RFC 10001: Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments

Vous gérez des serveurs #DNS dans un environnement où il y a à la fois IPv4 et IPv6 ? Alors, ce #RFC va vous aider. La recommandation est que tout serveur DNS, lorsque le réseau a à la fois IPv4 et IPv6, doit pouvoir servir les requêtes avec les deux versions d'IP.

https://www.bortzmeyer.org/10001.html

[Veille 📣] autistici.org - Press Release – August 28, 2026
https://www.inventati.org/campaign/press

Les USA ont placé Autistici/Inventati sur la liste des personnes bloquées (Specially Designated Nationals and Blocked Persons List) avec comme désignation SDGT (Specially Designated Global Terrorist). C'est une décision nationale, qui ne devrait pas avoir de conséquences internationales, sauf que…

1. Internet est en fait largement un système étasunien, le TLD (Top Level Domain) .org est géré par le PIR, qui se trouve être une structure étasunienne, donc soumise à la loi étasunienne. Elle a donc bloqué la propagation DNS ce qui rend totalement indisponible le site, alors qu'il est encore parfaitement fonctionnel.

2. Les USA menacent de sanctions secondaires les entreprises faisant du commerce avec des entités sur la liste des personnes bloquées. Ce qui implique que la banque qui gère A/I est censée rompre son contrat avec l'association pour éviter de se faire placer elle aussi sur une liste similaire.

Il est temps de nous libérer de l'impérialisme étasunien!

Lien vers cette entrée dans ma veille : https://liens.declosure.ch/shaare/X-RAfA
Toute ma veille est disponible ici : https://liens.declosure.ch/
#internet #impérialisme #dns #usa
#links #liens #veille

#DNS

Pas joli, le nom de domaine des serveurs faisant autorité. https://mastodon.gougere.fr/@DNSresolver/117188887152934762

RE: https://fedifreu.de/@chpietsch/117059348761270115

Mastodon-Admins, verhindert die nächste Spam- und Propagandawelle!

Die Welle an höchst dubiosen Registrierungsversuchen mit zufälligen Usernames, seltsamen E-Mail-Adressen und sturzlangweiligen oder aus Bios geklauten Begründungen ebbt nicht ab.

Zum Glück bekommt unser Moderationsteam die meisten spammigen Anträge gar nicht mehr zu sehen, weil ein von @gunchleoc gespendetes und von mir verschlimmbessertes Shellscript alle abblockt, die bekannte Wegwerf-Mailadressen enthalten. Vielen Dank an derjan, der den ersten Pull-Request dafür eingereicht hat! Damit wurde ein Flüchtigkeitsfehler von mir behoben.

Jetzt muss sich das Moderationsteam nur noch mit den kreativeren Registrierungsanträgen beschäftigen. Ein typisches Muster ist, dass seltsame Maildomains verwendet werden. Wenn diese im #DNS auf Mailserver verweisen, die für unsere legitimen User nicht relevant sein dürften, sperre ich die gleich mit. Aktuell sind das z.B. die von spacemail•com aus den USA.

Ich checke die Maildomains wie die IP-Adressen gern auf der Kommandozeile mit host und whois. Wer kein Linux zur Hand hat, kann unter Android die App Termux (z.B. aus #fdroid) nehmen und mit pkg install dnsutils whois diese Tools darin installieren.

$ host domioni.pro
domioni.pro mail is handled by 0 mx2.spacemail.com.
domioni.pro mail is handled by 0 mx1.spacemail.com.

Aber ihr könnt auch gleich ins Web-Interface eures Mastodon-Accounts mit Admin-Rechten gehen, um seltsame Maildomains zu sperren. Das geht dort: Einstellungen → Moderation → Gesperrte E-Mail-Domains → Neue hinzufügen. Nach Eingabe einer Maildomain und Klick auf Domain auflösen passiert automatisch eine Abfrage der zu dieser Domain im DNS hinterlegten Mailserver. Durch Antippen der Kästchen vor mx1.… und mx2.… (s. Screenshot) sperre ich die Mailserver in diesem Fall gleich mit.

So ergänze ich die vom obigen Script jede Nacht importierte Sperrliste bei Bedarf manuell und gebe den Spammern immer weniger Chancen. Zur Nachahmung empfohlen!

#Registrierspam #SleeperRegistrierung #SleeperAccounts #SpamAccounts #MastoAdmin #FediAdmin

AodeRelay boosted

Christian Peach » 🌐 2026-08-08
@chpietsch@fedifreu.de

RE: https://fedifreu.de/@chpietsch/117050639754423573

Liebe Mastodon-Admins,

wenn ihr nicht Teil einer rechtsextremen (oder von Putin/Trump gesteuerten) Propadandamaschine werden wollt, dann tut was gegen die #Sleeper-Accounts, die sich evt. massenhaft auf euren Instanzen einnisten.

Was ihr tun könnte, habe ich mit Teilnehmenden des laufenden #Fedicamp zusammengetragen.

Aktuelles Beispiel für diese FakeNews-Kampagnen: https://newsie.social/@dieKadda/117058626402342451

#PortalKombat #PutinTroll #TrumpTroll #SleeperAccounts #FakeNews #SpamRegistrations #RegistrationSpam #MastoAdmin #FediAdmin

AodeRelay boosted

Christian Peach » 🌐 2026-08-06 / 2026-08-06
@chpietsch@fedifreu.de

Beim #Fedicamp habe ich heute zusammen mit @wuffel einen Erfahrungsaustausch angestiftet, bei dem wir beraten haben, wie wir mit der Flut dubioser Mastodon-Account-Anträge umgehen können. Hier sind Notizen dazu:

Was tun gegen Mastodon-Account-Registrierungen durch Bots & Klickworker?

Anlass

FakeNews-Kampagne #PortalKombat und ähnliche: https://about.iftas.org/library/suspected-portal-kombat-accounts/

Abwehrstrategie E-Mail-Domain

Mastodon lässt es zu, Account-Registrierungen von bestimmten E-Mail-Domains automatisch zu verwerfen. Ein Massenimport der unten verlinkten Listen ist mit Hilfe des mitgelieferten Server-Tools tootctl möglich.

• Suche in ca. 70.000 Wegwerf-Domains: https://disposable.github.io/disposable-email-domains/lookup
  • Repo dazu: https://github.com/disposable/disposable
  • Bei so einer langen Liste steigt die Gefahr des Overblockings.
• Bewährte Teilmenge der obigen Liste mit ca. 7.000 Wegwerf-Domains: https://github.com/disposable-email-domains/disposable-email-domains
  • Update: Hier ist ein einfaches Shellscript, das diese Blocklist in eine Mastodon-Instanz importiert: https://codeberg.org/datenfreude/emailblock – am besten jede Nacht per Cronjob.

Abwehrstrategie IP-Adresse

Mit Standard-Tools wie host und whois können Linux-User die IP-Adresse(n) untersuchen, die ein Antragsteller verwendet hat. Ein mächtigeres Tool ist wtfis, wenn man die API-Keys einiger Webdienste hinterlegt: https://github.com/pirxthepilot/wtfis

Viele der Bots oder Klickworker nutzen Tor, andere Proxies oder Cloud-IPs. Anders gesagt: IPs von Heimanschlüssen sind ein positives Signal.

Abwehrstrategie Begründung

Viele Bots und Klickworker benutzen stinklangweilige Begründungen. Manche sind besonders dreist und verwenden die Bios beliebiger Fediverse-Accounts als Begründung. Beim Prüfen dieser Anträge kann es also sinnvoll sein, die Begründung ins Suchfeld einer großen Mastodon-Instanz zu kopieren.

Sehr sinnvoll erscheint es uns, den Text über dem Antragsformular anzupassen, um Antragsteller aufzufordern, in ihrer Begründung bestimmte Dinge zu erwähnen.

Eine Lösung für Matrix-Fans

Für Faule hat die Fediverse Foundation einen Matrix-Bot gebaut, der das Checken der IP-Adresse übernimmt und auch das Freischalten oder Ablehnen via Chat ermöglicht: https://git.fediverse.foundation/ff_pub/fedi-signup-bot

Allgemeine Anti-DDoS-Maßnahmen

Gegen Ende sprachen wir über Überlastungsprobleme, die von hemmungslosen »KI«-Crawlern hervorgerufen werden und alle Websites (auch außerhalb des Fediversums) betreffen können. Die bekannten Ansätze sind:

• Proof of Work, z.B. Anubis
• IP-Sperrlisten, z.B. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
• UserAgent-Sperrlisten
• Tarpitting/Teergrubing/Fallen

Ideen für Fallen

Ein 1-Pixel-PNG mit Link auf ein haltdiefresse.php, welches die nötigen Parameter gleich dem Türsteher übergibt. Beim Skripten könnte das helfen: https://mastodonpy.readthedocs.io

#PortalKombat #PutinTrolle #TrumpTrolle #AntiSpam #AntiFakeNews #Spam #FakeNews #disinformation #MastoAdmin #FediAdmin #Registrierungen #Fedicamp2006 #Fedicamp2006Tag3

Alt...

Screenshot des Mastodon-Admin-Webinterfaces mit dem ersten Schritt der Funktion „Neue E-Mail-Domain sperren“.

Alt...

Screenshot aus dem Admin-Webinterface einer von mir betreuten Mastodon-Instanz. Gezeigt wird der zweite Schritt der Funktion „Neue E-Mail-Domain sperren“. Die beiden MX-Domains habe ich angehakt.

[lien] Blog Stéphane Bortzmeyer: Autistici / Inventati et la censure sur leur nom de domaine #duralexsedlex #gik #dns #net #tld

Autistici / Inventati et la censure sur leur nom de domaine

https://www.bortzmeyer.org/autistici.html

#DNS #PIR #censorship

@benjamin

Recent events and a thought that had already been lingering in my mind for some time prompted me to register two new domains:

bsdcafe.eu
bsdcafe.it

The first is under European control, the second Italian.

Although as of today I have no reason for doubts or misgivings, having domains managed by European entities gives me a bit more peace of mind. How to put them to use will be a matter of reflection over the coming months.

Stay tuned!

#BSDCafe #Domains #DNS

RFC 10037: RDAP Extension for DNS TTL Values

Puisque le RFC 9803 étend le protocole d'avitaillement EPP pour ajouter des TTL spécifiques aux noms de domaine enregistrés, il était logique que le protocole d'interrogation #RDAP permette d'obtenir cette information. C'est ce que permet l'extension normalisée dans ce nouveau #RFC.

https://www.bortzmeyer.org/10037.html

#DNS

New blogpost:

# Time to drop .legal?

Just my ponderings at this point.

Perhaps I am over-worrying?

https://neilzone.co.uk/2026/08/time-to-drop-legal/

#blog #cybersecurity #DNS #lawfedi

For re-enabling domain name autistici.org, you can add to Unbound configuration the following lines (that may be changed in the future) :

domain-insecure: austistici.org
stub-zone:
name: "autistici.org"
stub-addr: 93.190.126.19
stub-addr: 198.167.222.108
stub-addr: 185.218.207.228
stub-addr: 2a12:4180:dc1:929::42
stub-addr: 2a12:4180:dc1:929::42
stub-addr: 2a11:7980:1::2:0

domain-insecure disable #DNSSEC (no more valid DS in the .org zone). #censorship #US #IT #DNS

https://computing-competence.de/news/20260828_kocokobana

[lien] Stéphane Bortzmeyer: "Un rappel utile si vous gérez …" - Mastodon - Gougère Network #duralexsedlex #gik #net #dns #tld

Bref, choisissez bien votre domaine de premier niveau (TLD = Top Level Domain).

#nomDeDomaine #DNS

Et que ce n’est pas une bonne pratique d’avoir un serveur #DNS derrière un firewall.
Et que mettre chaque serveur dans un sous-réseau (si ce n’est un AS) différent, c’est mieux.

Et merci à @bortzmeyer pour `check-soaˋ qui est un outil d’analyse très utile.

Je sais qu’ils font dans l’archive, mais quelqu’un peut dire à la #BnF que le #DNS c’est sur le port 53 en #UDP ET en #TCP depuis une bonne trentaine d’années :

```
% check-soa bnf.fr
ariane.bnf.fr.
193.50.133.237: OK: 2026081807
galatee.bnf.fr.
193.50.133.202: OK: 2026081807
% check-soa --tcp bnf.fr
ariane.bnf.fr.
193.50.133.237: ERROR: dial tcp 193.50.133.237:53: i/o timeout
galatee.bnf.fr.
193.50.133.202: ERROR: dial tcp 193.50.133.202:53: i/o timeout
```

Abusing TXT records by putting the whole static site HTML in there. #dns

#DNS #ICANN

« gTLD : de nouvelles extensions [sic] arrivent : .gram, .coin, .agent ou peut-être .meta ? »

https://next.ink/253163/gtld-de-nouvelles-extensions-arrivent-gram-coin-agent-ou-peut-etre-meta/

(Le fédivers est un des rares endroits où les TLD du précédent cycle sont largement utilisés. C'est le cas de .social, par exemple, propriété d'une entreprise commerciale étatsunienne.)

NSD Security Release!

As part of our ongoing work to address security issues identified through LLM-assisted security research, we have released NSD 4.15.1.

Read more about the security fixes and the new release on our community forum.

#DNS #OpenSource #Security

https://community.nlnetlabs.nl/t/nsd-4-15-1-security-release/3447

Liebe Folglinge... Ich habe alle meine Domains bei bei #world4you. Also, NUR die Domains inkl. #DNS, #Nameserver Einstellungen. #Mail-#Hosting habe ich ganz woanders und Web-Hosting wieder woanders.

Nun moechte ich #Domain- und Mailhosting zusammenlegen, damit alles an einem Ort ist.

Welche Hoster in #Deutschland, #Oesterreich oder zu mindest in #Europa(!) koennt ihr mir empfehlen? Sie sollten einem weitestgehende Freiheit bei der Konfiguration bieten (also den vollen DNS Record Satz, eigene Nameserver, ein #Mailhosting Paket ueber mehrere Domains sollte moeglich sein etc.) und kein all zu altbackenes UI haben.

Was koennt ihr mir da empfehlen?
Bitte nicht nennen, was es gibt, das kann ich mir selbst zusammensuchen. Ich haette gern Empfehlungen aus eigener Erfahrung.

#DNS #courrier
C'est assez rare, des MX qui pointent vers deux fournisseurs différents : https://mastodon.gougere.fr/@DNSresolver/117155351655886655

DNS4EU is a privacy-first DNS resolver by the European Union and Whalebone, available for free to all European citizens under the GDPR.

The service is anonymized and offers child protection, ad blocking, DNSSEC, IPv4, IPv6, DoH, DoT, and anycast, ensuring excellent privacy and minimal latency regardless of your location.

Your browsing data stays within the EU and is protected from cyber threats without being monetized!

https://joindns4.eu

#dns #browser #security #privacy #eu #europe

Alt...

DNS4EU public DNS service logo and Co-funded by the European Union logo. Caption: Launch of Secured Privacu-oriented Public DNS resolver.

@bortzmeyer Au niveau RFC 6014, le statut actuel n'est pas suffisant ? @shaft #RFC #RFC6014 #DNS #DNSSEC #PQC

@shaft @bortzmeyer pour l'instant je reste en ED25519 pour toutes les zones de production que je gère mais justement j'aurais voulu tester les problèmes en ML-DSA-44 (en signant du-mlsdsa44.teste.des.services)

#DNS #DNSSEC #PQC

Liked those short Curve RRSIG's in DNSSEC?

Well, that time is over, good lord. Post quantum RRSIGs with MLDSA44, https://codeberg.org/miekg/dns/pulls/987/files

#go #dns

#RFC 3901 is now obsoleted

“This document provides guidelines and documents best current practice for operating authoritative #DNS servers, recursive resolvers, and stub resolvers in a mixed #IPv4 / #IPv6 environment."

RFC 10001: Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments
https://www.rfc-editor.org/info/rfc10001/

Some services will be momentarily down today while we migrate from Dynadot to Dreamhost for our domain Registrar. Moving forward, all DNS will be managed at Hurricane Electric and/or Dreamhost. Thanks for patience 🙏🏼

This sudden change was due to Dynadot changing their subdomain record policy from 250 to 50 without notice. This caused a week-long disruption in building out new services due to any record over the cap being irrecoverable once deleted and new ones being impossible to create. Despite having 150+ records in the past, Dynadot responded that they've never supported more than 150 and would only restore that.

Both the change in terms and contract without notice and the dishonesty once a ticket was filed serve as sufficient reasons to ditch Dynadot. This was surprising to say the least. They've been a solid Registrar. As for DNS, we only used it the last three years having originally used afraid.org for over a decade. Ultimately, this is for the best however, because it is always unwise to keep one's DNS and Registrar at the same host. Hurricane Electric's DNS is additionally a breath of fresh air from 1998-2002 era and so easy to use - the alphabetical rendering of records amazing 🤩

It's always DNS !!

#DNS #selfhosted #linux #debian #registrar #sysadmin

@sebsauvage Et hop : #PiHole installée sur la #Raspberrypi qui me sert de serveur d'applications web locales.

Il faut apparemment définir cette machine comme __unique__ serveur #dns dans les configurations de la box (dixit la documentation).

[lien] How to Configure DNSSEC with PowerDNS Authoritative Server #security #gik #dns

Today a regular Unbound release, version 1.26.0, with features, maintenance and bug fixes. Enjoy the latest version and thanks to the contributors! And stay cool.

See for more details and acknowledgment our community post, https://community.nlnetlabs.nl/t/unbound-1-26-0-released/3434.

#DNS #OpenSource

One more straw on the #DNS camel, but a possibly nice straw if deployed in software

"This document specifies a method for a DNS client to request additional DNS record types to be delivered alongside the primary record type specified in the Question section of a DNS QUERY (OpCode=0)."

"For example, it may be desirable to receive the A, AAAA, and HTTPS RRs for a domain name together, rather than having to issue multiple queries."

#RFC 10029: DNS Multiple QTYPEs
https://www.rfc-editor.org/info/rfc10029/

DNS knows where it is because it knows where it isn't: LOC records
#DNS

[lien] Blog Stéphane Bortzmeyer: RFC 10023: The "_for-sale" Underscored and Globally Scoped DNS Node Name #gik #net #dns #rfc #$$$

In the overnight spam haul at $DAYJOB I found a message from Kevin Liu<kevin@cnnetregistry.com> trying to hawk various .cn domain versions of the name the company rebranded away from some months back.

Basically the same message as in https://nxdomain.no/~peter/domain_name_scams_are_alive_and_well_thank_you.html (tracked https://bsdly.blogspot.com/2016/03/domain-name-scams-are-alive-and-well.html) #dns #cn #cndomains #cndomainscam #cnnetregistry #scam #domainnamescam #spam

Federated protocols of the future should consider designing themselves so that even if they use DNS, it is not the foundation of their own identity system so they are not hopelessly bound to it. Federated networks which have message relaying capability such as Bitcoin or BGP can also span across different networks such as cjdns, Yggdrasil, I2P and of course the outside internet.

https://thegoodwork.substack.com/p/the-next-internet-war

#federated #DNS #Internet

https://fedins.eu.org

J'espère pouvoir à un moment bosser sur le fait de fournir aussi un service pour faire du primaire, mais je ne sais pas si un projet existant sympa pour ça existe ou s'il va falloir coder l'outil nous-même …

#DNS

Bienvenue au .web dans la racine du #DNS https://mastodon.gougere.fr/@DNSresolver/116969754190877796

Another Unbound security release is now available, addressing a large set of multi-vendor vulnerabilities. In total, Unbound 1.25.2 fixes 24 CVEs.

Many thanks to the security researchers who responsibly reported these issues.

Release details: https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430

#DNS #DNSSEC #Security

#DNS #sécurité
😱 Le registry (base de données DNS pour le .ro) pour la Roumanie s'est fait attaquer et *entièrement effacer*. Heureusement, ils avaient une copie offline.
Ayez toujours un backup déconnecté !
https://cybernews.com/security/hacker-deletes-romanian-land-registry-database/

#France #censure
L'autorité nationale des jeux a annoncé qu'elle demandait le blocage de #Polymarket. J'ai déjà parlé de censure via résolveur #DNS menteur à propos d'autres sources de blocage mais je n'avais pas encore parlé de l'#ANJ.

https://www.bortzmeyer.org/polymarket-france.html

Wenn Sie sich zum ersten Mal mit #SSH-Server verbinden, werden Sie gefragt, ob der #Fingerprint stimmt. Diese manuelle #Prüfung ist umständlich und fehleranfällig. #SSHFP bietet eine elegante Lösung: Der #Server-Fingerprint wird in #DNS hinterlegt und vom Client automatisch #verifiziert.

Dieser Artikel erklärt, wie SSHFP mit #Devuan #GNU #Linux funktioniert, welche Grenzen es hat und warum es in der Praxis selten genutzt wird.

linux.ambag.es/devuan/openssh/…

Dites, le synonyme de « test si connecté au web » = « test de ping 8.8.8.8 » m'a l'air tellement bien gravé chez certains.
On a une alternative UE ou non GAFAM à automatiquement répliquer ?
#Web #DNS #GAFAM #Google

The video of my presentation at DNS OARC 46 about progress on our new Rust based DNSSEC signing software Cascade went online today. It’s always fun to look back and see it from the perspective of the audience! For a higher level introduction to Cascade there’s also a great presentation that @jpmens gave at NLUUG earlier this year. Check them out at https://youtu.be/rQH3dey6kHI?si=0cqZgaMduwcmyKAP and https://youtu.be/HyAwFhIwxHM?si=QJiUIuHuD-o-Qera. @dnsoarc #nlnetLabs #dns #opensource #rustlang

J'étais surpris que les serveurs #DNS faisant autorité pour .ru soient en .net mais apparemment, les Russes sont en train de changer cela : https://mastodns.net/@diffroot/116920437777071977

Tiens le #DNS joindns4.eu qui bloque orbot.app (le client #ToR pour android) 🤔

Well good thing the American federal government doesn’t rely on a single privately-owned third-party digital identity provider operating on .me!

#dns

Alt...

Calvin change my mind meme with the ID.me logo and “is a national security risk” “change my mind”

Si vous utilisez le service de messagerie instantanée #Telegram, vous avez sans doute vu aujourd'hui, que des services ne marchent pas, notamment les liens vers des ressources diverses (images, etc). C'est parce que le registre de noms de domaine du Monténégro l'a décidé. Voyons les détails.

https://www.bortzmeyer.org/telegram-on-hold.html

#DNS #EPP #censure

sometimes you have to solve your own problems. had a specific use-case to not open a browser to check stats/issues on #nextdns which is an upstream to #blocky #dns resolver

being more tui/tty oriented, decided to build a tui dashboard. works pretty nicely. also felt it was good to dual-scope the binary so it can run as an optional web front-end that's very lightweight and customized

this is a 20mb #golang binary and all you need to do is feed it an api key and profile id (if not on default)

we live in an age where it's somewhat trivial to solve your own problems. why wait for others to do it? #hack everything.

Un faux outil d'analyse #DNS propage un #malware via 222 dépôts #GitHub. Un module Go imite un outil de scan #DNS et dissimule un chargeur #Windows relié à 222 dépôts #GitHub. Le réseau est actif depuis janvier et diffuse des #chevauxdetroie d’accès distant ainsi que des voleurs de données, selon l’éditeur de #securite Socket
https://www.clubic.com/actualite-620971-un-faux-outil-d-analyse-dns-propage-un-malware-via-222-depots-github.html
#trojan

@bortzmeyer @oli @jpmens For context, we’re now in “signing co.uk on a regular laptop” territory, with more improvements to come. #DNS #DNSSEC

It's still Friday and we're still doing a Cascade release, so here's 0.1.0-beta5 'Got that holiday feeling'. 🏖️

In this release we're giving you more speed improvements by parallelizing sorting and more memory reduction by improving the handling of NSEC(3) in incremental signing. You can also track all of these improvements with newly introduced metrics.

Thanks again to @bortzmeyer, @oli and @jpmens and others for providing valuable feedback!

#DNS #DNSSEC #OpenSource

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta5

Whether you're trying to:
✓ Triage alerts
✓ Investigate incidents
✓ Hunt adversaries
✓ Defend against emerging campaigns

DNS is now another layer of the Censys Internet Map helping teams decide faster and more accurately across every stage of the security operations workflow: https://censys.com/blog/censys-expands-its-internet-map-to-include-dns-intelligence/

#Censys #infosec #ThreatIntel #DNS

« Souveraineté numérique : l’Afnic désignée pour gérer et développer les extensions Internet des territoires ultramarins » https://www.entreprises.gouv.fr/espace-presse/souverainete-numerique-lafnic-designee-pour-gerer-et-developper-les-extensions

#DNS #NomsDeDomaine

« Transparentes et participatives, avec une gouvernance ouverte et inclusive »

Today, we're happy to launch the NSD 4.15.0. This release of our authoritative #DNS server includes more than 20 fixes for LLM-assisted security reports. It also improves the Prometheus metrics, as a nice bonus.

#OpenSource #Security

https://community.nlnetlabs.nl/t/nsd-4-15-0-released/3423

@bortzmeyer @shaft QOTD
> Yes, following DNS stuff on Mastodon is now part of maintaining DNS...
Petit jeu : qui est l'auteur ?
La réponse
https://mail-archive.com/dns-operations@lists.dns-oarc.net/msg09228.html
#dns #dnssec #ccTLD

Hello, j'ai un domaine dont les NS sont aux US et au Canada. Est ce qu'en soi c'est un problème ? Est ce qu'il existe des NS publics fiables en Europe ? Si je cherche, je tombe bien sur des listes des trucs (genre https://publicdnsserver.com/switzerland/ ). Mais je n'ai aucune idée du sérieux de ce genre de listes, pas plus que de l'utilisabilité de ces serveurs dans ce contexte.

#NameServer #Domaine #NomDeDomaine #DNS

appréciés

My final #IETF draft submission for the day -- this one being #IPv6 related!

"Indicating IPv6-only SVCB Endpoints and IPv4 Deprecation in the DNS"

https://datatracker.ietf.org/doc/html/draft-nygren-dnsop-ipv6only-indicator-00

(Likely for @ietf_wg_dnsop given it is extending #DNS #SVCB, although it ties into v6ops and happy as well.)

Abstract: As the DNS is the primary mechanism for translating from hostnames to IP addresses, it is a logical place to signal that endpoints are IPv6-only. It is thus also a logical place to signal that legacy endpoints supporting IPv4 are being deprecated. This specification introduces two SvcParams for SVCB-compatible RR types that signal IPv6-only endpoints ("ipv6only") as well as deprecated endpoints ("deprecated").

#sunset4 #ToTheUniversalDeprecationOfIPv4

Après les #DNS et les #VPN, les ayants droit veulent désormais pouvoir bloquer des réseaux entiers. La lutte contre le piratage pourrait bientôt franchir une nouvelle étape en #europe. 
https://www.clubic.com/actualite-620074-apres-les-dns-et-les-vpn-les-ayants-droit-veulent-desormais-pouvoir-bloquer-des-reseaux-entiers.html

I wrote a #IETF -00 draft for @ietf_wg_dnsop on #DNS Domain Delegation Validation, intended to provide a path around the "Sitting Ducks" issues that @briankrebs and many others have called out over the years where DNS Lame Delegations can be hijacked due to lack of validation:

https://datatracker.ietf.org/doc/html/draft-nygren-dnsop-domain-delegation-validation-00

We split it off of https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-domain-verification-techniques-13 because we're really hoping to finally get that done and published.

Found a TUI for handling DNS changes! 🤯

🌐 **dnsglobe** — A global DNS propagation checker

💯 Query 34 DNS resolvers worldwide in parallel, compare results & watch propagation live w/ interactive world map

🦀 Written in Rust & built with @ratatui_rs

⭐ GitHub: https://github.com/514-labs/dnsglobe

#rustlang #ratatui #tui #dns #networking #terminal

Albania's .al was secured for a week or so. Wonder what happened. 🤔

DS added to root zone : https://mastodns.net/@diffroot/116812884301667310
DS removed : https://mastodns.net/@diffroot/116857712875727653

#DNS #DNSSEC #ccTLD

Help me to check metalhead.club's current CDN performance!

Check out https://media.metalhead.club and let me know if the displayed location is the nearest for you.

There's Germany, USA and Singapore available.

I'm curious if Bunny DNS works more accurately than Scaleway DNS.

#metalheadclub #cdn #dns #scaleway #bunnycdn

Please note that we have volunteered to have all of our products and libraries analyzed by LLM tooling, so you can expect security releases for pretty much everything, down to libraries like rpki-rs and projects in maintenance mode like ldns.

#DNS #RPKI #BGP #OpenSource

We have been working incredibly hard on patching all of the LLM-assisted security reports for our authoritative #DNS server NSD.

Today, we're happy to launch the NSD 4.15.0rc1 pre-release so you can test the 20+ fixes that are included. This release also improves the Prometheus metrics, as a nice bonus.

https://community.nlnetlabs.nl/t/nsd-4-15-0rc1-pre-release/3421

@benjojo While we love working in Rust, designing and building a #DNS resolver for the modern era is a massive undertaking.

Simply rewriting Unbound in Rust is a non-starter. We are taking gradual steps in reinventing our DNS stack by putting ldns in maintenance mode and investing in our domain library, and sunsetting OpenDNSSEC by launching Cascade.

Doing an authoritative server in Rust is definitely in the cards. Then, we can imagine putting all puzzle pieces together for a new resolver.

Où vont les e-mails de la presse française ?

On a épluché les DNS de 50 médias : Le Monde, Libération, Ouest-France, Mediapart, Charlie Hebdo, Splann!...

Résultat : une majorité confie sa messagerie à Google ou Microsoft. Sous juridiction américaine, Cloud Act inclus.

Les médias indépendants s'en sortent généralement mieux.

Données publiques, méthodologie ouverte.

👉 https://quihebergelesmails.fr/press

#numerique #presse #DNS #logicielslibres

Le sachiez-tu ? Le nom de domaine sci-hub.se n'existe plus mais il y a toujours des FAI français qui le censurent sur leur résolveur #DNS (et renvoient 127.0.0.1) https://atlas.ripe.net/measurements/184788556

#JORF #DNS - Désignation officielle de l'Afnic comme registre de .mq, .gp, .gf, .re, .tf, .yt, .pm et .wf

https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310819

https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310836

#JORF #DNS - Désignation de l'AFNIC comme office d'enregistrement chargé de la gestion des noms de domaines de premier niveau en :

- « .mq, « .gp », « .gf », « .re » et « .tf » : https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310819

- « .yt », « .pm » et « .wf » : https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310836

looking for a database of DNS IOCs, e.g. "if a client queries for domain <X>, it's probably compromised by <Y>". does this exist?

#dns #infosec

Tiens, le résolveur #DNS 1.1.1.1 (Cloudflare) a désormais des #NSID non-opaques (on reconnait le code des aéroports, au lieu de l'ancien système opaque).

Underrated reason to have proper SPF setup for all of your hosted domain names to hard fail improper sending routes... when you forget to turn off the mail sender on your dev server and you run a batch action that sends out tens of thousands of emails to users.

I saw my inbox fill up with thousands of email notifications since a lot of the notifications were sent to me. The only reason I'm not panicking is because I looked at the mail headers and saw that because the emails were sent from my computer instead of my server, they failed both SPF and DKIM verification checks so any damage should be limited.

Ugh. 😓

#webdev #selfhost #dns #sysadmin

vannes.bzh ne réponds toujours pas.

Le domaine à 2 serveurs faisant autorité déclarés dans la zone parente :

- sdns2.ovh.net : Il refuse de répondre (comprendre : il dit ne pas faire autorité)
- sdns.pointbzh.fr : serveur également chez OVH et qui lui ne réponds pas

#DNS

La Bretagne est épargnée par la canicule mais pas par les pannes #DNS. vannes.bzh ne répond plus.

Cours #DNS jeudi et vendredi. Comme d'habitude, si vous avez des domaines cassés et/ou rigolos, n'hésitez pas à les indiquer, on les fera analyser par les étudiant·es.

Technitium DNS: Mehr als nur ein Werbeblocker
https://linuxnews.de/technitium-dns-mehr-als-nur-ein-werbeblocker/ #technitium #dns #pihole #linux #linuxnews

Je dis ça je dis rien... mais le point.final https://client.rdap.org/?type=domain&object=point.final&follow-referral=1 n'est pas encore enregistré
@shaft
#dns #tld #gtld

Cascade supports incremental DNSSEC signing.

It doesn't use a jitter-based mechanism for this like OpenDNSSEC has, but rather a “re-signing schedule” approach.

To help you understand what to expect from the output, and how the associated settings will affect Cascade's behavior, we have documented the functionality here: https://cascade.docs.nlnetlabs.nl/en/latest/incremental-signing.html

#DNS #DNSSSEC #OpenSource

On dirait que "ai" et "pn" qui le faisaient avant ne le font plus.

Et je n'ai trouvé que "uz" qui le fasse (mais en https et sans le certificat pour "uz") …

#DNS

@firefoxwebdevs Or use the #DNS yourself, may be through a fediverse gateway: https://mastodon.gougere.fr/@DNSresolver/116754611721915909

Le sachiez-tu ? Un nom de domaine peut parfaitement être enregistré (et donc ne plus être disponible) sans pour autant être publié dans le #DNS. Cela peut être un choix du titulaire ou bien une opération par le BE ou le registre mais le résultat est le même : le DNS vous répond NXDOMAIN (No Such Domain) mais le domaine n'est pas libre. Utilisez donc RDAP (ou whois pour les plus de 60 ans comme moi) pour savoir si le domaine est enregistré.

(Testez, par exemple, avec en.fr.)

It still can't do DoH to an upstream DNS server, but it'll at least encrypt DNS queries within the local network now.

Title: Windows Server gets DNS over HTTPS (DoH) support

Subtitle: #Microsoft has finally flipped the switch on a long-awaited #Windows Server security upgrade, bringing encrypted #DNS to enterprise networks.

Link: https://www.neowin.net/news/windows-server-gets-dns-over-https-doh-support/

#Privacy #Security

It’s Friday release day again with Cascade 0.1.0-beta2 'Donde comen dos, comen tres'. Thanks to the amazing feedback from @jpmens and @gryphius and hard work from the team, our DNSSEC signer has a bunch of fixes and improvements.

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta2

#DNS #DNSSEC #OpenSource

Today we released ldns 1.9.1, which contains a security fix for CVE-2026-10846: Insufficient verification that responses belong to a query. Thanks Pablo Ruiz from ‘codecome.ai’ for the report.

Read more in the release post:
https://community.nlnetlabs.nl/t/ldns-1-9-1-released/3403

#DNS #OpenSource

I wanted to do some #DNS reverse lookup while editing a #Cisco config file in #Vim:

```
setlocal iskeyword+=.,:
setlocal keywordprg=dig\ +short\ -x
```

so I can press `K` with the cursor over an #IPv4 or #IPv6 address in the file, and I will get the corresponding PTR record if it exists.

This ended up in my `~/.vim/ftplugin/cisco.vim`.

With Cascade 0.1.0 beta1 “Slàinte mhath” we begin our journey to the first production release of our #DNSSEC signing solution.

We rewritten our signer from the ground up using a state machine based architecture, ensuring that each zone pipeline is in a single consistent state at all times.

In addition to built-in pre-signing and pre-publication review hooks, there’s now incremental signing, TSIG support, downstream IXFR, zone persistence, metrics and much more. #DNS

https://blog.nlnetlabs.nl/cascade-beta1-release/

🆕 blog! “How many consecutive hyphens can you have in a domain name?”

A seemingly simple question which sent me down into the murky depths of standards. How many consecutive hyphens can you have in a domain name? It probably isn't sensible to name your online presence a----------hyphen.com - but is there anything technically…

👀 Read more: https://shkspr.mobi/blog/2026/06/how-many-consecutive-hyphens-can-you-have-in-a-domain-name/
⸻
#dns #ICANN #IETF #internet #standards #web

@jpmens Ah yes, this link is a more accurate reflection of the past few days. 😄

https://github.com/NLnetLabs/cascade/issues?q=is%3Aissue%20author%3Ajpmens%20created%3A%3E%40today-1w

TSIG is mentioned 6 times!

#DNS #DNSSEC

With eight issues and one pull request over the weekend, once again we're incredibly thankful for the effort @jpmens is putting into testing Cascade.

Luckily, none of the reports seem to be in the “everything is broken”-category! 😅

https://github.com/NLnetLabs/cascade/issues?q=is%3Aissue%20state%3Aopen%20author%3Ajpmens%20created%3A%3E%40today-1w

#DNS #DNSSEC #OpenSource

With the Cascade beta release, the project now also has a dedicated page on our website:

https://nlnetlabs.nl/projects/cascade/about/

Next up: a logo!

#DNS #DNSSEC

After releasing the Cascade beta, NLnet Labs HQ has a @jpmens vs. @bortzmeyer poll going.

#DNS #DNSSEC

Alt...

A poll that asks “How many GitHub issues will JP Mens and Stephane Bortzmeyer create by Monday?”

Cascade 0.1.0 beta1 “Slàinte mhath” is out, so this is your opportunity to kick the tires and take it for a spin around your testing grounds!

As we gear up to the production release of our DNSSEC signer, we're eager to hear your feedback so we can incorporate it while we add improvements that we still have in the pipeline which we consider essential for production use.

Read all about it in our blog post!
https://blog.nlnetlabs.nl/cascade-beta1-release/

#DNS #DNSSEC #OpenSource #rustlang #LoveDNS

Mon problème de #wifi merdique à la maison s’est résolu tout seul. Comme c’était arrivé à peu près en même temps que la mise en service de mon #pihole et que les symptômes faisaient clairement penser à un truc lié au #dns, j’ai passé pas mal de temps à faire du diag sur le sujet. Mais sans réussir à reproduire significativement les erreurs.
La seule différence avec aujourd’hui, c’est que les #firetv font genre x100 voir x1000 moins de requêtes dns qu’avant.

> Les SOA quand il y en a un ça va, c'est quand il y en a plusieurs qu'il y a des problèmes…
https://atlas.ripe.net/measurements/176129238/

blaeu blaeu-resolve --type SOA --ipv4 --requested=100 shiabank.com.
…
[ns-2evo.shiabank.com. hostmaster.shiabank.com. 1780405930 3600 600 86400 60] : 1 occurrences
[ERROR: SERVFAIL] : 3 occurrences
[ns-r6gh.shiabank.com. hostmaster.shiabank.com. 1780405930 3600 600 86400 60] : 1 occurrences
Test #176129238 done at 2026-06-02T13:12:51Z
#dns #soa #pouetCommeHortefeux

Given my domain renewal is around the corner, used the opportunity to move this last domain from Gandi to Porkbun.

Served me well over the years, but with all the recent changes, putting my (little) money where my mouth is and move to a better registrar.

#DNS

More IDN homograph detection research today. This screenshot is a bit horrifying considering how nearly identical many of the invalid entries visually match the valid entry (top).

#DNS #homograph #cybersecurity

Alt...

TIME CLIENT DOMAIN TYPE STATUS SOURCE SEC LATENCY 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. MX CACHE 0.1ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. AAAA FORWARD v SEC 43.1ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A CACHE 0.1ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypat.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypat.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypat.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-02 01:29 UTC 10.17.89.197 paypal.com. A BLOCKED HOMOGRAPH 0.0ms

Screenshot from my custom (Rust) DNS filtering-forwarder with new experimental runtime IDN homograph detection against a predefined protected domain list.

Screenshot results reflect these punycodes:
xn--ggle-55da.com google.com BLOCK
xn--pypl-53dc.com paypal.com BLOCK
xn--pple-43d.com apple.com BLOCK
xn--fiq228c5hs.cn chinese ALLOW

#DNS #homograph #cybersecurity

Alt...

TIME CLIENT DOMAIN TYPE STATUS SOURCE SEC LATENCY 2026-06-01 17:30 UTC 10.89.17.11 FZ. cn. A FORWARD - 450.5ms 2026-06-01 17:30 UTC 10.89.17.11 apple.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-01 17:30 UTC 10.89.17.11 paypal.com. A BLOCKED HOMOGRAPH 0.0ms 2026-06-01 17:30 UTC 10.89.17.11 google.com. A BLOCKED HOMOGRAPH 0.0ms

This month, Berkeley Internet Name Domain better known as BIND celebrates its 40th anniversary! It was first released with BSD 4.3 in June 1986 🥳🎂🎉

#DNS #BIND

Ou d'autres exemples amusant sur du DNS

Le retoot aide la pédagogie ^^

#DNS

bizarre (heureusement pas en "prod")

une recherche rapide m'indique que je suis pas le seul...

Je ne comprends pas pourquoi le site web de cette initiative de fourniture de DNS européens (qui inclut un filtrage enfant + antipub) n'est toujours pas traduite en plusieurs langues européennes 🤔

https://joindns4.eu/

Les DNS Grand Public :

- Protective 86.54.11.1
- Protective + Child Protection 86.54.11.12
- Protective + Ad Blocking 86.54.11.13
- Protective + Child Protection + Ad Blocking 86.54.11.11
- Unfiltered 86.54.11.100

#DNS #AntiPub #ChildCare

Alt...

Logo de DNS4EU, le 4 est en jaune, les lettres en gris.

If you run your own local DNS servers at home, do you: (select all that apply)

Comment with your preferred DNS stack and privacy friendly DNS providers.

#FreeBSD #Linux #selfHosting #DNS

I self-host the DNS for my domains for more than 20 years now.

2026 now finally was the year, where I decomissioned the last BIND server and replaced it with a PowerDNS, containerized in Podman and a SQLite backend.

I already migrated the hidden-primariy to PowerDNS in 2022 (because of the REST API, compatibility with Traefik, easier DNSSEC handling and the higher flexibility) and now my secondaries are also migrated.

Nontheless, BIND was one of the most stable pieces of technology that I've ever used. But it also felt a bit unwieldy and old-fashined ins some ways.

#dns #bind #powerdns #podman #contianer #linux #domain

We released Unbound 1.25.1 just seven days ago and now look at the changelog today. ❤️‍🩹🔥

https://github.com/NLnetLabs/unbound/blob/master/doc/Changelog

#DNS #LLM #Mythos #OpenSource

@danyork Any city (not too small, however). #DNS can do anything.

@h4ckernews

Yes, #p2p gnutella. I remember.

> For most #Gnutella was a file transfer tool. This categorization misses a basic function of the #protocol. At its core, Gnutella is just a peer-to-peer #search engine for blobs.

> We could have used it as a poor man's #DNS system, or a global metadata lookup table for key/value pairs, or a matchmaking service for your Unreal Tournament league, but that never really happened. Gnutella was good at providing file downloads that matched search queries, and that is what history remembers it for.

QOTD
> Technitium DNS Server est un serveur DNS open source complet : autoritaire, récursif, et relais.
@bortzmeyer revenez vite de vacances !
#dns

So question:
"how many authoritative name servers don't support encryption?"

The internet claims that this is >95%.

My personal feeling is that this is lower but this might be my bubble, that we're the 5%.

What's your feeling?

#infoSec #cybersecurity #DNS #encryption

Plz retoot for reach.

🚨 SECURITY RELEASE 🚨
Today we released Unbound 1.25.1, which consolidates security fixes for issues reported over a period of time.

There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608.

Please read the release notes carefully and plan to upgrade.

#DNS #DNSSEC #Mythos #LLM #OpenSource

https://community.nlnetlabs.nl/t/unbound-1-25-1-released/3392

Pro tip: set `UseDNS no` in your sshd_config to disable reverse DNS lookups for every single ssh connection to your host.

It provides no filtering or validation purpose, afaik, and seems to only generate excess DNS traffic.

This lesson brought to you by the 66k DNS lookups in the past 24hrs from a single public facing forgejo jail.

#FreeBSD #SSH #DNS

chinamobile.com has four #DNS name servers and they all have the same set of IP addresses.

#OARC46

Nice and clever trick to recover some of the "anonymized" IP addresses in #DNS root name server traffic. ("Anonymization" is often a joke.)

#OARC46

If your employer is an OARC member, you have access to the #DNS data collected by the root name servers. (Talk by Kazunori Fujiwara)

As always, working with data is complicated. For instance, some operators (A, B, D, F, H, I, J and L) blur the IP addresses, and it is not documented. (And they don't use the same algorithm.)

#OARC46

"Gonemaster - A Go implementation of Zonemaster" by Patrik Wallström

Instead of using AI, let's use Go :-) Among the good things: native concurrency [I approve]

https://codeberg.org/pawal/gonemaster

#Go #DNS #OARC46 🐪

@ximon18 @dnsoarc after his talk on stage, Ximon will be at the demo table in the lunch area, where he can show all the other tricks Cascade has learned since OARC 45 in Stockholm.

Also, make sure to bring your zone files so you can for example see how fast parallel #Dnssec signing by @bal4e really is. #DNS #LoveDNS #OpenSource

"It's still broken."

#DNS #OARC46

The NS set and the associated glue MUST be consistent between parent and child domain. If they are not, the result will depend on wether the #DNS resolver is parent-centric or child-centric.

(talk by Petr Špaček)

At a time, it broke the .cd TLD.

#OARC46

Webmin is hardened & clustered w/ three total nodes, ns1, ns2, and ns3 etc. I will eventually add clustered nodes on two other locations so records are still served when one cluster's host is down.

https://tech.haacksnetworking.org/2025/12/29/authoritative-dns-w-bind-9/ feedback welcome.

Added larger tmp directory & source-IPd vhost so webmin won't lock. Obv, make sure you use static, dedicated, & fully hardened external IPs for permitted list.

#selfhosted #homelab #sysadmin #linux #dns #webmin #opensource #freesoftware #networking

Alt...

haack's networking business logo

Funny that #DNS traffic analysis at Salesforce show still a lot of requests for obsolete types like A6, SPF, DLV.

#OARC46 #oldRRtypesNeverDie

Now, let's innovate: about DELEG, the future new system for #DNS delegation.

"Authoritative Enrollment of DELEG" by Libor Peltan

#OARC46

#DNS root zone key rollover under way. (Planned for 11 october.)

"Who in the room has root access to his resolver?" (Lot of hands, this is an OARC meeting.)

#OARC46 #DNSSEC

Wonderful list of things that can go wrong (and therefore, will) in operations.

(Including an error done on friday afternoon and fixed, will you guess, on monday.)

#DNS #DNSSEC #OARC46

DNessie, official #OARC46 mascot.

#DNS

Alt...

A cute Loch Ness monster standing in the front of the room.

"Modeling DNS Queries and Caching to Evaluate the Merits of QNAME Minimization" by Casey Deccio

Great explanation of caching dynamics, by the way.

#DNS #privacy #OARC46

Actually measuring the robustness of the Internet is hard. For instance, for #DNS resolvers (the current talk by Maynard Koch), good resolvers, actually used by people, are typically not publically reachable. The open resolvers which are easy to study are typically misconfigured and not actually used.

#OARC46

Weather at #OARC46 https://mastodon.gougere.fr/@DNSresolver/116583456671651351

#DNS

Did you know that OARC has its own fediverse instance?

#DNS #OARC46

Alt...

Sticker with a mastodon and the domain name mastodns.net

Good morning, Edinburgh! First day of the OARC workshop.

#DNS #OARC46

https://indico.dns-oarc.net/event/56/

Alt...

An old stone building (the Writer's Museum).

[lien] [Dnsmasq-discuss] Security - IMPORTANT #security #gik #dns #net

Averaging 36.6% block rate on my DNS filtering service across all users.

In the age of enshittification it's not hard to believe that 1/3 of all DNS queries request adware, malware, trackers, and other crap you don't need.

#DNS #enshittification

Dear Fedi friends,
You know how grateful I am for your help and expertise. I have a burning question and I know some of you may have the correct answer.

Long story short, I had been doing a deep dive into #WSocial. My exposé published on Friday got 830 retweets!

I am working on a follow-up piece and there's something I don't understand.

The homepage of W Social is now redirecting - from wsocial.eu to wsocial.news

If I put wsocial.news in WHOIS databases, I'm finding very little information about when it was registered. And there's some odd stuff, like showing an IP address in Washington DC - but they are very adamant of being hosted in Europe... and they use bunny.net (Slovenia). What gives?

#AskFedi #DNS #WhoIs

Alt...

a screenshot of DomainTools showing the WHOis record for WSocial.news - it says name servers are from bunny.net but the IP location and ASN are from Datacamp in the US

Just realised that #DNS is Internet Standard (STD) 13.

In Western societies it means that DNS brings, obviously, good luck ☝️

https://www.rfc-editor.org/info/std13

Encore un correcteur trop zélé (c'est legarcon.net, pas legarçon.net)

#IDN #DNS

@jpmens As expected, it was not a #DNS problem. :)

[lien] DNS et certificats SSL, les deux clés d'Internet que l'Europe n'a jamais eu en main #politikkills #gik #net #dns #tls

⋅ DNS et certificats SSL : les deux clés d'Internet que l'Europe n'a jamais eu en main

− https://www.clubic.com/dossier-611791-dns-et-certificats-ssl-les-deux-cles-d-internet-que-l-europe-n-a-jamais-eu-en-main.html

#DNS #SSL

.de incident is a good reminder that #DNS resolver operators really should serve stale data (#RFC 8767) when needed.

It helps.

DENIC wrote in their status message that "all DNSSEC-signed .de domains are currently affected in their reachability"
https://status.denic.de/pages/incident/592577eab611ce1e0d00046f/69fa60ef9d12f5057a974f38

But it wasn't just DNSSEC-signed domains! For example, bahn.de was down even though it is not DNSSEC-signed.

It looks like for DNSSEC-signed zones the DS record in de. was incorrectly signed:
https://dnsviz.net/d/nic.de/afpsNg/dnssec/

And for zones that were not signed, the NSEC3 records proving there is no DS record were incorrectly signed:
https://dnsviz.net/d/bahn.de/afpnxQ/dnssec/

#DNS

Please remember that #DNS is innocent until proven guilty. AFAIK DNS is working as expected in the case of .de outage

#DENIC

Alt...

'DNS is innocent' in caps against a yellow background

Here's a thought:

The fact that people are experiencing issues with DE sites and asking if CloudFlare is down speaks volumes about the stability of DE ccTLD and the broader DNS compared to big cloud providers.

#DNS #InfoSec #SysAdmin

DENIC's status page:
https://status.denic.de/

Screenshot below in case you're not able to load it (as I said, stuff is going to be intermittently failing).

#DNS #DENIC #DNSSEC #InfoSec #SysAdmin

Alt...

DNSSEC disruption affecting .de domainsPartial Service Disruption Incident Status Partial Service Disruption Components DNS Services DNS Nameservice May 5, 2026 23:28 CEST May 5, 2026 21:28 UTC INVESTIGATING Frankfurt am Main, 5 May 2026 – DENIC eG is currently experiencing a disruption in its DNS service for .de domains. As a result, all DNSSEC-signed .de domains are currently affected in their reachability. The root cause of the disruption has not yet been fully identified. DENIC’s technical teams are working intensively on analysis and on restoring stable operations as quickly as possible. Based on current information, users and operators of .de domains may experience impairments in domain resolution. Further updates will be provided as soon as reliable findings on the cause and recovery are available. DENIC asks all affected parties for their understanding. For further enquiries, DENIC can be contacted via the usual channels.

Ok, #DNS is innocent. Most of the time. Curious to know what caused .de outage

Am I the only one having #DNSSEC problems with #DENIC?

Unbound is throwing me a lot of DNSSEC bogus on some .de domains 🤔

#DNS

$ dig welt.de
...
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21366
...
; EDE: 6 (DNSSEC Bogus): (validation failure <welt.de. A IN>: signature crypto failed from 2a02:568:0:2::53 for DS welt.de. while building chain of trust)

At this moment, please send #HugOps to folks at DENIC. They are dealing with a really bad and stressful situation and I am sure they are doing their best to resolve it as soon as possible.

#DNS #DENIC

Edit: issue seems fixed.

Looks like DE ccTLD is unresolvable due to DNSSEC issue:
https://dnsviz.net/d/nic.de/afpsNg/dnssec/

😬

🧵👇

#InfoSec #DNSSEC #DNS #Germany

RE: https://mastodon.social/@jpmens/116522310229612501

IANA has a chance to do the funniest thing ever…

#DNS #DNSSEC #InfoSec

[lien] [FRnOG] [Alert] Compromission de la BDD des domaines chez bookmyname #cageaniel #security #gik #net #dns #db

I am looking for a few more US-based early adopters to provide feedback on a protective DNS service offering aligned with NIST SP 800-81 Rev. 3 (March 2026).

https://csrc.nist.gov/pubs/sp/800/81/r3/final

This service merges Zero Trust and DNS without requiring client-side agents. Supports mobile devices, browsers, server hardware & IoT.

If you're interested in providing feedback on this service as a free beta tester, email me at:

securednsbeta@techliterate.co

#FreeBSD #BastilleBSD #ZTA #DNS #IOT #NIST #Infosec

Can you reach https://crocuda.com ?
(it is #ipv6 only)

#dns

Ah, je viens donc de découvrir que drill a été "abandonné", que le nouvel outil s'appelle "dnsi" ... Et qu'il n'a pas l'air beaucoup plus développé non plus.
Faut en revenir à dig ?

#DNS