Conveners
OARC 47 Day 2: Day 2 Session 1
- Merike Kaeo (Double Shot Security)
OARC 47 Day 2: Day 2 Session 2
- Ulrich Wisser (IIS)
OARC 47 Day 2: Day 2 Session 3
- Cathy Almond (Internet Systems Consortium)
OARC 47 Day 2: Members AGM
- There are no conveners in this block
SIDN has been operating its own DNS anycast platform for a few years using Equinix Metal. Unfortunately, Equinix decided to sunset this service mid 2026, so we were forced to migrate.
After selecting a new vendor, we decided to adopt a data-driven approach; using the well-tried Manycastr tool, we collected data from all available i3D PoPs to all resolvers querying for the .nl TLD. From this...
DNS operators instrument the DNS layer closely — query volume, latency, resolution failures, DNSSEC validation — but the routing layer underneath is usually a blind spot. Anycast DNS services, root servers, and authoritative infrastructure all depend on BGP announcing the right origin AS over a legitimate path, and when that breaks, DNS-layer signals often stay healthy right up until they...
On June 30th, 2026 the root server operators observed an increase in query rates to approximately double normal levels. The additional traffic originated from a small number of related autonomous systems and, while significant in terms of volume, did not appear to be an attack.
Upon establishing contact with the originating network, they were able to identify the reason and roll back...
RDAP has become the IETF-standard protocol for accessing Internet number registration data, offering structured responses, HTTPS transport, authentication, and extensibility beyond the capabilities of traditional WHOIS. A transition from WHOIS to RDAP represents more than a protocol change - it represents a significant evolution in how Internet number registration data is accessed, secured,...
The Domain Name System has traditionally provided a hierarchical namespace for identifying Internet hosts and services. Emerging applications such as drones and IoT devices extend this role beyond conventional Internet resources, requiring not only globally unique identification and resolution, but also new mechanisms to establish trust, such as cryptographically binding an identifier to the...
QNAME minimization (RFC 7816 / RFC 9156) reduces the information a recursive resolver leaks to upstream authoritative servers, but it does so by walking a name's label hierarchy one query at a time. For the vast majority of names this costs little, but for names with an unusually deep label structure, the same incremental walk can multiply the number of upstream queries needed to resolve a...
Opportunistic encryption of recursive to authoritative transports (Op-ADoX) is still in the early days of development and deployment. Unilateral (but blind) probing of alternative transports suggested in RFC9539 has seen only limited deployment to-date for a variety of reasons, and end users are not yet benefiting from the range of protections offered by Op-ADoX.
In this talk we will...
Many Internet services use composite DNS queries, where one domain is embedded within a query to another service. Translation platforms, email link protection systems, reputation services, and content delivery networks rely on this approach. While these services provide valuable functionality, they also make it harder to determine the true destination from DNS data alone, creating a visibility...
In recent years, benchmarking tools have been extended to support new transports like DNS-over-TLS, HTTPS, and QUIC. These features are orders of magnitude more complex than the good old UDP and TCP, and this complexity provides fertile ground for bugs.
To make things even worse, "Who tests the testing tools?" Hardly anyone.
We developed a test suite for the testing tools and uncovered...
Over the last few DNS-OARC workshops, we have been floating the idea of creating a group inside the OARC community to create a DNS Best Current Practices set of documents. Last year at OARC 45 we started the OARC BCP initiative.
The goal was set to create a centralized gateway to introduce DNS best
operational practices to different actors.
A year later, where do we stand? This...
