PowerDNS Authoritative Server 5.1.3 Released

https://blog.powerdns.com/2026/05/30/powerdns-authoritative-server-5.1.3-released

#dns #dnssec

Albania is now a safer country \o/

#DNSSEC

https://mastodns.net/@diffroot/116812884301667310

PowerDNS DNSdist 1.9.15 and 2.0.7 Released (Security Release)

https://blog.powerdns.com/2026/06/25/powerdns-dnsdist-1.9.15-and-2.0.7-released-security-release

#dns #dnssec

PowerDNS Security Advisory 2026-07 for PowerDNS Authoritative Server
(aka PowerDNS Authoritative Server 4.9.16, 5.0.6 and 5.1.2 released)

https://blog.powerdns.com/2026/06/25/powerdns-security-advisory-2026-07-for-powerdns-authoritative-server

#dns #dnssec

how embarrassing! This is definitely not my concept!!

#dnssec

edit: I'm embarrassed because I don't deserve an iota of credit for the concept

Alt...

You are likely referring to Jan-Piet Mens's concept of DS-push. In the context of his writing, "DS-push” refers to the automated mechanism for uploading Delegation Signer (DS) records to a parent DNS zone during a DNSSEC key rollover (specifically for subzones). ...

This "OK GEPRÜFT" is a MUST [RFC 2119] have for any serious #DNSSEC administrator.

#rrsig

Alt...

Self-Inking German language text stamp with the word "Geprüft" (verified) on it.

It’s Friday release day again with Cascade 0.1.0-beta2 'Donde comen dos, comen tres'. Thanks to the amazing feedback from @jpmens and @gryphius and hard work from the team, our DNSSEC signer has a bunch of fixes and improvements.

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta2

#DNS #DNSSEC #OpenSource

#DNSSEC
DENIC "Final Report: DNS Outage of 5 May 2026"
https://blog.denic.de/en/final-report-dns-outage-of-5-may-2026/

I'm still frustrated, not all questions are answered.

@letoams That release name involved the Never Really Here cocktail bar in Edinburgh, during DNS OARC 46.

Let's see what naming suggestions @maarten brings home from #ICANN86 in Sevilla.😉

#LoveDNS #DNS #DNSSEC

With Cascade 0.1.0 beta1 “Slàinte mhath” we begin our journey to the first production release of our #DNSSEC signing solution.

We rewritten our signer from the ground up using a state machine based architecture, ensuring that each zone pipeline is in a single consistent state at all times.

In addition to built-in pre-signing and pre-publication review hooks, there’s now incremental signing, TSIG support, downstream IXFR, zone persistence, metrics and much more. #DNS

https://blog.nlnetlabs.nl/cascade-beta1-release/

PowerDNS Authoritative Server 5.1.1 Released

https://blog.powerdns.com/2026/06/08/powerdns-authoritative-server-5.1.1-released

#dns #dnssec

@jpmens Ah yes, this link is a more accurate reflection of the past few days. 😄

https://github.com/NLnetLabs/cascade/issues?q=is%3Aissue%20author%3Ajpmens%20created%3A%3E%40today-1w

TSIG is mentioned 6 times!

#DNS #DNSSEC

With eight issues and one pull request over the weekend, once again we're incredibly thankful for the effort @jpmens is putting into testing Cascade.

Luckily, none of the reports seem to be in the “everything is broken”-category! 😅

https://github.com/NLnetLabs/cascade/issues?q=is%3Aissue%20state%3Aopen%20author%3Ajpmens%20created%3A%3E%40today-1w

#DNS #DNSSEC #OpenSource

With the Cascade beta release, the project now also has a dedicated page on our website:

https://nlnetlabs.nl/projects/cascade/about/

Next up: a logo!

#DNS #DNSSEC

After releasing the Cascade beta, NLnet Labs HQ has a @jpmens vs. @bortzmeyer poll going.

#DNS #DNSSEC

Alt...

A poll that asks “How many GitHub issues will JP Mens and Stephane Bortzmeyer create by Monday?”

Cascade 0.1.0 beta1 “Slàinte mhath” is out, so this is your opportunity to kick the tires and take it for a spin around your testing grounds!

As we gear up to the production release of our DNSSEC signer, we're eager to hear your feedback so we can incorporate it while we add improvements that we still have in the pipeline which we consider essential for production use.

Read all about it in our blog post!
https://blog.nlnetlabs.nl/cascade-beta1-release/

#DNS #DNSSEC #OpenSource #rustlang #LoveDNS

PowerDNS Authoritative Server 5.1.0 Released

https://blog.powerdns.com/2026/06/03/powerdns-authoritative-server-5.1.0-released

#dns #dnssec

PowerDNS Recursor 5.2.10, 5.3.7 and 5.4.2 Released

https://blog.powerdns.com/2026/06/03/powerdns-recursor-5.2.10-5.3.7-and-5.4.2-released

#dns #dnssec

PowerDNS DNSdist 2.1.0 Release Candidate 1 Released

https://blog.powerdns.com/2026/06/02/powerdns-dnsdist-2.1.0-release-candidate-1-released

#dns #dnssec

RFC 9975: Clarifications on CDS/CDNSKEY and CSYNC Consistency

Pour compléter un processus de sécurisation des noms de domaine avec #DNSSEC, il faut transmettre au domaine parent votre clé publique. Le faire manuellement via l'interface Web du BE n'est pas pratique donc il existe un moyen d'automatiser cela, les CDS/CDNSKEY. Mais attention à la sécurité ! Ce moyen n'est sûr que si on suit quelques précautions, décrites dans ce nouveau #RFC.

https://www.bortzmeyer.org/9975.html

PowerDNS DNSdist 2.0.6 Released

https://blog.powerdns.com/2026/05/21/powerdns-dnsdist-2.0.6-released

#dns #dnssec

PowerDNS Security Advisory 2026-06 for PowerDNS Authoritative Server
(aka PowerDNS Authoritative Server 4.9.15 & 5.0.5 released)

https://blog.powerdns.com/2026/05/20/powerdns-security-advisory-2026-06-for-powerdns-authoritative-server

#dns #dnssec

🚨 SECURITY RELEASE 🚨
Today we released Unbound 1.25.1, which consolidates security fixes for issues reported over a period of time.

There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608.

Please read the release notes carefully and plan to upgrade.

#DNS #DNSSEC #Mythos #LLM #OpenSource

https://community.nlnetlabs.nl/t/unbound-1-25-1-released/3392

J’ai désactivé l’option, puis l’ai réactivée. Et maintenant, c’est bon, j’ai pu renouveler le certificat Let’s Encrypt dans YunoHost.

Oui, parce que c’est grâce à l’interface d’admin de YunoHost que j’ai su que c’était DNSSEC le problème. J’aurais jamais trouvé ça tout seul!

#Infomaniak #DNS #DNSSEC

#Infomaniak #DNS #DNSSEC

@bortzmeyer As the manager of the Cascade project, I feel it's important to provide some context and nuance to the terms "alpha”, “beta" and “production ready”. This applies especially to software that is intended to run in critical infrastructure, with possible grave consequences when there is a failure.

While @nlnetlabs is building Cascade on 25 years of experience in DNS and software architecture, operators should not take our work for granted based on that.

This is our plan.

We have frozen the feature set Cascade has now, for the beta release. That means a DNSSEC signer with HSM support, IXFR in and out with TSIG, deterministic incremental signing, review hooks, and monitoring endpoints.

We will mark this release as “beta” in the coming weeks, but read this as whatever you feel is appropriate given the context I gave. That being said: we will dogfood this release. Starting this summer, operators can put Cascade in their testing environments to put it through their wringers, so we can iron out bugs and fix corner cases.

Over the coming months, our aim to have operators build the confidence to start deploying Cascade in production, with the expectation that we'll see real-world Cascade deployments towards the end of this year.

#DNS #DNSSEC #OARC46 #LoveDNS @dnsoarc

Peter Koch (DENIC) on the 5 may problem in .de.

.de has almost 18 million domain names and is incrementally updated.

Validation is done once it is already published.

HSM were using different keys :-(

#DNSSEC
#OARC46

"Cascade [#DNSSEC key manager and signer]: Beyond alpha" by Ximon Eighteen

Written in Rust. Still alpha (beta was not released yet).

Supported (among others) by the Sovereign Tech Agency.

#OARC46

Please pray to the live demo Gods over lunch so @ximon18 can show you our #DNSSEC signer Cascade in action this afternoon at @dnsoarc 46.

We’ll cover incremental signing with IXFR in and out with TSIG, all on a YubiHSM we packed. 🤞

#LoveDNS

@ximon18 @dnsoarc after his talk on stage, Ximon will be at the demo table in the lunch area, where he can show all the other tricks Cascade has learned since OARC 45 in Stockholm.

Also, make sure to bring your zone files so you can for example see how fast parallel #Dnssec signing by @bal4e really is. #DNS #LoveDNS #OpenSource

#DNS root zone key rollover under way. (Planned for 11 october.)

"Who in the room has root access to his resolver?" (Lot of hands, this is an OARC meeting.)

#OARC46 #DNSSEC

Wonderful list of things that can go wrong (and therefore, will) in operations.

(Including an error done on friday afternoon and fixed, will you guess, on monday.)

#DNS #DNSSEC #OARC46

The real world is complicated. For signing a .cn domain, it was necessary to send DS records by email... For .br, errors are not corrected 24x7, only during business hours. (Not always the registry's fault, sometimes you have to use a lot of intermediaries.)

#OARC46 #DNSSEC

Automatic authenticated DNSSEC Bootstrapping in PowerDNS Authoritative

https://blog.powerdns.com/2026/05/12/automatic-authenticated-dnssec-bootstrapping-in-powerdns-authoritative-server

#dns #dnssec

Hey, .ml (ccTLD for Mali) is using #ed25519 !

$ dig +short ml. DS
21942 15 2 <crypto shenanigans>

(the number 15 indicates algorithm 15 aka ed25519)

So number of #TLD using algorithm 15: 3
- .fj (Fiji)
- .pg (Papua New Guinea)
- .ml

#DNSSEC

Reviewing DNS logs and noticed that `vuxml.freebsd.org` fails DNSSEC validation but `matrix-dev.freebsd.org` passes.

Can anyone else confirm or is my software buggy?

#FreeBSD #DNSSEC

Alt...

2026-05-08 03:27 UTC 10.17.89.66 matrix-dev.freebsd.org. v SEC 2026-05-08 03:27 UTC 10.17.89.66 matrix-dev.freebsd.org. v SEC 2026-05-08 03:22 UTC 10.17.89.18 vuxml. freebsd. org. Xx SEC 2026-05-08 03:21 UTC 10.17.89.19 vuxml. freebsd. org. Xx SEC 2026-05-08 03:17 UTC 10.17.89.66 vuxml. freebsd. org. Xx SEC 2026-05-08 03:06 UTC 10.17.89.42 vuxml. freebsd. org. Xx SEC

L'incident du .de m'a permis de constater que welt.de est signé avec #DNSSEC. Rép à ça lemonde.fr

DENIC's status page:
https://status.denic.de/

Screenshot below in case you're not able to load it (as I said, stuff is going to be intermittently failing).

#DNS #DENIC #DNSSEC #InfoSec #SysAdmin

Alt...

DNSSEC disruption affecting .de domainsPartial Service Disruption Incident Status Partial Service Disruption Components DNS Services DNS Nameservice May 5, 2026 23:28 CEST May 5, 2026 21:28 UTC INVESTIGATING Frankfurt am Main, 5 May 2026 – DENIC eG is currently experiencing a disruption in its DNS service for .de domains. As a result, all DNSSEC-signed .de domains are currently affected in their reachability. The root cause of the disruption has not yet been fully identified. DENIC’s technical teams are working intensively on analysis and on restoring stable operations as quickly as possible. Based on current information, users and operators of .de domains may experience impairments in domain resolution. Further updates will be provided as soon as reliable findings on the cause and recovery are available. DENIC asks all affected parties for their understanding. For further enquiries, DENIC can be contacted via the usual channels.

Am I the only one having #DNSSEC problems with #DENIC?

Unbound is throwing me a lot of DNSSEC bogus on some .de domains 🤔

#DNS

$ dig welt.de
...
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21366
...
; EDE: 6 (DNSSEC Bogus): (validation failure <welt.de. A IN>: signature crypto failed from 2a02:568:0:2::53 for DS welt.de. while building chain of trust)

Edit: issue seems fixed.

Looks like DE ccTLD is unresolvable due to DNSSEC issue:
https://dnsviz.net/d/nic.de/afpsNg/dnssec/

😬

🧵👇

#InfoSec #DNSSEC #DNS #Germany

RE: https://mastodon.social/@jpmens/116522310229612501

IANA has a chance to do the funniest thing ever…

#DNS #DNSSEC #InfoSec

@bortzmeyer après plusieurs timeout
Mais je suis en forêt avec un téléphone
C'est pas idéal pour déboguer :-) surtout #dnssec sur lequel je suis nul

Alt...

Une chienne noire dans un chemin forestier

PowerDNS DNSdist 1.9.14 and 2.0.5 Released

https://blog.powerdns.com/2026/04/23/powerdns-dnsdist-1.9.14-and-2.0.5-released

#dns #dnssec

PowerDNS Security Advisory 2026-05 for PowerDNS Authoritative Server
(aka PowerDNS Authoritative Server 4.9.14 and 5.0.4 released)

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-05-for-powerdns-authoritative-server

#dns #dnssec

PowerDNS Security Advisory 2026-03 for PowerDNS Recursor
(aka PowerDNS Recursor 5.2.9, 5.3.6 and 5.4.1 released)

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-03

#dns #dnssec

PowerDNS Security Advisory 2026-04 for PowerDNS DNSdist
(aka DNSdist 1.9.13 and 2.0.4 released)

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-04-for-powerdns-dnsdist

#dns #dnssec

RE: https://mastodns.net/@diffroot/116445067811030516

Space is now elliptic!

#DNSSEC

Well at least it is signed with #DNSSEC 😬😬

#Wero
https://piaille.fr/@shaft/116324300412851241

Alt...

The "X, X everywhere" from Toy Story 2 but redrawn by @gee@framapiaf.org. This version reads "Amazon, Amazon everywhere"

PowerDNS DNSdist 1.9.12 and 2.0.3 Released (Security Release)

https://blog.powerdns.com/2026/03/31/powerdns-dnsdist-1.9.12-and-2.0.3-released

#dns #dnssec

We're thrilled that Cascade is among the first projects supported by the Nominet DNS Fund.

With Nominet's support, our new DNSSEC signing solution receives a massive push forward, allowing our team to focus on implementing speed improvements, a reduced memory footprint and essentials such as incremental signing.

We'll be launching a beta in April, followed by an initial production release in June 2026.

Read more: https://nominet.uk/news/nominet-supports-foundations-of-the-internet-with-first-dns-fund-projects-announced/

#OpenSource #rustlang #FOSS #DNS #DNSSEC

Alt...

Nominet DNS Fund banner

If we start to use Merkle trees for #DNSSEC signatures, as currently discussed at #IETF125, this would create a lot of new interesting blog posts and @dnsoarc meeting talks 😋

So, previously on post-quantum #DNSSEC: not a lot of action. Standardized post-quantum cryptography algorithms like ML-DSA have keys and signatures which are way too long for the #DNS.

https://mastodon.gougere.fr/@DNSresolver/116241567126448201

TLS can deal with it (they run on TCP or QUIC) but we cannot, with UDP. No obvious solution.

#IETF125

PowerDNS Recursor 5.4.0 Released

https://blog.powerdns.com/2026/03/09/powerdns-recursor-5.4.0-released

#dns #dnssec