I released v1.7.1 of gonemaster that now can verify ML-DSA-44. Based on miekg/dns that also released support for it today. #DNS #dnssec #pqc

@bortzmeyer @shaft y'a déjà un numéro d'algo en tout cas (18) dans le registre de l'IANA.

#dnssec #pqc

@shaft C'était pas dans le registre en juillet @bortzmeyer #IANA #DNSSEC

@bortzmeyer Au niveau RFC 6014, le statut actuel n'est pas suffisant ? @shaft #RFC #RFC6014 #DNS #DNSSEC #PQC

@shaft @bortzmeyer pour l'instant je reste en ED25519 pour toutes les zones de production que je gère mais justement j'aurais voulu tester les problèmes en ML-DSA-44 (en signant du-mlsdsa44.teste.des.services)

#DNS #DNSSEC #PQC

#RFC 10026 [and #BCP 246]: Operational Recommendations for #DNSSEC Delegation Signer (DS) Automation
https://www.rfc-editor.org/info/rfc10026/

Another Unbound security release is now available, addressing a large set of multi-vendor vulnerabilities. In total, Unbound 1.25.2 fixes 24 CVEs.

Many thanks to the security researchers who responsibly reported these issues.

Release details: https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430

#DNS #DNSSEC #Security

@bortzmeyer @oli @jpmens For context, we’re now in “signing co.uk on a regular laptop” territory, with more improvements to come. #DNS #DNSSEC

It's still Friday and we're still doing a Cascade release, so here's 0.1.0-beta5 'Got that holiday feeling'. 🏖️

In this release we're giving you more speed improvements by parallelizing sorting and more memory reduction by improving the handling of NSEC(3) in incremental signing. You can also track all of these improvements with newly introduced metrics.

Thanks again to @bortzmeyer, @oli and @jpmens and others for providing valuable feedback!

#DNS #DNSSEC #OpenSource

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta5

@bortzmeyer @shaft QOTD
> Yes, following DNS stuff on Mastodon is now part of maintaining DNS...
Petit jeu : qui est l'auteur ?
La réponse
https://mail-archive.com/dns-operations@lists.dns-oarc.net/msg09228.html
#dns #dnssec #ccTLD

Hier, l'Albanie a cassé #DNSSEC et la racine a retiré l'enregistrement DS depuis https://dnsviz.net/d/al/akgJew/dnssec/

Albania's .al was secured for a week or so. Wonder what happened. 🤔

DS added to root zone : https://mastodns.net/@diffroot/116812884301667310
DS removed : https://mastodns.net/@diffroot/116857712875727653

#DNS #DNSSEC #ccTLD

Albania is now a safer country \o/

#DNSSEC

https://mastodns.net/@diffroot/116812884301667310

It’s Friday release day again with Cascade 0.1.0-beta2 'Donde comen dos, comen tres'. Thanks to the amazing feedback from @jpmens and @gryphius and hard work from the team, our DNSSEC signer has a bunch of fixes and improvements.

https://github.com/NLnetLabs/cascade/releases/tag/v0.1.0-beta2

#DNS #DNSSEC #OpenSource

#DNSSEC
DENIC "Final Report: DNS Outage of 5 May 2026"
https://blog.denic.de/en/final-report-dns-outage-of-5-may-2026/

I'm still frustrated, not all questions are answered.

With Cascade 0.1.0 beta1 “Slàinte mhath” we begin our journey to the first production release of our #DNSSEC signing solution.

We rewritten our signer from the ground up using a state machine based architecture, ensuring that each zone pipeline is in a single consistent state at all times.

In addition to built-in pre-signing and pre-publication review hooks, there’s now incremental signing, TSIG support, downstream IXFR, zone persistence, metrics and much more. #DNS

https://blog.nlnetlabs.nl/cascade-beta1-release/

@jpmens Ah yes, this link is a more accurate reflection of the past few days. 😄

https://github.com/NLnetLabs/cascade/issues?q=is%3Aissue%20author%3Ajpmens%20created%3A%3E%40today-1w

TSIG is mentioned 6 times!

#DNS #DNSSEC

With eight issues and one pull request over the weekend, once again we're incredibly thankful for the effort @jpmens is putting into testing Cascade.

Luckily, none of the reports seem to be in the “everything is broken”-category! 😅

https://github.com/NLnetLabs/cascade/issues?q=is%3Aissue%20state%3Aopen%20author%3Ajpmens%20created%3A%3E%40today-1w

#DNS #DNSSEC #OpenSource

With the Cascade beta release, the project now also has a dedicated page on our website:

https://nlnetlabs.nl/projects/cascade/about/

Next up: a logo!

#DNS #DNSSEC

After releasing the Cascade beta, NLnet Labs HQ has a @jpmens vs. @bortzmeyer poll going.

#DNS #DNSSEC

Alt...

A poll that asks “How many GitHub issues will JP Mens and Stephane Bortzmeyer create by Monday?”

Cascade 0.1.0 beta1 “Slàinte mhath” is out, so this is your opportunity to kick the tires and take it for a spin around your testing grounds!

As we gear up to the production release of our DNSSEC signer, we're eager to hear your feedback so we can incorporate it while we add improvements that we still have in the pipeline which we consider essential for production use.

Read all about it in our blog post!
https://blog.nlnetlabs.nl/cascade-beta1-release/

#DNS #DNSSEC #OpenSource #rustlang #LoveDNS

RFC 9975: Clarifications on CDS/CDNSKEY and CSYNC Consistency

Pour compléter un processus de sécurisation des noms de domaine avec #DNSSEC, il faut transmettre au domaine parent votre clé publique. Le faire manuellement via l'interface Web du BE n'est pas pratique donc il existe un moyen d'automatiser cela, les CDS/CDNSKEY. Mais attention à la sécurité ! Ce moyen n'est sûr que si on suit quelques précautions, décrites dans ce nouveau #RFC.

https://www.bortzmeyer.org/9975.html

🚨 SECURITY RELEASE 🚨
Today we released Unbound 1.25.1, which consolidates security fixes for issues reported over a period of time.

There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608.

Please read the release notes carefully and plan to upgrade.

#DNS #DNSSEC #Mythos #LLM #OpenSource

https://community.nlnetlabs.nl/t/unbound-1-25-1-released/3392

Peter Koch (DENIC) on the 5 may problem in .de.

.de has almost 18 million domain names and is incrementally updated.

Validation is done once it is already published.

HSM were using different keys :-(

#DNSSEC
#OARC46

"Cascade [#DNSSEC key manager and signer]: Beyond alpha" by Ximon Eighteen

Written in Rust. Still alpha (beta was not released yet).

Supported (among others) by the Sovereign Tech Agency.

#OARC46

Please pray to the live demo Gods over lunch so @ximon18 can show you our #DNSSEC signer Cascade in action this afternoon at @dnsoarc 46.

We’ll cover incremental signing with IXFR in and out with TSIG, all on a YubiHSM we packed. 🤞

#LoveDNS

@ximon18 @dnsoarc after his talk on stage, Ximon will be at the demo table in the lunch area, where he can show all the other tricks Cascade has learned since OARC 45 in Stockholm.

Also, make sure to bring your zone files so you can for example see how fast parallel #Dnssec signing by @bal4e really is. #DNS #LoveDNS #OpenSource

#DNS root zone key rollover under way. (Planned for 11 october.)

"Who in the room has root access to his resolver?" (Lot of hands, this is an OARC meeting.)

#OARC46 #DNSSEC

Wonderful list of things that can go wrong (and therefore, will) in operations.

(Including an error done on friday afternoon and fixed, will you guess, on monday.)

#DNS #DNSSEC #OARC46

The real world is complicated. For signing a .cn domain, it was necessary to send DS records by email... For .br, errors are not corrected 24x7, only during business hours. (Not always the registry's fault, sometimes you have to use a lot of intermediaries.)

#OARC46 #DNSSEC

Hey, .ml (ccTLD for Mali) is using #ed25519 !

$ dig +short ml. DS
21942 15 2 <crypto shenanigans>

(the number 15 indicates algorithm 15 aka ed25519)

So number of #TLD using algorithm 15: 3
- .fj (Fiji)
- .pg (Papua New Guinea)
- .ml

#DNSSEC

Reviewing DNS logs and noticed that `vuxml.freebsd.org` fails DNSSEC validation but `matrix-dev.freebsd.org` passes.

Can anyone else confirm or is my software buggy?

#FreeBSD #DNSSEC

Alt...

2026-05-08 03:27 UTC 10.17.89.66 matrix-dev.freebsd.org. v SEC 2026-05-08 03:27 UTC 10.17.89.66 matrix-dev.freebsd.org. v SEC 2026-05-08 03:22 UTC 10.17.89.18 vuxml. freebsd. org. Xx SEC 2026-05-08 03:21 UTC 10.17.89.19 vuxml. freebsd. org. Xx SEC 2026-05-08 03:17 UTC 10.17.89.66 vuxml. freebsd. org. Xx SEC 2026-05-08 03:06 UTC 10.17.89.42 vuxml. freebsd. org. Xx SEC

L'incident du .de m'a permis de constater que welt.de est signé avec #DNSSEC. Rép à ça lemonde.fr

DENIC's status page:
https://status.denic.de/

Screenshot below in case you're not able to load it (as I said, stuff is going to be intermittently failing).

#DNS #DENIC #DNSSEC #InfoSec #SysAdmin

Alt...

DNSSEC disruption affecting .de domainsPartial Service Disruption Incident Status Partial Service Disruption Components DNS Services DNS Nameservice May 5, 2026 23:28 CEST May 5, 2026 21:28 UTC INVESTIGATING Frankfurt am Main, 5 May 2026 – DENIC eG is currently experiencing a disruption in its DNS service for .de domains. As a result, all DNSSEC-signed .de domains are currently affected in their reachability. The root cause of the disruption has not yet been fully identified. DENIC’s technical teams are working intensively on analysis and on restoring stable operations as quickly as possible. Based on current information, users and operators of .de domains may experience impairments in domain resolution. Further updates will be provided as soon as reliable findings on the cause and recovery are available. DENIC asks all affected parties for their understanding. For further enquiries, DENIC can be contacted via the usual channels.

Am I the only one having #DNSSEC problems with #DENIC?

Unbound is throwing me a lot of DNSSEC bogus on some .de domains 🤔

#DNS

$ dig welt.de
...
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21366
...
; EDE: 6 (DNSSEC Bogus): (validation failure <welt.de. A IN>: signature crypto failed from 2a02:568:0:2::53 for DS welt.de. while building chain of trust)

Edit: issue seems fixed.

Looks like DE ccTLD is unresolvable due to DNSSEC issue:
https://dnsviz.net/d/nic.de/afpsNg/dnssec/

😬

🧵👇

#InfoSec #DNSSEC #DNS #Germany

RE: https://mastodon.social/@jpmens/116522310229612501

IANA has a chance to do the funniest thing ever…

#DNS #DNSSEC #InfoSec

@bortzmeyer après plusieurs timeout
Mais je suis en forêt avec un téléphone
C'est pas idéal pour déboguer :-) surtout #dnssec sur lequel je suis nul

Alt...

Une chienne noire dans un chemin forestier