Please pray to the live demo Gods over lunch so @ximon18 can show you our #DNSSEC signer Cascade in action this afternoon at @dnsoarc 46.

We’ll cover incremental signing with IXFR in and out with TSIG, all on a YubiHSM we packed. 🤞

#LoveDNS

@ximon18 @dnsoarc after his talk on stage, Ximon will be at the demo table in the lunch area, where he can show all the other tricks Cascade has learned since OARC 45 in Stockholm.

Also, make sure to bring your zone files so you can for example see how fast parallel #Dnssec signing by @bal4e really is. #DNS #LoveDNS #OpenSource

#DNS root zone key rollover under way. (Planned for 11 october.)

"Who in the room has root access to his resolver?" (Lot of hands, this is an OARC meeting.)

#OARC46 #DNSSEC

Wonderful list of things that can go wrong (and therefore, will) in operations.

(Including an error done on friday afternoon and fixed, will you guess, on monday.)

#DNS #DNSSEC #OARC46

The real world is complicated. For signing a .cn domain, it was necessary to send DS records by email... For .br, errors are not corrected 24x7, only during business hours. (Not always the registry's fault, sometimes you have to use a lot of intermediaries.)

#OARC46 #DNSSEC

Automatic authenticated DNSSEC Bootstrapping in PowerDNS Authoritative

https://blog.powerdns.com/2026/05/12/automatic-authenticated-dnssec-bootstrapping-in-powerdns-authoritative-server

#dns #dnssec

Hey, .ml (ccTLD for Mali) is using #ed25519 !

$ dig +short ml. DS
21942 15 2 <crypto shenanigans>

(the number 15 indicates algorithm 15 aka ed25519)

So number of #TLD using algorithm 15: 3
- .fj (Fiji)
- .pg (Papua New Guinea)
- .ml

#DNSSEC

Reviewing DNS logs and noticed that `vuxml.freebsd.org` fails DNSSEC validation but `matrix-dev.freebsd.org` passes.

Can anyone else confirm or is my software buggy?

#FreeBSD #DNSSEC

Alt...

2026-05-08 03:27 UTC 10.17.89.66 matrix-dev.freebsd.org. v SEC 2026-05-08 03:27 UTC 10.17.89.66 matrix-dev.freebsd.org. v SEC 2026-05-08 03:22 UTC 10.17.89.18 vuxml. freebsd. org. Xx SEC 2026-05-08 03:21 UTC 10.17.89.19 vuxml. freebsd. org. Xx SEC 2026-05-08 03:17 UTC 10.17.89.66 vuxml. freebsd. org. Xx SEC 2026-05-08 03:06 UTC 10.17.89.42 vuxml. freebsd. org. Xx SEC

DENIC: “Analysis of the DNS outage on 5 May 2026”

English: https://blog.denic.de/en/analysis-of-the-dns-outage-on-5-may-2026/

German: https://blog.denic.de/analyse-des-dns-ausfalls-vom-5-mai-2026/

#dnssec

L'incident du .de m'a permis de constater que welt.de est signé avec #DNSSEC. Rép à ça lemonde.fr

Quad1 and Quad9 appear to have added an NTA (negative trust anchor) for .DE which means validators will no longer validate domains below *.DE; the situation will thus resolve (pun not really intended) itself soon’ish if temporarily until the root cause is fixed and the NTAs are removed.

Quad8 is still validating .DE

#dnssec

Here is Quad9’s NTA: https://quad9.net/api/ntas.txt

DENIC's status page:
https://status.denic.de/

Screenshot below in case you're not able to load it (as I said, stuff is going to be intermittently failing).

#DNS #DENIC #DNSSEC #InfoSec #SysAdmin

Alt...

DNSSEC disruption affecting .de domainsPartial Service Disruption Incident Status Partial Service Disruption Components DNS Services DNS Nameservice May 5, 2026 23:28 CEST May 5, 2026 21:28 UTC INVESTIGATING Frankfurt am Main, 5 May 2026 – DENIC eG is currently experiencing a disruption in its DNS service for .de domains. As a result, all DNSSEC-signed .de domains are currently affected in their reachability. The root cause of the disruption has not yet been fully identified. DENIC’s technical teams are working intensively on analysis and on restoring stable operations as quickly as possible. Based on current information, users and operators of .de domains may experience impairments in domain resolution. Further updates will be provided as soon as reliable findings on the cause and recovery are available. DENIC asks all affected parties for their understanding. For further enquiries, DENIC can be contacted via the usual channels.

Am I the only one having #DNSSEC problems with #DENIC?

Unbound is throwing me a lot of DNSSEC bogus on some .de domains 🤔

#DNS

$ dig welt.de
...
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21366
...
; EDE: 6 (DNSSEC Bogus): (validation failure <welt.de. A IN>: signature crypto failed from 2a02:568:0:2::53 for DS welt.de. while building chain of trust)

Edit: issue seems fixed.

Looks like DE ccTLD is unresolvable due to DNSSEC issue:
https://dnsviz.net/d/nic.de/afpsNg/dnssec/

😬

🧵👇

#InfoSec #DNSSEC #DNS #Germany

RE: https://mastodon.social/@jpmens/116522310229612501

IANA has a chance to do the funniest thing ever…

#DNS #DNSSEC #InfoSec

John Shaft boosted

JP Mens » 🌐 2026-05-05
@jpmens@mastodon.social

Rolling the root #DNSSEC key:

"The next KSK key roll is underway as of May 2026. This is not a change of algorithm, but simply a change of the private key value. The incoming KSK (KSK-2024) was published on the IANA website in July 2024 and added to the root zone’s DNSKEY Resource Record in January 2025. The IANA plans to roll the KSK in October 2026, when it will be used for generating the root zone’s DNSKEY Resource Record digital signatures"

https://blog.apnic.net/2026/05/05/rolling-the-root-key/

Rolling the root #DNSSEC key:

"The next KSK key roll is underway as of May 2026. This is not a change of algorithm, but simply a change of the private key value. The incoming KSK (KSK-2024) was published on the IANA website in July 2024 and added to the root zone’s DNSKEY Resource Record in January 2025. The IANA plans to roll the KSK in October 2026, when it will be used for generating the root zone’s DNSKEY Resource Record digital signatures"

https://blog.apnic.net/2026/05/05/rolling-the-root-key/

@bortzmeyer après plusieurs timeout
Mais je suis en forêt avec un téléphone
C'est pas idéal pour déboguer :-) surtout #dnssec sur lequel je suis nul

Alt...

Une chienne noire dans un chemin forestier

PowerDNS DNSdist 1.9.14 and 2.0.5 Released

https://blog.powerdns.com/2026/04/23/powerdns-dnsdist-1.9.14-and-2.0.5-released

#dns #dnssec

PowerDNS Security Advisory 2026-05 for PowerDNS Authoritative Server
(aka PowerDNS Authoritative Server 4.9.14 and 5.0.4 released)

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-05-for-powerdns-authoritative-server

#dns #dnssec

PowerDNS Security Advisory 2026-03 for PowerDNS Recursor
(aka PowerDNS Recursor 5.2.9, 5.3.6 and 5.4.1 released)

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-03

#dns #dnssec

PowerDNS Security Advisory 2026-04 for PowerDNS DNSdist
(aka DNSdist 1.9.13 and 2.0.4 released)

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-04-for-powerdns-dnsdist

#dns #dnssec

RE: https://mastodns.net/@diffroot/116445067811030516

Space is now elliptic!

#DNSSEC

Well at least it is signed with #DNSSEC 😬😬

#Wero
https://piaille.fr/@shaft/116324300412851241

Alt...

The "X, X everywhere" from Toy Story 2 but redrawn by @gee@framapiaf.org. This version reads "Amazon, Amazon everywhere"

PowerDNS DNSdist 1.9.12 and 2.0.3 Released (Security Release)

https://blog.powerdns.com/2026/03/31/powerdns-dnsdist-1.9.12-and-2.0.3-released

#dns #dnssec

We're thrilled that Cascade is among the first projects supported by the Nominet DNS Fund.

With Nominet's support, our new DNSSEC signing solution receives a massive push forward, allowing our team to focus on implementing speed improvements, a reduced memory footprint and essentials such as incremental signing.

We'll be launching a beta in April, followed by an initial production release in June 2026.

Read more: https://nominet.uk/news/nominet-supports-foundations-of-the-internet-with-first-dns-fund-projects-announced/

#OpenSource #rustlang #FOSS #DNS #DNSSEC

Alt...

Nominet DNS Fund banner

If we start to use Merkle trees for #DNSSEC signatures, as currently discussed at #IETF125, this would create a lot of new interesting blog posts and @dnsoarc meeting talks 😋

So, previously on post-quantum #DNSSEC: not a lot of action. Standardized post-quantum cryptography algorithms like ML-DSA have keys and signatures which are way too long for the #DNS.

https://mastodon.gougere.fr/@DNSresolver/116241567126448201

TLS can deal with it (they run on TCP or QUIC) but we cannot, with UDP. No obvious solution.

#IETF125

PowerDNS Recursor 5.4.0 Released

https://blog.powerdns.com/2026/03/09/powerdns-recursor-5.4.0-released

#dns #dnssec

With memory prices skyrocketing we're happy to bring you some good news on the #DNS front.

In version 4.14.0 of our authoritative nameserver NSD we vastly reduced the memory footprint by refactoring the RDATA storage, with gains up to 50%.

Overall, relatively large #DNSSEC-signed zones like .nl and .se benefit the most, but being able to bring the memory requirements to serve .com below 64GB is pretty awesome too.

We're eager to hear the improvements you're seeing!

https://blog.nlnetlabs.nl/smaller-faster-nsds-refactored-rdata-storage-and-compile-time-memory-reduction-options/