Some light #reading on this fine #rainy #October #Friday #night.

#dns #bind #homelab #fun

Alt...

Great book!

heise+ | Adblocker inklusive: DNS-Server Technitium installieren und einrichten

Der DNS-Server Technitium glänzt mit großem Funktionsumfang, ist aber nicht ganz einfach einzurichten. Wir zeigen Installation und Konfiguration.

https://www.heise.de/ratgeber/Adblocker-inklusive-DNS-Server-Technitium-installieren-und-einrichten-11439401.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DNS #Docker #IT #Linux #OpenSource #news

Save the dates! There will be a two days Root #KSK ceremony next april!

- 2027-04-29: Delete KSK-2017 & Decommission Related Materials¹
- 2027-04-30: Sign 2027Q3 ZSKs; Generate KSK-2027, Introduce Six New HSMs²

There should be a algorithm rollover! Root zone would go elliptic!! 🥳🥳🥳

'Having considered the feedback received, #ICANN org intends to proceed with the Root Zone KSK Algorithm Rollover as described in the proposal.'³

So long KSK-2017 and hello KSK-2027!

¹ https://www.iana.org/dnssec/ceremonies/65-1
² https://www.iana.org/dnssec/ceremonies/65-2

³ https://itp.cdn.icann.org/en/files/domain-name-system-dns-engineering/summary-report-proposed-root-ksk-algorithm-rollover-04-05-2026-en.pdf

#DNSSEC #IANA #DNS

[lien] Root DNSSEC trust anchors - Lobsters (jpmens.net via 7tehdt3cnw6kir6o) #security #gik #dns #net

#PacketQ v1.8.0 released!
- now support reading DNSTAP files!
- new column `dns.transport` for what DNS used, example UDP, DOH, DOQ, DNSCryptUDP etc
#DNS #PCAP #DNSTAP #Analysis #SQL #OpenSource
https://codeberg.org/DNS-OARC/PacketQ/releases/tag/v1.8.0

@DailyCyberSecurity On March 1, 2026, Iran was about a day into a near-total internet shutdown: NetBlocks measured connectivity at 4% of normal, Cloudflare Radar a drop of about 98%. What remained was essentially a domestic intranet, and DNS was one of the very few paths that still leaked out. So people turned to DNS tunneling: slow, unstable, hard to set up, but sometimes the only thread to the outside world. VPNs were sold by the gigabyte, starting around 2 million toman each, and hand-made DNS tunnel setups spread from person to person. A flood like this most likely reflects that moment: many clients and automated tools hammering DNS, constantly probing for any route that still worked. DomainTools rightly doesn't name who ran supaghost, but the timing says a lot. Seen from the network, it's an anomaly. From inside Iran, it was people trying to stay connected.

#Iran #InternetShutdown #DNS

I came across a user mentioning the .irish TLD is owned by American capitalists, but that’s only the tip of this iceberg. Since I went down this road of “who is my TLD operator” already, here’s a brief introduction to the Identity Digital / Donuts empire.

Using a country, region or populace is a valid objection to ICANN. The outdoor brand Patagonia wanted .patagonia, but Argentina filed an objection and the brand withdrew their application.

I don’t see a single objection to .irish in the 2014 public comments, which is unfortunate. But a lot of sketchy and questionable things snuck through back then—.zip anyone?

A corporation shouldn’t own a nationality or diaspora TLD.

Where was the ICANN’s GAC (Governmental Advisory Committee)? Well..

Identity Digital, who now operates .irish, is a mess of companies, ironically originally founded in Ireland in 1999, now “operating” in Bellevue, WA, US. It was acquired by Afilias (who then owned irish) and later Donuts. All backed by American PE, Ethos Capital. If that PE firm sounds familiar, they tried to gain private control of .org for $1B in 2021.

And the CEO of this PE firm? Here’s a screenshot of his own LinkedIn, where he was previously ICANN’s President.

Your TLD owner and operator matter. The political control and financial damage a misaligned corporation can inflict is worrisome. My best recommendation is to pursue well governed and protected ccTLDs. Or a non-profit with an aligned mission statement, like .meow.

#dns #icann #tld

Alt...

CEO Identity Digital Inc. - Full-time Nov 2018 - Present - 8 yrs Los Angeles County, California, United States ICANN 8 yrs 2 mos Los Angeles Metropolitan Area President, Global Domains Division Jul 2013 - Oct 2018 - 5 yrs 4 mos Oversee ICANN's globally integrated business operations comprising over 70...more COO Sep 2010 - Jun 2013 - 2 yrs 10 mos

Bon, normalement, toutes les signatures faites avec l'ancienne clé de la racine du #DNS ont maintenant expiré. Si votre réseau fonctionne encore, c'est que vous aviez bien reçu la nouvelle clé. Si votre réseau ne fonctionne plus, c'est parce que votre configuration #DNSSEC était mal gérée (ou que vous étiez dans un centre de données de Yandex).

A domain name of mine failed in #DNSViz. The error message is as follows:

org zone: The server(s) were not responsive to queries over UDP. See RFC 1035, Sec. 4.2. (2001:500:c::1)

I checked other *.org. domain names, and they all seem to error on the same cause.

Following this rabbit hole shows, that the IPv6 in the error message is one of the authoritative nameservers of org., namely b0.org.afilias-nst.org..

Asking this specific nameserver responds with UDP to requests on IPv4 and on IPv6. Is it, that DNSViz's hosts are blocked and cannot reach that server? Other IPv6 addresses of the other nameservers of org. also appear to respond on UDP.

Thankful for insights!

#DNS #DNSViz #TLD #gTLD #org #IPv4 #IPv6

PowerDNS DNSdist 2.1.3 and 2.0.11 Released

https://blog.powerdns.com/2026/10/12/powerdns-dnsdist-2.1.3-and-2.0.11-released

#dns #dnssec

[lien] Blog Stéphane Bortzmeyer: Remplacement de la clé DNSSEC de la racine #security #gik #net #dns

Aujourd'hui, la racine du #DNS, qui était signée avec la clé 20326 a changé, et utilise désormais la clé 38696. https://www.bortzmeyer.org/remplacement-cle-dnssec-2026.html

#DNSSEC #RSA #JeSuisEnWeekEnd

[fobser@pocketcapybara:~]
$ dig +norec +dnssec @k.root-servers.net DNSKEY .
; <<>> DiG 9.20.29 <<>> -r +nocookie +nocrypto +nsid +retry=0 +norec +dnssec @k.root-servers.net DNSKEY .
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45103
;; flags: qr aa; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; NSID: 6e 73 32 2e 6e 6c 2d 61 6d 73 2e 6b 2e 72 69 70 65 2e 6e 65 74 ("ns2.nl-ams.k.ripe.net")
;; QUESTION SECTION:
;.              IN  DNSKEY
;; ANSWER SECTION:
.           172800  IN  DNSKEY  256 3 8 [key id = 8763]
.           172800  IN  DNSKEY  257 3 8 [key id = 20326]
.           172800  IN  DNSKEY  257 3 8 [key id = 38696]
.           172800  IN  RRSIG   DNSKEY 8 0 172800 20261101000000 20261011000000 38696 . [omitted]
;; Query time: 18 msec
;; SERVER: 2001:7fd::1#53(k.root-servers.net) (UDP)
;; WHEN: Sun Oct 11 16:01:51 CEST 2026
;; MSG SIZE  rcvd: 1164

​

#DNS #KSK2024

Bon, sinon, c'est pas tout, mais, aujourd'hui, on change la clé de la racine du #DNS. Avec un peu de chance, on exterminera l'humanité avec une panne DNS, avant que l'IA ne s'en charge.

#DNSSEC

Salut !

La page du wiki concernant la synchronisation des #DNS #OVH pour l' #IPv4 et l' #IPv6 vient d'être entièrement révisée, mise à jour et améliorée.

https://wiki.blablalinux.be/fr/synchronisation-dns-ovh-ipv4-ipv6

Aujourd'hui, le fichier de zone de la racine du #DNS fait environ dans les 2,2 Mo et donc tiens sur une disquette 3,5" à densité étendue (ce sont celle avec une capacité de 2880 Kio). 💾

Avec l'arrivée des nouveaux #gTLD, on risque fort de dépasser cette capacité et il va falloir zipper pour que ça tienne sur ce type de disquette 😔

🥐 DNS Resolver Quad9 Rejects French Piracy Blocks, Weighs Exit as beIN Seeks Up to €580K a Day * TorrentFreak https://torrentfreak.com/dns-resolver-quad9-rejects-french-piracy-blocks-weighs-exit-as-bein-seeks-up-to-e580k-a-day/

#dns #privacy #france

There may be a .taylorswift soon #DNS #ICANN #gTLD

https://newgtldprogram-aps.icann.org/applications/TRML2619T-T56523/summary

A 40" display, you say?

Yes, so I can have a very wide terminal window with a `tail -f xfer-out.log` showing me zone transfer entries on individual lines ;-)

#migration #monitoring #dns

heise+ | HTTPS im Heimnetz: So sichern Sie lokale Dienste ab

Selbst gehostete Dienste lassen sich dank DNS-01-Challenge mit Let's-Encrypt-Zertifikaten absichern, ohne aus dem Internet erreichbar sei zu müssen.

https://www.heise.de/ratgeber/HTTPS-im-Heimnetz-So-sichern-Sie-lokale-Dienste-ab-11439409.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DNS #Docker #Domain #https #IT #Linux #Server #Verschlüsselung #news

#DNS #nomDeDomaine

Du 25 au 27 septembre, un inconnu a piraté trois registres de noms de domaine. L'occasion de rappeler, face à plusieurs commentaires erronés, que si un attaquant prend le contrôle du nom de domaine, il peut tout faire (et, non, #TLS ne protège pas).

https://www.bortzmeyer.org/piratage-trois-cctld.html

#DNS #nomDeDomaine #ICANN
Si vous voulez voir la liste des 1 615 nouveaux domaines de premier niveau demandés, elle a été publiée hier :
https://newgtldprogram-aps.icann.org/
.meow, .furry, .pride, .vegan, .koala, .panda, .metaverse (il y a des optimistes), .québec (avec l'accent), quatre .con (en français, ça va faire drôle), une dizaine de .agent, un .ham mais pas de .spam, quatre .cannabis, sept .quantum (pour ceux qui veulent un autre buzzword que IA), un seul .stradivarius, un .taylorswift…

On October 11th, the DNS root is swapping its master security key for only the second time ever.

If you run a DNSSEC-validating router or homelab resolver (like pfSense or Unbound), RFC 5011 auto-trust probably already handled it for you, but you'll want to verify so lookups don't suddenly fail. The good news is following this link will perform validation for you using DNS lookups alone.

https://dnstest.dev/ksk-2024/

Consider boosting to help your followers.

#DNS #DNSSEC #HomeLab #Networking

Happy #ICANN Reveal Fresh Hell Day! A company in the Caymans would like the TLD .pdf

And these other spectacular submissions that surely won't end poorly: .sys .key .duo .lab .private .state .auth .conf .config .loc .log .php .url .vpn

#DNS #RevealDay #blueTeam #tld

Alt...

Screenshot of ICANN application details for the TLD spring "pdf" circled in red with my text WITAF

RE: https://mastodon.social/@bagder/117401551466729243

Domains? Where we’re going, we don’t need domains!

https://ar.al/2025/06/25/web-numbers/

#WebNumbers #SmallWeb #SmallTech #decentralisation #DNS #ICAAN #gTLD

JP Mens™ boosted

daniel:// stenberg:// » 🌐 2026-10-07
@bagder@mastodon.social

"Here you can find a full list of all New gTLD Program: 2026 Round applications"

Yeps, exactly as crazy as you can imagine.

https://newgtldprogram-aps.icann.org/applications

⋅ DNSSEC : la clé principale du DNS change le 11 octobre, qui doit vérifier son résolveur ?

− https://www.it-connect.fr/dnssec-roulement-ksk-racine-dns-verifier-resolveur/

#DBSSEC #DNS

Mauvais hébergement #DNS (les trois serveurs ont des adresses IP proches, donc sans doute au même endroit) https://mastodon.gougere.fr/@DNSresolver/117395392662543078

DNS resolver bot » 🤖 🌐 2026-10-06
@DNSresolver@mastodon.gougere.fr

@bortzmeyer dns1.finances.gouv.fr.
dns3.finances.gouv.fr.
dns2.finances.gouv.fr.

Preparing for Post Quantum DNSSEC with PowerDNS

https://blog.powerdns.com/preparing-for-post-quantum-dnssec-with-powerdns

#dns #dnssec

DNS resolver Quad9 is considering pulling out of France after broadcaster beIN Sports asked a Paris court to impose non-compliance penalties that could go up to €580,000 per day.

**DNS Resolver Quad9 Rejects French Piracy Blocks, Weighs Exit as beIN Seeks Up to €580K a Day**

https://torrentfreak.com/dns-resolver-quad9-rejects-french-piracy-blocks-weighs-exit-as-bein-seeks-up-to-e580k-a-day/

#DNS #Quad9 #Censorship #BeInSports

Salut @shaft
Ton résolveur DNS fonctionne à nouveau depuis le le pays le plus notoirement hostile à l'Internet quand c'est pas le-leur-rien-qu'à-eux.

Tout comme celui de @bortzmeyer mais celui-ci n'avait pas été bloqué.

Je ne le crie pas trop fort des fois que l'idée de les bloquer les reprenait, hein...

Un **grand merci** à tous les deux!

#DNS #Censorship #Privacy

PowerDNS Recursor 5.3.11 and 5.4.7 Released

https://blog.powerdns.com/2026/10/01/powerdns-recursor-5.3.11-and-5.4.7-released

#dns #dnssec

Godot stands for "Geography over #DNS over #TLS"

The DNS Museum https://dns.museum #History #dns

We’re in the home stretch for Cascade’s first production release. By now it’s a tradition to team up with our house designer, Richard de Ruijter, to design a logo. We’re excited to show it to you now — we hope you like it!

#DNS #DNSSEC #OpenSource

We’re in the home stretch for Cascade’s first production release. By now it’s a tradition to team up with our house designer, Richard de Ruijter, to design a logo. We’re excited to show it to you now — we hope you like it!

#DNS #DNSSEC #OpenSource

Major update on https://dns.hostux.net : you can now create your own custom block list. I took this opportunity to give the site a visual refresh.

#DNS #Privacy #Selfhosting

Alt...

Screenshot showcasing dns.hostux.net website light and dark themes side by side, separated diagonally by an orange line. The light theme uses a cream background with black text, while the dark theme uses a black background with white text. Both display the HostuxDNS navigation, DNS filtering profiles, and orange accent elements.

Bien, du coup je vais essayer de faire une #introduction

Je suis Shaft, breton anciennement exilé en Île-de-France. Je cause de :
- #DNS (pas mal)
- De trucs divers (cinéma, musique de flim...)

Je fais des jeux de mots nuls (trop)

J'essaye d'apprendre en autodidacte comment fonctionne Internet

J'administre un service de DNS sur TLS (DoT) et DNS sur HTTPS (DoH), voir ici : https://www.shaftinc.fr/dns-shaftinc.html

Mes messages sont majoritairement en français, et quelques fois in English

We released beta7 of our #DNSSEC signer Cascade, named “Gezellig”.

We can now read TSIG key data from a file, supporting the NSD, BIND, and Knot formats. There are various bug fixes and improvements for using Cascade with an HSM.

Starting today Cascade is being included in the AI-assisted security scanning that has been performed on most of our other #DNS, #BGP and #RPKI projects since last year. This means even the very first production release will be very solid.

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta7

des.services both signed in #ED25519 and #MLDSA44 😊

#DNS #DNSSEC #NewRFC #RFC #PQC

PowerDNS DNSdist 2.0.10 Released

https://blog.powerdns.com/2026/09/22/powerdns-dnsdist-2.0.10-released

#dns #dnssec

Just found a massive footgun if your hostname contains a . (dot), e.g. if you use FQDN directly as /etc/hostname, your gTLD may accidentally become a DNS search domain used by libc. Anyone can register a domain name under your gTLD to bypass DNSSEC. #dns #dnssec

Alt...

cat rootfs_extra/etc/resolv.conf # Use unbound to resolve DNS locally. # # Note: since systemd-networkd is used, DNS must be set correctly # in /etc/systemd/network/default.network. This is only a fallback. nameserver 127.0.0.1 nameserver ::1 # Use the DNS root as the "local" domain name. Without this setting, # glibc may derive the "local" search domain from the machine's hostname. # For example, if the machine's hostname is a FQDN such as example.club, # dnssec-failed.org falls back to dnssec-failed.org.club, which is a # valid domain, allowing DNSSEC bypass! domain .

#DNS

Sinon, vous vous en fichez peut-être mais le domaine de tête .kp (Corée du Nord) est HS (aucun des deux serveurs faisant autorité ne répond).

Admirez ce que ça donne avec la configuration très particulière de Verisign pour les serveurs faisant autorité pour .com et .net : https://bgpmap.net/s/fngdc6ppqb

#BGP #DNS

https://mullvad.net/en/blog/2026/9/3/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead

Oh I use Mullvad DNS on my Mac after switching from Quad9. I guess I'll go back to Quad9 then!
PSA: Remember to set a reminder to update it before it expires...

#quad9 #dns #mulllvad

We recently published our LLM policy, requiring all code and documentation contributions to be authored by a human. We do accept reports of vulnerabilities found with LLMs.

It has drawn a lot of feedback, both positive and negative. In this article we want to explain the background and motivation behind our choices.

#OpenSource #DNS #BGP #RPKI #softwaredevelopment

https://blog.nlnetlabs.nl/maintaining-the-love-for-coding-in-the-time-of-ai/

#DNS #cryptographie

https://mastodon.gougere.fr/@DNSresolver/117246027675732613

Le post-quantique est trop lourd même pour un mastodonte.

#DNS stands for Domain Name Shenanigans ☝️

PowerDNS DNSdist 2.1.2 and 2.0.9 Released

https://blog.powerdns.com/2026/09/08/powerdns-dnsdist-2.1.2-and-2.0.9

#dns #dnssec

At the core of the global internet are the DNS root servers. These 13 go-to places are at the top of authority when it comes to making sure you can connect to any server with a domain name. What you might not know is that 10 of these 13 root servers are ultimately under US jurisdiction. Should that worry you? I guess not, the current system is quite robust. But I deal in risk assessment and probabilities. And I think this isn't an ideal setup.

https://en.wikipedia.org/wiki/Root_name_server

#DNS #Centralisation

Alt...

2026-09-07 DNS Root Server Addresses Letter IPv4 address IPv6 address Operator Operator origin A | 198.41.0.4 | 2001:503:ba3e::2:30 | Verisign | United States B | 170.247.170.2 | 2801:1b8:10::b | usc-Ist | United States C | 192.33.4.12 | 2001:500:2::c | Cogent Communications | United States D | 199.7.91.13 | 2001:500:2d::d | University of Maryland | United States E | 192.203.230 |.10 2001:500:a8::e | NASA Ames Research Center | United States F | 192.5.5.241 | 2001:500:2f::f | Internet Systems Consortium | United States G | 192.112.36.4 | 2001:500:12::d0d | Defense Information Systems Agency | United States H | 198.97.190.53 | 2001:500:1::53 | U.S. Army Research Lab | United States I | 192.36.148.17 | 2001:7fe::53 | Netnod | Sweden J | 192.58.128.30 | 2001:503:c27::2:30 | Verisign | United States K | 193.0.14.129 | 2001:7fd::1 | RIPE NCC | Netherlands L | 199.7.83.42 | 2001:500:9f::42 | ICANN | United States M | 202.12.27.33 | 2001:dc3::35 | WIDE Project | Japan

⚠️ IMPORTANT for anyone using my #DNS blocklist #BlockMeta in #uBlockOrigin or #personalDNSFilter : I’m migrating the repository from my personal Forgejo instance to my Codeberg account, so please remember to update your settings !

› https://codeberg.org/DansLeRuSH/dns-filters

I've updated a list of all #DNS used by #Meta and its trackers : #Facebook, #Instagram, #WhatsApp and all other crap.

On the last update, a total of 486 DNS listed.

Usable with #personalDNSfilter on #Android and #uBlockOrigin, if you no longer have an account with them (which you should) and want to block them completely from browsing, I've put all the information you need to set up the list in my Git repository below 👇

› https://codeberg.org/DansLeRuSH/dns-filters

#BlockMeta #DeleteMeta #BanMeta

⚠️ IMPORTANT pour les personnes utilisant ma liste de blocage #DNS "#BlockMeta" sous #uBlockOrigin ou #personalDNSFilter : je migre le dépôt de mon instance personnel Forgejo vers mon compte Codeberg, pensez à mettre à jour vos configs !

› https://codeberg.org/DansLeRuSH/dns-filters

@MissConstrue Yes but small fix: the disabling of the autistici.org domain name was not done on the #DNS resolvers but on the authoritative name servers of .org.

Haack's Networking

✍️ Hijacking DNS & Stopping DoH

🔗 https://tech.haacksnetworking.org/2026/09/06/hijacking-dns-stopping-doh/

🧻 This tutorial is designed for #openwrt users and #pihole / #unbound users looking for a clean way to protect your LAN's DNS. This tutorial used a dedicated vlan/subnet with 4 Wyze v4 cams but/and can easily be extended to any IoT devices one chooses. There are three types of actions covered in this tutorial:

- Hijacking plain-text udp 53 and udp 853 DNS requests
- Hijacking tcp 853 (DoT) requests
- Dropping DoH requests for specified upstream DNS ips

📜 I hope people find this tutorial helpful. Feedback and comments are welcome. For those seeking assistance and/or if you want to chat about setup or other Linuxy stuffs, feel free to swing by the GNU/Linux Club Matrix over at https://matrix.to/#/#introductions:gnulinux.club

#OpenWrt #PiHole #Unbound #DNS #DoH #DoT #DoQ #Firewall #TrafficRules #PortForward #tcpdump #VLAN #IoT #Privacy #SelfHosted #Homelab #AWSIoT #NetworkSecurity #FOSS #Debian #floss #freesoftware #opensource

[lien] « En clair, je disparais d'Internet. », une décision lui fait perdre le nom de domaine sur lequel il a construit toute sa vie numérique - Numerama #security #gik #net #dns #wtf

Gros cafouillage #DNS au France-IX ? Les serveurs faisant autorité répondent NODATA pour les requêtes NS. (Sauf celui de HE.)

@acontios

PowerDNS Recursor 5.4.6 Released

https://blog.powerdns.com/2026/09/03/powerdns-recursor-5.4.6-released

#dns #dnssec

В России начали блокировать протоколы DoH и DoT

С середины августа 2026 года у части абонентов «Ростелекома», «Дом.ру», «Таттелекома», SkyNet и «Билайна» одновременно перестал работать зашифрованный DNS от Google и Cloudflare. Не зависал, не подтормаживал, а именно перестал отвечать. Причём ложился он по-разному в зависимости от протокола, и это различие — самое интересное в истории. Давайте разберём, что именно происходит на проводе, почему DoT и DoH ломаются не одинаково, как это потрогать руками, и что со всем этим делать.

https://habr.com/ru/articles/1077682/

#dns #doh #dot #блокировки

RFC 10001: Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments

Vous gérez des serveurs #DNS dans un environnement où il y a à la fois IPv4 et IPv6 ? Alors, ce #RFC va vous aider. La recommandation est que tout serveur DNS, lorsque le réseau a à la fois IPv4 et IPv6, doit pouvoir servir les requêtes avec les deux versions d'IP.

https://www.bortzmeyer.org/10001.html

[Veille 📣] autistici.org - Press Release – August 28, 2026
https://www.inventati.org/campaign/press

Les USA ont placé Autistici/Inventati sur la liste des personnes bloquées (Specially Designated Nationals and Blocked Persons List) avec comme désignation SDGT (Specially Designated Global Terrorist). C'est une décision nationale, qui ne devrait pas avoir de conséquences internationales, sauf que…

1. Internet est en fait largement un système étasunien, le TLD (Top Level Domain) .org est géré par le PIR, qui se trouve être une structure étasunienne, donc soumise à la loi étasunienne. Elle a donc bloqué la propagation DNS ce qui rend totalement indisponible le site, alors qu'il est encore parfaitement fonctionnel.

2. Les USA menacent de sanctions secondaires les entreprises faisant du commerce avec des entités sur la liste des personnes bloquées. Ce qui implique que la banque qui gère A/I est censée rompre son contrat avec l'association pour éviter de se faire placer elle aussi sur une liste similaire.

Il est temps de nous libérer de l'impérialisme étasunien!

Lien vers cette entrée dans ma veille : https://liens.declosure.ch/shaare/X-RAfA
Toute ma veille est disponible ici : https://liens.declosure.ch/
#internet #impérialisme #dns #usa
#links #liens #veille

#DNS

Pas joli, le nom de domaine des serveurs faisant autorité. https://mastodon.gougere.fr/@DNSresolver/117188887152934762

[lien] Blog Stéphane Bortzmeyer: Autistici / Inventati et la censure sur leur nom de domaine #duralexsedlex #gik #dns #net #tld

Autistici / Inventati et la censure sur leur nom de domaine

https://www.bortzmeyer.org/autistici.html

#DNS #PIR #censorship

@benjamin

Recent events and a thought that had already been lingering in my mind for some time prompted me to register two new domains:

bsdcafe.eu
bsdcafe.it

The first is under European control, the second Italian.

Although as of today I have no reason for doubts or misgivings, having domains managed by European entities gives me a bit more peace of mind. How to put them to use will be a matter of reflection over the coming months.

Stay tuned!

#BSDCafe #Domains #DNS

RFC 10037: RDAP Extension for DNS TTL Values

Puisque le RFC 9803 étend le protocole d'avitaillement EPP pour ajouter des TTL spécifiques aux noms de domaine enregistrés, il était logique que le protocole d'interrogation #RDAP permette d'obtenir cette information. C'est ce que permet l'extension normalisée dans ce nouveau #RFC.

https://www.bortzmeyer.org/10037.html

#DNS

New blogpost:

# Time to drop .legal?

Just my ponderings at this point.

Perhaps I am over-worrying?

https://neilzone.co.uk/2026/08/time-to-drop-legal/

#blog #cybersecurity #DNS #lawfedi

[lien] Stéphane Bortzmeyer: "Un rappel utile si vous gérez …" - Mastodon - Gougère Network #duralexsedlex #gik #net #dns #tld

Bref, choisissez bien votre domaine de premier niveau (TLD = Top Level Domain).

#nomDeDomaine #DNS

#DNS #ICANN

« gTLD : de nouvelles extensions [sic] arrivent : .gram, .coin, .agent ou peut-être .meta ? »

https://next.ink/253163/gtld-de-nouvelles-extensions-arrivent-gram-coin-agent-ou-peut-etre-meta/

(Le fédivers est un des rares endroits où les TLD du précédent cycle sont largement utilisés. C'est le cas de .social, par exemple, propriété d'une entreprise commerciale étatsunienne.)

NSD Security Release!

As part of our ongoing work to address security issues identified through LLM-assisted security research, we have released NSD 4.15.1.

Read more about the security fixes and the new release on our community forum.

#DNS #OpenSource #Security

https://community.nlnetlabs.nl/t/nsd-4-15-1-security-release/3447

#DNS #courrier
C'est assez rare, des MX qui pointent vers deux fournisseurs différents : https://mastodon.gougere.fr/@DNSresolver/117155351655886655

Liked those short Curve RRSIG's in DNSSEC?

Well, that time is over, good lord. Post quantum RRSIGs with MLDSA44, https://codeberg.org/miekg/dns/pulls/987/files

#go #dns

#RFC 3901 is now obsoleted

“This document provides guidelines and documents best current practice for operating authoritative #DNS servers, recursive resolvers, and stub resolvers in a mixed #IPv4 / #IPv6 environment."

RFC 10001: Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments
https://www.rfc-editor.org/info/rfc10001/

Some services will be momentarily down today while we migrate from Dynadot to Dreamhost for our domain Registrar. Moving forward, all DNS will be managed at Hurricane Electric and/or Dreamhost. Thanks for patience 🙏🏼

This sudden change was due to Dynadot changing their subdomain record policy from 250 to 50 without notice. This caused a week-long disruption in building out new services due to any record over the cap being irrecoverable once deleted and new ones being impossible to create. Despite having 150+ records in the past, Dynadot responded that they've never supported more than 150 and would only restore that.

Both the change in terms and contract without notice and the dishonesty once a ticket was filed serve as sufficient reasons to ditch Dynadot. This was surprising to say the least. They've been a solid Registrar. As for DNS, we only used it the last three years having originally used afraid.org for over a decade. Ultimately, this is for the best however, because it is always unwise to keep one's DNS and Registrar at the same host. Hurricane Electric's DNS is additionally a breath of fresh air from 1998-2002 era and so easy to use - the alphabetical rendering of records amazing 🤩

It's always DNS !!

#DNS #selfhosted #linux #debian #registrar #sysadmin

First alpha release of PowerDNS Recursor 5.5.0

https://blog.powerdns.com/2026/08/13/first-alpha-release-of-powerdns-recursor-5.5.0

#dns #dnssec

@sebsauvage Et hop : #PiHole installée sur la #Raspberrypi qui me sert de serveur d'applications web locales.

Il faut apparemment définir cette machine comme __unique__ serveur #dns dans les configurations de la box (dixit la documentation).

RE: https://mastodns.net/@dnsoarc/117049464935957144

You dare be my boss? 😁
#fedihire #nonprofit #dns #community

[lien] How to Configure DNSSEC with PowerDNS Authoritative Server #security #gik #dns

Today a regular Unbound release, version 1.26.0, with features, maintenance and bug fixes. Enjoy the latest version and thanks to the contributors! And stay cool.

See for more details and acknowledgment our community post, https://community.nlnetlabs.nl/t/unbound-1-26-0-released/3434.

#DNS #OpenSource

One more straw on the #DNS camel, but a possibly nice straw if deployed in software

"This document specifies a method for a DNS client to request additional DNS record types to be delivered alongside the primary record type specified in the Question section of a DNS QUERY (OpCode=0)."

"For example, it may be desirable to receive the A, AAAA, and HTTPS RRs for a domain name together, rather than having to issue multiple queries."

#RFC 10029: DNS Multiple QTYPEs
https://www.rfc-editor.org/info/rfc10029/

DNS knows where it is because it knows where it isn't: LOC records
#DNS

[lien] Blog Stéphane Bortzmeyer: RFC 10023: The "_for-sale" Underscored and Globally Scoped DNS Node Name #gik #net #dns #rfc #$$$

In the overnight spam haul at $DAYJOB I found a message from Kevin Liu<kevin@cnnetregistry.com> trying to hawk various .cn domain versions of the name the company rebranded away from some months back.

Basically the same message as in https://nxdomain.no/~peter/domain_name_scams_are_alive_and_well_thank_you.html (tracked https://bsdly.blogspot.com/2016/03/domain-name-scams-are-alive-and-well.html) #dns #cn #cndomains #cndomainscam #cnnetregistry #scam #domainnamescam #spam

Federated protocols of the future should consider designing themselves so that even if they use DNS, it is not the foundation of their own identity system so they are not hopelessly bound to it. Federated networks which have message relaying capability such as Bitcoin or BGP can also span across different networks such as cjdns, Yggdrasil, I2P and of course the outside internet.

https://thegoodwork.substack.com/p/the-next-internet-war

#federated #DNS #Internet

https://fedins.eu.org

J'espère pouvoir à un moment bosser sur le fait de fournir aussi un service pour faire du primaire, mais je ne sais pas si un projet existant sympa pour ça existe ou s'il va falloir coder l'outil nous-même …

#DNS

Bienvenue au .web dans la racine du #DNS https://mastodon.gougere.fr/@DNSresolver/116969754190877796

Another Unbound security release is now available, addressing a large set of multi-vendor vulnerabilities. In total, Unbound 1.25.2 fixes 24 CVEs.

Many thanks to the security researchers who responsibly reported these issues.

Release details: https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430

#DNS #DNSSEC #Security

#DNS #sécurité
😱 Le registry (base de données DNS pour le .ro) pour la Roumanie s'est fait attaquer et *entièrement effacer*. Heureusement, ils avaient une copie offline.
Ayez toujours un backup déconnecté !
https://cybernews.com/security/hacker-deletes-romanian-land-registry-database/

#France #censure
L'autorité nationale des jeux a annoncé qu'elle demandait le blocage de #Polymarket. J'ai déjà parlé de censure via résolveur #DNS menteur à propos d'autres sources de blocage mais je n'avais pas encore parlé de l'#ANJ.

https://www.bortzmeyer.org/polymarket-france.html

#validns v0.11.0 released!
New:
- Major work on verbose output to render records and rdata (-1 meow)
- Support for EUI48 and EUI64 records (RFC 7043)
- Detect NSEC3 records with flags, iterations, or salt inconsistent with NSEC3PARAM
- New policies: all-algorithms-signed, occluded-records, missing-glue, no-strict-glue
Fixed:
- Crashes, data races, memory leaks, buffer overflows and more, see CHANGELOG for complete list
#DNS #Zone #Validation #OpenSource
https://codeberg.org/DNS-OARC/validns/releases/tag/v0.11.0

J'étais surpris que les serveurs #DNS faisant autorité pour .ru soient en .net mais apparemment, les Russes sont en train de changer cela : https://mastodns.net/@diffroot/116920437777071977

Tiens le #DNS joindns4.eu qui bloque orbot.app (le client #ToR pour android) 🤔

Well good thing the American federal government doesn’t rely on a single privately-owned third-party digital identity provider operating on .me!

#dns

Alt...

Calvin change my mind meme with the ID.me logo and “is a national security risk” “change my mind”

Si vous utilisez le service de messagerie instantanée #Telegram, vous avez sans doute vu aujourd'hui, que des services ne marchent pas, notamment les liens vers des ressources diverses (images, etc). C'est parce que le registre de noms de domaine du Monténégro l'a décidé. Voyons les détails.

https://www.bortzmeyer.org/telegram-on-hold.html

#DNS #EPP #censure

sometimes you have to solve your own problems. had a specific use-case to not open a browser to check stats/issues on #nextdns which is an upstream to #blocky #dns resolver

being more tui/tty oriented, decided to build a tui dashboard. works pretty nicely. also felt it was good to dual-scope the binary so it can run as an optional web front-end that's very lightweight and customized

this is a 20mb #golang binary and all you need to do is feed it an api key and profile id (if not on default)

we live in an age where it's somewhat trivial to solve your own problems. why wait for others to do it? #hack everything.

Un faux outil d'analyse #DNS propage un #malware via 222 dépôts #GitHub. Un module Go imite un outil de scan #DNS et dissimule un chargeur #Windows relié à 222 dépôts #GitHub. Le réseau est actif depuis janvier et diffuse des #chevauxdetroie d’accès distant ainsi que des voleurs de données, selon l’éditeur de #securite Socket
https://www.clubic.com/actualite-620971-un-faux-outil-d-analyse-dns-propage-un-malware-via-222-depots-github.html
#trojan

@bortzmeyer @oli @jpmens For context, we’re now in “signing co.uk on a regular laptop” territory, with more improvements to come. #DNS #DNSSEC

It's still Friday and we're still doing a Cascade release, so here's 0.1.0-beta5 'Got that holiday feeling'. 🏖️

In this release we're giving you more speed improvements by parallelizing sorting and more memory reduction by improving the handling of NSEC(3) in incremental signing. You can also track all of these improvements with newly introduced metrics.

Thanks again to @bortzmeyer, @oli and @jpmens and others for providing valuable feedback!

#DNS #DNSSEC #OpenSource

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta5

JusProgDNS für Linux

Kinderschutz im Netz ist ein sensibles Thema. Einerseits braucht es Schutzmechanismen, andererseits sollen diese Mechanismen nicht selbst zum Hindernis werden. Genau da setzt JusProgDNS an.

#DNS #JusProgDNS #Kinderschutz #Linux

https://gnulinux.ch/jusprogdns

Whether you're trying to:
✓ Triage alerts
✓ Investigate incidents
✓ Hunt adversaries
✓ Defend against emerging campaigns

DNS is now another layer of the Censys Internet Map helping teams decide faster and more accurately across every stage of the security operations workflow: https://censys.com/blog/censys-expands-its-internet-map-to-include-dns-intelligence/

#Censys #infosec #ThreatIntel #DNS

« Souveraineté numérique : l’Afnic désignée pour gérer et développer les extensions Internet des territoires ultramarins » https://www.entreprises.gouv.fr/espace-presse/souverainete-numerique-lafnic-designee-pour-gerer-et-developper-les-extensions

#DNS #NomsDeDomaine

« Transparentes et participatives, avec une gouvernance ouverte et inclusive »

Today, we're happy to launch the NSD 4.15.0. This release of our authoritative #DNS server includes more than 20 fixes for LLM-assisted security reports. It also improves the Prometheus metrics, as a nice bonus.

#OpenSource #Security

https://community.nlnetlabs.nl/t/nsd-4-15-0-released/3423

@bortzmeyer @shaft QOTD
> Yes, following DNS stuff on Mastodon is now part of maintaining DNS...
Petit jeu : qui est l'auteur ?
La réponse
https://mail-archive.com/dns-operations@lists.dns-oarc.net/msg09228.html
#dns #dnssec #ccTLD

Hello, j'ai un domaine dont les NS sont aux US et au Canada. Est ce qu'en soi c'est un problème ? Est ce qu'il existe des NS publics fiables en Europe ? Si je cherche, je tombe bien sur des listes des trucs (genre https://publicdnsserver.com/switzerland/ ). Mais je n'ai aucune idée du sérieux de ce genre de listes, pas plus que de l'utilisabilité de ces serveurs dans ce contexte.

#NameServer #Domaine #NomDeDomaine #DNS

appréciés

Après les #DNS et les #VPN, les ayants droit veulent désormais pouvoir bloquer des réseaux entiers. La lutte contre le piratage pourrait bientôt franchir une nouvelle étape en #europe. 
https://www.clubic.com/actualite-620074-apres-les-dns-et-les-vpn-les-ayants-droit-veulent-desormais-pouvoir-bloquer-des-reseaux-entiers.html

Albania's .al was secured for a week or so. Wonder what happened. 🤔

DS added to root zone : https://mastodns.net/@diffroot/116812884301667310
DS removed : https://mastodns.net/@diffroot/116857712875727653

#DNS #DNSSEC #ccTLD

Help me to check metalhead.club's current CDN performance!

Check out https://media.metalhead.club and let me know if the displayed location is the nearest for you.

There's Germany, USA and Singapore available.

I'm curious if Bunny DNS works more accurately than Scaleway DNS.

#metalheadclub #cdn #dns #scaleway #bunnycdn

PowerDNS DNSdist 2.1.0 Released

https://blog.powerdns.com/2026/07/02/powerdns-dnsdist-2.1.0-released

#dns #dnssec

Please note that we have volunteered to have all of our products and libraries analyzed by LLM tooling, so you can expect security releases for pretty much everything, down to libraries like rpki-rs and projects in maintenance mode like ldns.

#DNS #RPKI #BGP #OpenSource

We have been working incredibly hard on patching all of the LLM-assisted security reports for our authoritative #DNS server NSD.

Today, we're happy to launch the NSD 4.15.0rc1 pre-release so you can test the 20+ fixes that are included. This release also improves the Prometheus metrics, as a nice bonus.

https://community.nlnetlabs.nl/t/nsd-4-15-0rc1-pre-release/3421

PowerDNS Authoritative Server 5.1.3 Released

https://blog.powerdns.com/2026/05/30/powerdns-authoritative-server-5.1.3-released

#dns #dnssec

@benjojo While we love working in Rust, designing and building a #DNS resolver for the modern era is a massive undertaking.

Simply rewriting Unbound in Rust is a non-starter. We are taking gradual steps in reinventing our DNS stack by putting ldns in maintenance mode and investing in our domain library, and sunsetting OpenDNSSEC by launching Cascade.

Doing an authoritative server in Rust is definitely in the cards. Then, we can imagine putting all puzzle pieces together for a new resolver.

Le sachiez-tu ? Le nom de domaine sci-hub.se n'existe plus mais il y a toujours des FAI français qui le censurent sur leur résolveur #DNS (et renvoient 127.0.0.1) https://atlas.ripe.net/measurements/184788556

#JORF #DNS - Désignation officielle de l'Afnic comme registre de .mq, .gp, .gf, .re, .tf, .yt, .pm et .wf

https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310819

https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310836

#JORF #DNS - Désignation de l'AFNIC comme office d'enregistrement chargé de la gestion des noms de domaines de premier niveau en :

- « .mq, « .gp », « .gf », « .re » et « .tf » : https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310819

- « .yt », « .pm » et « .wf » : https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000054310836

looking for a database of DNS IOCs, e.g. "if a client queries for domain <X>, it's probably compromised by <Y>". does this exist?

#dns #infosec

PowerDNS DNSdist 1.9.15 and 2.0.7 Released (Security Release)

https://blog.powerdns.com/2026/06/25/powerdns-dnsdist-1.9.15-and-2.0.7-released-security-release

#dns #dnssec

PowerDNS Security Advisory 2026-07 for PowerDNS Authoritative Server
(aka PowerDNS Authoritative Server 4.9.16, 5.0.6 and 5.1.2 released)

https://blog.powerdns.com/2026/06/25/powerdns-security-advisory-2026-07-for-powerdns-authoritative-server

#dns #dnssec

Tiens, le résolveur #DNS 1.1.1.1 (Cloudflare) a désormais des #NSID non-opaques (on reconnait le code des aéroports, au lieu de l'ancien système opaque).

Underrated reason to have proper SPF setup for all of your hosted domain names to hard fail improper sending routes... when you forget to turn off the mail sender on your dev server and you run a batch action that sends out tens of thousands of emails to users.

I saw my inbox fill up with thousands of email notifications since a lot of the notifications were sent to me. The only reason I'm not panicking is because I looked at the mail headers and saw that because the emails were sent from my computer instead of my server, they failed both SPF and DKIM verification checks so any damage should be limited.

Ugh. 😓

#webdev #selfhost #dns #sysadmin

vannes.bzh ne réponds toujours pas.

Le domaine à 2 serveurs faisant autorité déclarés dans la zone parente :

- sdns2.ovh.net : Il refuse de répondre (comprendre : il dit ne pas faire autorité)
- sdns.pointbzh.fr : serveur également chez OVH et qui lui ne réponds pas

#DNS

La Bretagne est épargnée par la canicule mais pas par les pannes #DNS. vannes.bzh ne répond plus.

Cours #DNS jeudi et vendredi. Comme d'habitude, si vous avez des domaines cassés et/ou rigolos, n'hésitez pas à les indiquer, on les fera analyser par les étudiant·es.

Technitium DNS: Mehr als nur ein Werbeblocker
https://linuxnews.de/technitium-dns-mehr-als-nur-ein-werbeblocker/ #technitium #dns #pihole #linux #linuxnews

Je dis ça je dis rien... mais le point.final https://client.rdap.org/?type=domain&object=point.final&follow-referral=1 n'est pas encore enregistré
@shaft
#dns #tld #gtld

Cascade supports incremental DNSSEC signing.

It doesn't use a jitter-based mechanism for this like OpenDNSSEC has, but rather a “re-signing schedule” approach.

To help you understand what to expect from the output, and how the associated settings will affect Cascade's behavior, we have documented the functionality here: https://cascade.docs.nlnetlabs.nl/en/latest/incremental-signing.html

#DNS #DNSSSEC #OpenSource

bizarre (heureusement pas en "prod")

une recherche rapide m'indique que je suis pas le seul...