Root zone update for TLD managers Mexico City, Mexico March 2009
|
|
|
- Eric Price
- 8 years ago
- Views:
Transcription
1 Root zone update for TLD managers Mexico City, Mexico March 2009 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers
2 A quick census
3 280 delegated
4 11 testing 280 delegated
5 280 delegated 11 testing 1.arpa
6 11 testing 280 delegated 1.arpa 248 country codes
7 11 testing 20 g s 280 delegated 1.arpa 248 country codes
8 11 testing 13 sponsored 20 g s 280 delegated 1.arpa 248 country codes
9 11 testing 13 sponsored 20 g s 3 generic restricted 280 delegated 1.arpa 248 country codes
10 11 testing 20 g s 280 delegated 1.arpa 248 country codes 13 sponsored 3 generic restricted 4 unrestricted
11 11 testing 13 sponsored 20 g s 3 generic restricted 280 delegated 4 unrestricted 1.arpa 248 country codes 242 in ISO
12 280 delegated 11 testing 13 sponsored 20 g s 3 generic restricted 4 unrestricted 1.arpa 248 country codes 242 in ISO
13 280 delegated 11 testing 13 sponsored 20 g s 3 generic restricted 4 unrestricted 1.arpa 248 country codes 242 in ISO former countries
14 280 delegated 11 testing 13 sponsored 20 g s 3 generic restricted 4 unrestricted 1.arpa 248 country codes 242 in ISO exceptional current countries 3 former countries
15 280 delegated 11 testing 13 sponsored 20 g s 3 generic restricted 4 unrestricted 1.arpa 246 in country codes 242 in ISO exceptional current countries 3 former countries
16 280 delegated 11 testing 13 sponsored 20 g s 3 generic restricted 4 unrestricted 1.arpa 246 in country codes 242 in ISO not deleg. 6 3 exceptional current countries 3 former countries
17 Technical Conformance
18 Technical Conformance Bring our minimum technical criteria for root zone changes up to date Phasing in: Prohibition on open recursive name servers More appropriate name server diversity requirement No fragmentation of root zone referrals
19 1 Open recursive name servers Not good network citizens Open to cache poisoning attacks (Kaminsky, et.al) Open to amplification attacks Not required for authoritative service
20 1 Open recursive name servers Not good network citizens Open to cache poisoning attacks (Kaminsky, et.al) Open to amplification attacks Not required for authoritative service
21 2 Network diversity for name servers Current informal rule is a minimum of two not in the same /24 subnet Not very relevant to networks today Each IP address on the Internet s network location is derived through announcements in the global routing table using BGP Each network is roughly organised into a group called an autonomous system Require name servers to be announced in at least two different autonomous systems
22 .CX ns.cx-nic.org.nz[ ] ns.anycast.nic.cx[ ] cx1.dyntld.net[ ] cx2.dyntld.net[ ] cx3.dyntld.net[ ] cx4.dyntld.net[ ]
23 .CX ns.cx-nic.org.nz[ ] ns.anycast.nic.cx[ ] cx1.dyntld.net[ ] cx2.dyntld.net[ ] cx3.dyntld.net[ ] cx4.dyntld.net[ ] Hostway Corporation Pty Ltd WoodyNet Dynamic Network Services, Inc. Dynamic Network Services, Inc. Dynamic Network Services, Inc. Dynamic Network Services, Inc.
24 .CX ns.cx-nic.org.nz[ ] ns.anycast.nic.cx[ ] cx1.dyntld.net[ ] cx2.dyntld.net[ ] cx3.dyntld.net[ ] cx4.dyntld.net[ ] Hostway Corporation Pty Ltd WoodyNet Dynamic Network Services, Inc. Dynamic Network Services, Inc. Dynamic Network Services, Inc. Dynamic Network Services, Inc. 3 distinct networks
25 .CX ns.cx-nic.org.nz[ ] ns.anycast.nic.cx[ ] cx1.dyntld.net[ ] cx2.dyntld.net[ ] cx3.dyntld.net[ ] cx4.dyntld.net[ ] Hostway Corporation Pty Ltd WoodyNet Dynamic Network Services, Inc. Dynamic Network Services, Inc. Dynamic Network Services, Inc. Dynamic Network Services, Inc. 3 distinct networks
26 None cctlds with AS diversity
27 100% IPv4 diversity 0%
28 Pushing the envelope... IANA currently has a minimum set of technical requirements for IPv4 name service. These include two nameservers separated by geography and by network topology, that each serve a consistent set of data, and are reachable from multiple locations across the globe. The registry will meet this same criterion for IPv6, requiring IPv6 transport to their network. Evaluation Criterion #40 Draft gtld Applicant Guide Book
29 100% IPv4 diversity IPv6 diversity 0%
30 100% IPv4 diversity any IPv6 IPv6 diversity 0%
31 None cctlds with AS diversity over IPv6
32 3 Referrals should not fragment A query for a domain name to the root servers results in a referral to a TLD s authorities
33 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at
34 3 Referrals should not fragment A query for a domain name to the root servers should result in a referral to the TLD s authorities Classical limit for response size is 512 bytes If the root server needs to send back more than 512 bytes of in a response, it will need to establish a much more complicated TCP connection, rather than use the simpler UDP protocol. This is not good for load and reliability
35
36 Where is iana.org?
37 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at
38 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at
39 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN
40 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK
41 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK
42 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org?
43 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at ns3.org ns4.org
44 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at ns3.org ns4.org TCP ACK
45 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at ns3.org ns4.org TCP ACK TCP FIN ACK
46 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at ns3.org ns4.org TCP ACK TCP FIN ACK TCP ACK
47 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at ns3.org ns4.org TCP ACK TCP FIN ACK TCP ACK TCP FIN ACK
48 Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at TCP SYN TCP SYN ACK TCP ACK Where is iana.org? I don t know, ask the.org name servers: ns1.org at ns2.org at ns3.org ns4.org TCP ACK TCP FIN ACK TCP ACK TCP FIN ACK TCP ACK
49 Limiting referral size Reduce the number of name servers Take advantage of name compression
50 ns1.iana.org and ns2.iana.com 3 n s 1 4 i a n a 3 o r g 0 3 n s 2 4 i a n a 3 c o m 0 Bytes used for names = 28
51 ns1.iana.org and ns2.iana.com 3 n s 1 4 i a n a 3 o r g 0 3 n s 2 4 i a n a 3 c o m 0 ns1.iana.org and ns2.iana.org Bytes used for names = 28 3 n s 1 4 i a n a 3 o r g 0 3 n s 2 2 byte pointer Bytes used for names = 20 8 bytes saved
52 Limiting referral size Reduce the number of name servers Take advantage of name compression The more domains are shared for authorities, the better the compression outcome Tradeoff you are now more reliant on certain domains
53 The bottom line
54 The bottom line TLDs with open recursive name servers 9.6%
55 The bottom line TLDs with open recursive name servers 9.6% TLDs without diverse IPv4 connectivity 7.2%
56 The bottom line TLDs with open recursive name servers 9.6% TLDs without diverse IPv4 connectivity 7.2% TLDs without diverse IPv6 connectivity 68.7%
57 The bottom line TLDs with open recursive name servers 9.6% TLDs without diverse IPv4 connectivity 7.2% TLDs without diverse IPv6 connectivity 68.7%... without any IPv6 41.0%
58 The bottom line TLDs with open recursive name servers 9.6% TLDs without diverse IPv4 connectivity 7.2% TLDs without diverse IPv6 connectivity 68.7%... without any IPv6 41.0% TLDs with referrals that can fragment 4.3%
59 How IDN cctld applications will be processed (in theory)
60
61
62 Signing the Root Zone
63 Signing the root zone? ICANN s strategic plan is to be operationally ready Signed root test bed operating for over a year System is built with advice from current DNSSEC operators, and many other experts in both DNS and cryptography ICANN already signs 11 top-level domains operationally, and incrementally signing the last remaining zones under our control
64 Register on Thursday, October 2, 2008 (73 FR 57336). The Council s Research Steering Committee (Committee) will address a range of issues including a briefing on the status of NMFS Cooperative Research Program activities and Signing the root zone? funding. The Committee also will ICANN developed review preliminary a proposal work of the to sign the root Committee zone will which re-examine, was and submitted to US Government NEFMC s 5-year research priorities. The possibly revise, the evaluation criteria for cooperative research priorities subject to review by the Committee as well as review a small number of cooperative research project final reports. The Committee will also discuss the use of a workshop format to conduct future Committee management reviews. Finally, the Committee will discuss outstanding issues related to the VeriSign followed up with a different proposal to sign the root zone The US Government has issued a Notice of time Inquiry allows. The to Committee seek views may relating to signing the DNS root zone, which was open to comments until November 24. Council s research set-aside programs if consider other topics at their discretion. Although non-emergency issues not contained in this agenda may come before this group for discussion, those issues may not be the subject of formal action during this meeting. Action will be restricted to those issues specifically listed in this notice and any issues arising after publication of this notice that require emergency action under section 305(c) of the Magnuson-Stevens ACTION: Notice of Inquiry SUMMARY: The Department of Commerce (Department) notes the increase in interest among government, technology experts and industry representatives regarding the deployment of Domain Name and Addressing System Security Extensions (DNSSEC) at the root zone level. The Department remains committed to preserving the security and stability of the DNS and is exploring the implementation of DNSSEC in the DNS hierarchy, including at the authoritative root zone level. Accordingly, the Department is issuing this notice to invite comments regarding DNSSEC implementation at the root zone. DATES: Comments are due on November 24, ADDRESSES: Written comments may be submitted by mail to Fiona Alexander, Associate Administrator, Office of International Affairs, National Telecommunications and Information Administration, U.S. Department of Commerce, 1401 Constitution Avenue, N.W., Room 4701, Washington, DC Written comments may also be sent by facsimile to (202) or electronically via electronic mail to DNSSEC@ntia.doc.gov. Comments will be posted on NTIA s website at the com tra po mo D To vu En the em pro pro Int att to and the and is d for tha pro is a int exi any the pro den att T all wi
65 Interim Trust Anchor Repository
66 Interim Trust Anchor Repository A mechanism to publish keys of top-level domains that currently implement DNSSEC If the root zone is DNSSEC signed, such a repository is unnecessary Therefore this is a stopgap measure Should be decommissioned when the root is signed
67 root com org se!" iana.com iana.org #$%!"
68 root com org se!" iana.com iana.org #$%!"
69 root com org se!" iana.com iana.org #$%!"
70 root com org se!" iana.com iana.org #$%!"
71 root com org se!" iana.com iana.org #$%!"
72 root KEYS I TRUST root com org se!" iana.com iana.org #$%!"
73 root KEYS I TRUST root com org se!" iana.com iana.org #$%!"
74 root com org se!" iana.com iana.org #$%!"
75 root com org se!" iana.com iana.org #$%!"
76 root com org se!" iana.com iana.org #$%!"
77 root KEYS I TRUST se!" com org se!" iana.com iana.org #$%!"
78 root KEYS I TRUST se!" com org se!" iana.com iana.org #$%!"
79 root KEYS I TRUST se!" com org se!" iana.com iana.org #$%!" ITAR
80 Benefits Fully meets a set of recommendations provided by RIPE Simple to use for both top-level domain operators, and end users. Works with different DNS software, different protocols, etc. Non proprietary. Almost fully automated Helps DNSSEC deployment
81
82
83 itar.iana.org
84 Interim Trust Anchor Repository Mexico City, Mexico March 2009 Thanks!
IANA Functions to cctlds Sofia, Bulgaria September 2008
IANA Functions to cctlds Sofia, Bulgaria September 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers What is IANA? Internet Assigned Numbers Authority
The IANA Functions. An Introduction to the Internet Assigned Numbers Authority (IANA) Functions
The IANA Functions An Introduction to the Internet Assigned Numbers Authority (IANA) Functions Contents SECTION 1: INTRODUCTION 4 SECTION 2: POLICY, STAKEHOLDERS AND STEWARDSHIP IMPLEMENTATION 6 SECTION
Kim Davies Internet Assigned Numbers Authority
Introducing IANA Baltic Region and Eastern Europe International Seminar The Internet & the post-wsis environment: enhancing dialogue among the stakeholders Riga 2006 Kim Davies Internet Assigned Numbers
Computer Networks: Domain Name System
Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com
Topics of Interest Iraklion, Greece June 2008
Topics of Interest Iraklion, Greece June 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda ICANN Budget for 2009 Interim Trust Anchor Repository
The Internet Ecosystem and ICANN!! Steve Sheng @ Stanford University, Center for Information and Society! 29 April 2013!
The Internet Ecosystem and ICANN!! Steve Sheng @ Stanford University, Center for Information and Society! 29 April 2013! Ecosystem! + A network of interactions among organisms, and between organisms and
An introduction to IANA Presentation Notes
An introduction to IANA Presentation Notes Date 29 September 2008 Contact Kim Davies, Manager of Root Zone Services kim.davies@icann.org While the Internet is renowned for being a worldwide network free
Comments on Docket Number 0810021307-81308-1, Enhancing the Security and Stability of the Internet s Domain Name and Addressing System
The Office of International Affairs National Telecommunications and Information Administration U.S. Department of Commerce Ms. Fiona Alexander Comments on Docket Number 0810021307-81308-1, Enhancing the
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How does the DNS work? A typical DNS query The
Securing DNS Infrastructure Using DNSSEC
Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias rmohan@afilias.info February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival
Basic DNS Course. Module 1. DNS Theory. Ron Aitchison ZYTRAX, Inc. Page 1 of 24
Basic DNS Course Module 1 Ron Aitchison ZYTRAX, Inc. Page 1 of 24 The following are the slides used in this Module of the course. Some but not all slides have additional notes that you may find useful.
110207099 1099 01] RIN 0660 XA23:
![110207099 1099 01] RIN 0660 XA23:](/thumbs/27/11605322.jpg "110207099 1099 01] RIN 0660 XA23:")
Fiona M. Alexander Associate Administrator Office of International Affairs National Telecommunications and Information Administration 1401 Constitution Avenue, NW., Room 4701 Washington, DC 20230 By electronic
Internet Structure and Organization
Internet Structure and Organization Resources management and allocation Bernard.Tuy@renater.fr Introduction What s the Internet? Why organizations / bodies are needed? Define protocol specifications Agree
Innovating with the Domain Name System: From Web to Cloud to the Internet of Things
Innovating with the Domain System: From Web to Cloud to the Internet of Things Dr. Burt Kaliski, Jr. Senior Vice President, Chief Technology Officer WHD.Asia 2014 September 2, 2014 Agenda Ecosystem Innovations
Telecom and Internet Regulatory Challenges and Opportunities Names, Numbers, Internet Governance
Telecom and Internet Regulatory Challenges and Opportunities Names, Numbers, Internet Governance Global Forum ICT & The Future of Internet Bucharest, Romania, 19-20 October 2009 Theresa Swinehart Vice-President
Distributed Systems. 22. Naming. 2013 Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 22. Naming Paul Krzyzanowski Rutgers University Fall 2013 November 21, 2013 2013 Paul Krzyzanowski 1 My 15 MacBook Pro The rightmost computer on my desk Paul s aluminum laptop, but
Verisign/ICANN Proposal in Response to NTIA Request
Verisign/ICANN Proposal in Response to NTIA Request Root Zone Administrator Proposal Related to the IANA Functions Stewardship Transition Introduction On March 14, 2014, NTIA announced its intent to transition
Current Counter-measures and Responses by the Domain Name System Community
Current Counter-measures and Responses by the Domain Name System Community Paul Twomey President and CEO 22 April 2007 APEC-OECD Malware Workshop Manila, The Philippines 1 What I want to do today in 15
DNS Root NameServers
DNS Root NameServers An Overview Dr. Farid Farahmand Updated: 9/24/12 Who- is- Who! Over half million networks are connected to the Internet 5 billion users by 2015! Network numbers are managed by ICANN
A Quick Introduction to the Domain Name System
A Quick Introduction to the Domain Name System David Conrad Chief Technology Officer Overview Introduction to the DNS DNS Components DNS Structure and Hierarchy The DNS in Context
Response to Solicitation Number: SA-13-01-6R-P0-016
Response to Solicitation Number: SA-13-01-6R-P0-016 Offered by: Internet Corporation for Assigned Names and Numbers 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292 USA +1-310-823-9358 (tel) +1-310-823-8649
Before the. Committee on Energy and Commerce Subcommittee on Communications and Technology United States House of Representatives
Testimony of Fiona M. Alexander Associate Administrator, Office of International Affairs National Telecommunications and Information Administration United States Department of Commerce Before the Committee
Network Working Group Request for Comments: 1591 Category: Informational March 1994. Domain Name System Structure and Delegation. Status of this Memo
Network Working Group J. Postel Request for Comments: 1591 ISI Category: Informational March 1994 Domain Name System Structure and Delegation Status of this Memo This memo provides information for the
PLAN FOR ENHANCING INTERNET SECURITY, STABILITY, AND RESILIENCY
PLAN FOR ENHANCING INTERNET SECURITY, STABILITY, AND RESILIENCY June 2009 Table of Contents Executive Summary... 1 ICANN s Role... 2 ICANN Security, Stability and Resiliency Programs... 3 Plans to Enhance
Use Domain Name System and IP Version 6
Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)
New gtld Basics New Internet Extensions
New gtld Basics New Internet Extensions Agenda Overview about domain names, gtld timeline and the New gtld Program Why is ICANN doing this; potential impact of this initiative to businesses, governments,
2014 IANA FUNCTIONS CUSTOMER SERVICE SURVEY RESULTS. Survey by Ebiquity Report by Leo Vegoda & Marilia Hirano
2014 IANA FUNCTIONS CUSTOMER SERVICE SURVEY RESULTS Survey by Ebiquity Report by Leo Vegoda & Marilia Hirano November 2014 Table of Contents Survey objective 1 Executive summary 2 Methodology 4 General
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
Distributed Systems. 09. Naming. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 09. Naming Paul Krzyzanowski Rutgers University Fall 2015 October 7, 2015 2014-2015 Paul Krzyzanowski 1 Naming things Naming: map names to objects Helps with using, sharing, and communicating
Internet Security and Resiliency: A Collaborative Effort
Internet Security and Resiliency: A Collaborative Effort Baher Esmat Manager, Regional Relations Middle East MENOG 4 Manama, 9 April 2009 1 WHAT IS THIS PRESENTATION ABOUT? ICANN s effort in enhancing
F-Root's DNSSEC Signing Plans. Keith Mitchell Internet Systems Consortium DNS-OARC NANOG48, Austin, 24 th Feb 2010
F-Root's DNSSEC Signing Plans Keith Mitchell Internet Systems Consortium DNS-OARC NANOG48, Austin, 24 th Feb 2010 What is ISC? Internet Systems Consortium, Inc. Headquartered in Redwood City, California
2015 IANA Functions Customer Service Survey Results
2015 IANA Functions Customer Service Survey Results Report on the third annual customer service satisfaction survey administered by Ebiquity Marilia Hirano November 2015 Contents Survey objective... 3
Domain Name System. CS 571 Fall 2006. 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved
Domain Name System CS 571 Fall 2006 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved DNS Specifications Domain Names Concepts and Facilities RFC 1034, November 1987 Introduction
Vorlesung Kommunikationsnetze Domain Name System
Picture 15 13 Vorlesung Kommunikationsnetze Domain Name System Prof. Dr. H. P. Großmann mit B. Wiegel sowie A. Schmeiser und M. Rabel Sommersemester 2009 Institut für Organisation und Management von Informationssystemen
Recommendations for dealing with fragmentation in DNS(SEC)
Recommendations for dealing with fragmentation in DNS(SEC) Abstract DNS response messages can sometimes be large enough to exceed the Maximum Transmission Unit (MTU) size for the underlying physical network.
THE DOMAIN NAME INDUSTRY BRIEF VOLUME 11 ISSUE 2 AUGUST 2014
THE DOMAIN NAME INDUSTRY BRIEF VOLUME 11 ISSUE AUGUST 1 THE VERISIGN DOMAIN REPORT AS A GLOBAL LEADER IN DOMAIN NAMES AND INTERNET SECURITY, VERISIGN REVIEWS THE STATE OF THE DOMAIN NAME INDUSTRY THROUGH
How To Use The Domain Name Server (Dns)
DNS Out There... Lars- Johan Liman, M.Sc. Sr. Systems Specialist Netnod Internet Exchange Bear in Mind... One DB to Rule Them All... DNS in a database. DNS is one database that is distributed over many
IPv6 support in the DNS
IPv6 support in the DNS How important is the DNS? Getting the IP address of the remote endpoint is necessary for every communication between TCP/IP applications Humans are unable to memorize millions of
DNS Measurements, Monitoring & Quality Control
DNS Measurements, Monitoring & Quality Control Universität Bielefeld pk@techfak.uni-bielefeld.de CENTR General Assembly Budapest, 2003-06-02 CENTR GA 2003-06-02 DNS Monitoring 1 of 18 The Monitor Some
Root Zone KSK: The Road Ahead. Edward Lewis DNS-OARC & RIPE DNSWG May 2015 edward.lewis@icann.org
Root Zone KSK: The Road Ahead Edward Lewis DNS-OARC & RIPE DNSWG May 2015 edward.lewis@icann.org Agenda Setting the scene Change of Hardware Security Modules (HSMs) Roll (change) the Key Signing Key (KSK)
2013 IANA Functions Customer Service Survey Results
2013 IANA Functions Customer Service Survey Results Survey by Ebiquity Report by Leo Vegoda Please see Errata attached at the end of this document. Revised Version effective March 2015 2013 IANA Functions
IPv6 Support in the DNS. Workshop Name Workshop Location, Date
IPv6 Support in the DNS Workshop Name Workshop Location, Date Copy Rights This slide set is the ownership of the 6DEPLOY project via its partners The Powerpoint version of this material may be reused and
ICANN 33. Patrick Jones ICANN, Registry Liaison Manager 4 November 2008
ICANN 33 Patrick Jones ICANN, Registry Liaison Manager 4 November 2008 Overall goals of Plan: Protection of Existing Registrants Ensure confidence in the DNS The gtld Registry Continuity Plan is one of
CS 355. Computer Networking. Wei Lu, Ph.D., P.Eng.
CS 355 Computer Networking Wei Lu, Ph.D., P.Eng. Chapter 2: Application Layer Overview: Principles of network applications? Introduction to Wireshark Web and HTTP FTP Electronic Mail: SMTP, POP3, IMAP
A Survey of cctld DNS Vulnerabilities. ITU cctld Workshop March 3, 2003 Jim.Reid@nominum.com
A Survey of cctld DNS Vulnerabilities ITU cctld Workshop March 3, 2003 Jim.Reid@nominum.com RATIONALE Health-check on DNS infrastructure > Now becoming a critical national resource Attacks on DNS servers
Internet-Praktikum I Lab 3: DNS
Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans
Internet Bodies. Bernard.Tuy@renater.fr
Internet Bodies Bernard.Tuy@renater.fr Agenda Names, Acronyms in the Internet IETF organisation IESG, IAB, ISOC ICANN & IANA Standardisation process Standardisation compliance Internet Registries Requesting
Pre Delegation Testing (PDT) Frequently Asked Questions (FAQ)
Pre Delegation Testing (PDT) Frequently Asked Questions (FAQ) [Ver 1.7 2013-06- 04] List of contents General questions Who do I contact with questions about Pre- Delegation Testing?... 3 What is the process
Internet Technical Governance: Orange s view
Internet Technical Governance: Orange s view 1 Internet Technical Governance: Orange s view With the increasing use of IP technologies in the electronic communication networks and services, Internet Technical
THE DOMAIN NAME SYSTEM DNS
Announcements THE DOMAIN NAME SYSTEM DNS Internet Protocols CSC / ECE 573 Fall, 2005 N. C. State University copyright 2005 Douglas S. Reeves 2 Today s Lecture I. Names vs. Addresses II. III. IV. The Namespace
Chapter 25 Domain Name System. 25.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
Chapter 25 Domain Name System 25.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 25.2 Figure 25.1 Example of using the DNS service 25-1 NAME SPACE To be unambiguous,
Monitoring the DNS. Gustavo Lozano Event Name XX XXXX 2015
Monitoring the DNS Gustavo Lozano Event Name XX XXXX 2015 Agenda 1 2 3 Components of the DNS Monitoring gtlds Monitoring other components of the DNS 4 5 Monitoring system Conclusion 2 Components of the
DNS Basics. DNS Basics
DNS Basics 1 A quick introduction to the Domain Name System (DNS). Shows the basic purpose of DNS, hierarchy of domain names, and an example of how the DNS protocol is used. There are many details of DNS
DNS Domain Name System
Domain Name System DNS Domain Name System The domain name system is usually used to translate a host name into an IP address Domain names comprise a hierarchy so that names are unique, yet easy to remember.
DNS & IPv6. Agenda 4/14/2009. MENOG4, 8-9 April 2009. Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, www.nic.net.sa. DNS & IPv6.
DNS & IPv6 MENOG4, 8-9 April 2009 Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, www.nic.net.sa Agenda DNS & IPv6 Introduction What s next? SaudiNIC & IPv6 About SaudiNIC How a cctld Registry supports
THE MASTER LIST OF DNS TERMINOLOGY. v 2.0
THE MASTER LIST OF DNS TERMINOLOGY v 2.0 DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To help people
The Domain Name System
DNS " This is the means by which we can convert names like news.bbc.co.uk into IP addresses like 212.59.226.30 " Purely for the benefit of human users: we can remember numbers (e.g., telephone numbers),
Secure Domain Name System (DNS) Deployment Guide
NIST Special Publication 800-81-2 Secure Domain Name System (DNS) Deployment Guide Ramaswamy Chandramouli Scott Rose C O M P U T E R S E C U R I T Y NIST Special Publication 800-81-2 Secure Domain Name
IPv6 Support in the DNS
IPv6 Support in the DNS Copy Rights This slide set is the ownership of the 6DEPLOY project via its partners The Powerpoint version of this material may be reused and modified only with written authorization
Network Fundamentals. 2010 Carnegie Mellon University
Network Fundamentals What We Will Cover Introduction Your Network Fundamentals of networks, flow, and protocols Malicious traffic External Events & Trends Malware Networks in the Broad Working Together
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS OVERVIEW OF THE DNS AND GLOSSARY OF TERMS The DNS is a technology that most IT managers don t think much about; it works well and usually does not require much
Overview of DNSSEC deployment worldwide
The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research conducted by EURid in cooperation with industry experts
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS
PROTECT YOUR BUSINESS D-Zone Anycast DNS Service OVERVIEW OF THE DNS AND GLOSSARY OF TERMS 1 PROTECT YOUR BUSINESS OVERVIEW OF THE DNS AND GLOSSARY OF TERMS The DNS is a technology that most IT managers
INTERNET MANAGEMENT. Structured Evaluation Could Help Assess Proposed Transition of Key Domain Name and Other Technical Functions
United States Government Accountability Office Report to Congressional Requesters August 2015 INTERNET MANAGEMENT Structured Evaluation Could Help Assess Proposed Transition of Key Domain Name and Other
The Environment Surrounding DNS. 3.1 The Latest DNS Trends. 3. Technology Trends
3. The Environment Surrounding DNS DNS is used in many applications, serving as an important Internet service. Here we discuss name collision issues that have arisen with recent TLD additions, and examine
FAQ (Frequently Asked Questions)
FAQ (Frequently Asked Questions) Specific Questions about Afilias Managed DNS What is the Afilias DNS network? How long has Afilias been working within the DNS market? What are the names of the Afilias
ICANN: achievements and challenges of a multi-stakeholder, bottom up, transparent model
ICANN: achievements and challenges of a multi-stakeholder, bottom up, transparent model Anne Rachel Inné, Giovanni Seppia Regional Liaisons Aurelio Peccei Lecture 4 April 2007 1 Presentation overview The
NET0183 Networks and Communications
NET0183 Networks and Communications Lecture 25 DNS Domain Name System 8/25/2009 1 NET0183 Networks and Communications by Dr Andy Brooks DNS is a distributed database implemented in a hierarchy of many
Domain Names and their Role for the Net
Domain Names and their Role for the Net Hans Peter Dittler Karlsruhe 2000 H.P. Dittler - BRAINTEC Netzwerk-Consulting 27.6.2002 1 History 1962 first idea 1967 early planning for a real network 1969 ARPANET
page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl http://www.nlnetlabs.nl/ 28 Feb 2013 Stichting NLnet Labs
page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl page 2 One slide DNS Root www.nlnetlabs.nl A Referral: nl NS www.nlnetlabs.nl A 213.154.224.1 www.nlnetlabs.nl A www.nlnetlabs.nl A 213.154.224.1
CS 43: Computer Networks Naming and DNS. Kevin Webb Swarthmore College September 17, 2015
CS 43: Computer Networks Naming and DNS Kevin Webb Swarthmore College September 17, 2015 Agenda Identifiers and addressing Domain Name System History Query sequences Record types Load balancing Recall:
Service Expectations of Root Servers
Service Expectations of Root Servers RSSAC- 001 1, 2013-05- 02 Table of Contents Revision History... 2 1. Introduction... 2 2. Service Provided by Root Servers... 3 3. Expectations of Root Server Operators...
DNS Abuse Handling. Champika Wijayatunga APRICOT2015 Fukuoka Japan Feb 2015
DNS Abuse Handling Champika Wijayatunga APRICOT2015 Fukuoka Japan Feb 2015 Acknowledgements Dave Piscitello Vice President, Security and ICT Coordination ICANN 2 2 Agenda 1 2 3 Brief Overview of DNS Defining
Why You Need More Than Two Library and Information Services School of African and Oriental Studies London Networkshop 38, 2010 Everything Rolled into Together Design Flaws 1990 s DNS Design in 2010 In
DNS. The Root Name Servers. DNS Hierarchy. Computer System Security and Management SMD139. Root name server. .se name server. .
Computer System Security and Management SMD139 Lecture 5: Domain Name System Peter A. Jonsson DNS Translation of Hostnames to IP addresses Hierarchical distributed database DNS Hierarchy The Root Name
Secure Domain Name System (DNS) Deployment Guide
Special Publication 800-81 Sponsored by the Department of Homeland Security Secure Domain Name System (DNS) Deployment Guide Recommendations of the National Institute of Standards and Technology Ramaswamy
THE DOMAIN NAME INDUSTRY BRIEF VOLUME 11 ISSUE 1 APRIL 2014
THE DOMAIN NAME INDUSTRY BRIEF VOLUME 11 ISSUE 1 APRIL 2014 THE VERISIGN DOMAIN REPORT AS THE GLOBAL LEADER IN DOMAIN NAMES, VERISIGN REVIEWS THE STATE OF THE DOMAIN NAME INDUSTRY THROUGH A VARIETY OF
Networking Overview. (as usual, thanks to Dave Wagner and Vern Paxson)
Networking Overview (as usual, thanks to Dave Wagner and Vern Paxson) Focus For This Lecture Sufficient background in networking to then explore security issues in next few lectures Networking = the Internet
ICANN STRATEGIC PLAN JULY 2012 JUNE 2015
ICANN STRATEGIC PLAN JULY 2012 JUNE 2015 One World. One Internet. One World. One Internet. ICANN is the global organization that coordinates the Internet s unique identifier systems for worldwide public
DNS Risks, DNSSEC. Olaf M. Kolkman and Allison Mankin. olaf@nlnetlabs.nl and mankin@psg.com. http://www.nlnetlabs.nl/ 8 Feb 2006 Stichting NLnet Labs
DNS Risks, DNSSEC Olaf M. Kolkman and Allison Mankin olaf@nlnetlabs.nl and mankin@psg.com 8 Feb 2006 Stichting NLnet Labs DNSSEC evangineers of the day Allison: Independent consultant Member of the Internet2
Vanuatu Domain Name Management and Administration Regulation Inviting public comment and input
A Further Consultation Paper on Vanuatu Domain Name Management and Administration Regulation Inviting public comment and input 19 December 2014 1 Vanuatu Domain Name Management and Administration Regulation
An Introduction to the Domain Name System
An Introduction to the Domain Name System Olaf Kolkman Olaf@nlnetlabs.nl October 28, 2005 Stichting NLnet Labs This Presentation An introduction to the DNS Laymen level For non-technologists About protocol
Summary - ENUM functions that maps telephone numbers to Internet based addresses - A description and the possible introduction to Sweden
DATE REFERENCE NO. 30 March 2001 01-9734 Summary - ENUM functions that maps telephone numbers to Internet based addresses - A description and the possible introduction to Sweden AUTHOR Joakim Strålmark
THE MASTER LIST OF DNS TERMINOLOGY. First Edition
THE MASTER LIST OF DNS TERMINOLOGY First Edition DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To
Development of the Domain Name System. Joey Brown David Margolies
Development of the Domain Name System Joey Brown David Margolies Introduction DNS provides name service for the Internet 1982 - HOSTS.TXT Centrally maintained Too large Too costly to distribute Organizations
APNIC IPv6 Deployment
APNIC IPv6 Deployment Ulaanbaatar, Mongolia 19 October 2015 Issue Date: Revision: Overview Deployment motivation Network deployment IPv6 Services deployment IPv6 Anycast service IPv6 Cloud service Summary
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE Your external DNS is a mission critical business resource. Without
3SECTION B SUPPLIES OR SERVICES AND PRICES/COSTS. This is a no cost, $0.00 time and material contract. B.2 COST/PRICE
3SECTION B SUPPLIES OR SERVICES AND PRICES/COSTS This is a no cost, $0.00 time and material contract. B.2 COST/PRICE The Contractor may not charge the United States Government to perform the requirements
Security related proposals in the DAG v3
Security related proposals in the DAG v3 Jay Daley.nz Jay Daley - Nairobi 2010 1 Agenda! Background! Mitigating Malicious Conduct! High Security Zones! HSTLD working group 2 Background! Draft Application
The Domain Name System (DNS) A Brief Overview and Management Guide
The Domain Name System (DNS) A Brief Overview and Management Guide Table of Contents Introduction 1 What Exactly Is DNS? 2 Potential Pitfalls of DNS 4 DNS Management and 5 Zone Hosting DNS Management 6
DNSSEC for Everybody: A Beginner s Guide
DNSSEC for Everybody: A Beginner s Guide San Francisco, California 14 March 2011 4:00 to 5:00 p.m. Colonial Room The Schedule 2 This is Ugwina. She lives in a cave on the edge of the Grand Canyon... This
SAC 049 SSAC Report on DNS Zone Risk Assessment and Management
SAC 049 SSAC Report on DNS Zone Risk Assessment and Management A Report from the ICANN Security and Stability Advisory Committee (SSAC) 03 June 2011 SAC049 1 Preface This is a Report of the Security and
Accommodating IP Version 6 Address Resource Records for the Root of the Domain Name System
Accommodating IP Version 6 Address Resource Records for the Root of the Domain Name System A Joint Report from the ICANN Security and Stability Advisory and Root Server System Advisory Committees SAC018
DOMAIN NAME SECURITY EXTENSIONS
DOMAIN NAME SECURITY EXTENSIONS The aim of this paper is to provide information with regards to the current status of Domain Name System (DNS) and its evolution into Domain Name System Security Extensions
Lecture 2 CS 3311. An example of a middleware service: DNS Domain Name System
Lecture 2 CS 3311 An example of a middleware service: DNS Domain Name System The problem Networked computers have names and IP addresses. Applications use names; IP uses for routing purposes IP addresses.
K-Root Name Server Operations
K-Root Name Server Operations Andrei Robachevsky andrei@ripe.net 1 Outline Root Server System brief update Architecture Current locations Anycast deployment K.root-servers.net Server Major milestones Current
SSAC Report on the IANA Functions Contract
SSAC Report on the IANA Functions Contract A Report from the ICANN Security and Stability Advisory Committee (SSAC) 10 October 2014 Preface This is a Report to the Internet Corporation for Assigned Names
Operation of the Root Name Servers
Operation of the Root Name Servers Lars-Johan Liman, i.root-servers.net John Crain, l.root-servers.net Suzanne Woolf, f.root-servers.net Bill Manning, b.root-servers.net Axel Pawlik, Rob Blokzijl, k.root-servers.net
CS3250 Distributed Systems
CS3250 Distributed Systems Lecture 4 More on Network Addresses Domain Name System DNS Human beings (apart from network administrators and hackers) rarely use IP addresses even in their human-readable dotted