DNS

DNS… Wait a SEC

Complete DNSSEC implementation requires that domains are authenticated at the root by the Registry, and that DNS zones and records are authenticated as well. Now before I go any further, let me begin by stating that I fully support the development and deployment of DNSSEC and that the vulnerabilities presented by Cache Poisoning are very real, especially for those websites collecting login credentials or other types of sensitive information.

DNSSEC No Longer Pie-in-the-Sky: Time to Develop a Strategy

You may have seen media reports a few weeks ago describing how servers behind the so-called Great Firewall of China were found delivering incorrect DNS information to users in the rest of the world, thereby redirecting users to edited Web pages. Reports indicate that this apparently occurred due to a caching error by a single Internet Service Provider. While the problem was fairly limited in scope, it could have entirely been prevented in a world where DNSSEC was fully deployed.

DNSSEC Ready Set Go! But, Wait, Are You Ready?

The year 2010 is turning out to be the "year of DNSSEC" from Registry implementations, Registrar implementations, ISP support, to the Root being signed this summer. Because we are dealing with such critical infrastructure, it is important to not lose sight of careful implementations.

Accidentally Importing Censorship

With advancements in hardware and software, sophisticated filtering technologies are increasingly being applied to restrict access to the Internet. This happens at the level of both governments and corporations. .. given the open nature of the trust-based Internet, one country's restrictions, if not handled very carefully, can easily foul the global Internet nest we all live in. This blog is about one such story of Internet restrictions in China becoming visible (seemingly at random) from other parts of the world and going undetected for 3 weeks.

IDN ccTLD Fast Track developments

The IDN ccTLD Fast Track program is moving along rapidly, with ICANN's announcement that both the Simplified and Traditional Chinese script versions of .china have passed the string evaluation phase of the IDN ccTLD Fast Track Program. Alongside this, ICANN have also announced the release of a proposed implementation plan for 'Synchronised IDN ccTLDs' that will create the rules by which these variant IDN ccTLDs will coexist.

Live Long and (Do Not) Prosper: Lessons and Reminders from Yesterday’s Wikipedia Outage

Yesterday's Wikipedia outage, which resulted from invalid DNS zone information, provides some good reminders about the best and worst attributes of active DNS management. The best part of the DNS is that it provides knowledgeable operators with a great tool to use to manage traffic around trouble spots on a network. In this case, Wikipedia was attempting to route around its European data center because...

All Aboard… the IDN Fast Track

In addition to Egypt, Russian Federation, United Arab Emirates and Saudi Arabia which had successfully completed the second phase of the Internationalized Domain Names (IDN) Fast Track Process earlier this year, ICANN announced today that China, Hong Kong, Palestinian Territories, Qatar, Sri Lanka, Taiwan, Thailand and Tunisia have also successfully completed the second phase.

MIT 2010 Spam Conference Starts Tomorrow…

In January we presented the glorious history of the MIT spam conference, today we present the schedule for the first day. Opening session will be from this author, Garth Buren with a topic entitled The Internet Doomsday Book, with details be released the same day as the presentation. Followed by Dr. Robert Bruen with a review of activities since the last MIT spam conference...

The Future Looks Bright for New gTLDs!

The ICANN Board meeting undertaken recently in Nairobi was indeed eventful and there were many vital topics on the agenda, in particular for the new gTLD program that kept many interested parties on the edges of their seats as the meeting unfolded. ... One of the more controversial decisions was in regard to the Expression of Interest (EOI), a program intended to allow potential new gTLD applicants to pre-register for their desired TLD and provide ICANN and the community with invaluable information regarding likely volumes of applications.

Perspectives on a DNS-CERT

Last week at the ICANN meeting in Nairobi, a plan was announced by ICANN staff to create a "CERT" for DNS. That's a Community Emergency Response Team (CERT) for the global Domain Name System (DNS). There are all kinds of CERTs in the world today, both inside and outside the Internet industry. There isn't one for DNS, and that's basically my fault, and so I have been following the developments in Nairobi this week very closely.