numerous ISPs around the world. It will also discuss operating considerations introduced by the changes to the legacy DNS protocol. Data and insights from live servers will also be presented.

Status of DoH/TRR in Firefox (Public Workshop)

• Eric Rescorla (Mozilla)

Room: Bayview Room Mozilla has been working to deploy DNS over HTTPS (DoH) in Firefox. We report on the status of Mozilla's deployment, learnings from our rollout so far, our Trusted Recursive Resolver (TRR) program, and the future evolution of DoH/TRR.

The Present and Future of BIND 9 (Public Workshop)

• Evan Hunt (ISC)

Room: Bayview Room A discussion of recent development work in BIND 9, including the "DNSSEC Made Easy" key and signing policy features, and advanced new networking code for improved performance and easier implementation of DNS-over-TLS and DNS-over-HTTPS in the next release.

Updates to F-Root (Public Workshop)

• Dan Mahoney (ISC)

Room: Bayview Room This presentation will cover recent changes in ISC's F-root system, including how we have evolved from using legacy routers and hardware, to working with single-box solutions designed to work within a peering exchange. Brief mentions will be made about tooling on both the frontend and the backend, as well as routing table discoveries, and operating system choices, and some unexpected lessons learned.

Using the Ethereum blockchain to complement and expand the capabilities of DNS (Public Workshop)

• Brantly Millegan (Ethereum Name Service (ENS))

Room: Bayview Room The open source project Ethereum Name Service (ENS) is the leading blockchain-based naming infrastructure project. Managed by a small non-profit with support of the Ethereum Foundation, today we provide naming mostly for the cryptocurrency wallet naming space (we have around 50 wallets signed up) and the emerging decentralized (IPFS-based) web (native integration in Opera, a few blockchain-focused mobile browsers, and others via extension). But we're also doing research on using blockchain technology to serve the existing DNS tech stack, as well as various projects with EnCirca, .KRED, .ART, and others in the DNS space. This presentation will be a quick overview of how our system works, how it serves the DNS namespace (including how we've integrated that namespace for use on our system), and our ideas of how it can complement the existing DNS.

Forever Young - TTL and RRSIG lifetimes (Public Workshop)

• Ulrich Wisser (IIS)

Room: Bayview Room A deep dive in the world of TTL values of the ccTLD world. Which values are used and why? Guidelines for choosing TTL values and the interdependencies of TTL values. A closer look on RRSIG lifetimes, the interdependencies on TTL values and what RRSIG lifetimes mean for disaster recovery including a view on real life examples.

DNS Analysis and Threats with IPv6 Automatic Transition Mechanisms (Public Workshop)

• John Kristoff

Room: Bayview Room Large content providers such as Google and Akamai report that at least 20% of all client systems are using IPv6 and that most do so using native IPv6 transport. Until recently, Microsoft Windows operating systems shipped with with 6to4, ISATAP, and Teredo IPv6 transition mechanisms enabled by default. While these transition mechanisms are widely panned and increasingly obsolete, for millions of systems they are turned on and ready to be activated, and for many systems, they are used when only IPv4 transport is available. This talk summarizes DNS aspects of recent research work exploring the dangers that linger from these transition mechanisms. A very brief technical overview of 6to4, ISATAP, and Teredo IPv6 automatic transition mechanisms will be provided.