DNS

Proposal for Signing the DNSSEC Root

The U.S. National Telecommunications and Information Administration (NTIA) is soliciting comments on signing the DNSSEC root. Ignore the caption on the page: this is not about DNSSEC deployment, which is already happening just fine. It's about who gets to sign the root zone.

What’s Going on at ICANN in Cairo

Following up on the big decision at the Paris ICANN meeting in June to make new Top-Level Domains available, there's lots of activity at the ICANN conference in Cairo, Egypt this week. A few of the hot topics of discussion that we are following are the applications process for new generic Top-Level Domains (gTLDs), Registry/Registrar Cross Ownership, and restructuring of the ICANN Board.

Russian Minister of Telecom and Mass Communications Talks About Cyrillic Domain Names

Igor Schegolev, the Russian Minister of Telecom and Mass Communications spoke at the opening of the InfoCom 2008 exhibition in Moscow. Among other things, which made news (for example, that the Russian government will be implementing a free and open source based operating system on all computers in the Russian schools), he also made the following remarks - translated by me in English.

Users Don’t Like Forwarded Spam

A message on Dave Farber's Interesting People list complained that Comcast was blocking mail forwarded by DynDNS, a popular provider of DNS and related services for small-scale users... Actually, they're blocking it because a lot of it is spam. This is a problem that every mail forwarder and every mail system encounters; the only unusual thing here is that DynDNS is whining about it. It's yet another way that spammers have broken the mail for the rest of us.

Remembering Jon: Looking Beyond the Decade

A decade has passed since Jon Postel left our midst. It seems timely to look back beyond that decade and to look forward beyond a decade hence. It seems ironic that a man who took special joy in natural surroundings, who hiked the Muir Trail and spent precious time in the high Sierras was also deeply involved in that most artificial of enterprises, the Internet.

DNSSEC Rally

In late August the White House mandated that all of the agencies in the US government have functioning DNSSEC capabilities deployed and operational by December 2009. I am suggesting here that we, as a community, commit to the same timetable. I call upon VeriSign and other registries to bring up DNSSEC support by January 2009.

A Secure Recursive Caching DNS Server

Over the last couple of weeks I have spent some time working on a project to develop a DNS cache for Windows that is intended to be reasonably secure against spoof attacks, in particular in situations where NAT firewalls may prevent port randomization. The program is evolving, but currently uses a couple of ideas to attempt to defeat spoof attacks... The source code is intended to be entirely un-encumbered, that is free in all respects. I would welcome any suggestions or comments on the aims of the project, the source code, the functionality of the program or other ideas.

Trust, but Verify

We are at an inflection point in our lifetimes. The Internet is broken, seriously broken... Almost all of the systems currently in use on the Internet are based on implicit trust. This has to change. The problem is that these systems are so embedded in our everyday lives that it would be, sort of like, changing gravity, very difficult.

Can ICANN Manage the DNS Root Zone by Itself? “No!” Says US Department of Commerce

In a recent letter, the US Department of Commerce NTIA strongly denied being engaged in discussions about a "root zone transition" from VeriSign to ICANN. The community, ICANN President Strategic Committee (PSC), and perhaps ICANN and IANA staff are suddenly informed that no transition of root zone management is going to occur. What happened? With the touted ICANN transparency and accountability principles, why such a shift in (perceived) ICANN strategic directions coming from its overseeing government department?

Is This Only Sloppy Wording by ICANN?

So I wrote earlier that I though it was good stuff when ICANN released a paper on DNS Security. Yes, I think it was good this paper was released, and yes it points out correctly how important DNSSEC is. But, now when reading it in detail, I find two things that troubles me. And it has to do with management of .ARPA. A top level domain that is used for infrastructural purposes. Like IP-addresses and E.164 numbers...