Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

411–420 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#411

Post by toast0 »

basilikum wrote: post #228

This is the kind of system failure that we need really good and well tested disaster recovery plans for. While not necessary this time, DENIC and any critical infrastructure provider should be able to rebuild their entire infrastructure from scratch in a tolerable amount of time (Rather days than hours in the case of a full rebuild). Importantly the disaster recovery plan has to work without reliance on either the sy…

> This is the kind of system failure that we need really good and well tested disaster recovery plans for.

All the cool kids offer their services over multiple TLDs and have their name servers of record in multiple TLDs, too. It's not quite best practices for recursive DNS to regularly fetch the complete root zone to cache it, but it's not unreasonable to do so.

Re: DNSSEC disruption affecting .de domains – Resolved

#412

Post by amiga386 »

icedchai wrote: post #401
ondohotola wrote: post #400

Earlier quoted context omitted.

Have you ANY clue about the size of .DE's name server infrastructure?

Are you following the thread? We're talking about redundancy for a single domain here.

The single domain here is a ccTLD, and DNS's heirarchical nature means your personal domain's redundant DNS can't mitigate an outage at the ccTLD level.

Re: DNSSEC disruption affecting .de domains – Resolved

#413

Post by icedchai »

amiga386 wrote: post #412
icedchai wrote: post #401

Earlier quoted context omitted.

Are you following the thread? We're talking about redundancy for a single domain here.

The single domain here is a ccTLD, and DNS's heirarchical nature means your personal domain's redundant DNS can't mitigate an outage at the ccTLD level.

Sorry, no. I was responding to "I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers."

That is not the ccTLD, that is an individual domain and its name servers. I recall being given that warning for early domain registrations.

Re: DNSSEC disruption affecting .de domains – Resolved

#414

Post by walrus01 »

account42 wrote: post #361
walrus01 wrote: post #258

Earlier quoted context omitted.

As the CPU/RAM resources to run an authoritative-only slave nameserver for a few domains are extremely minimal (mine run at a unix load of 0.01), it's a very wise idea to put your ns3 or something at a totally different service provider on another continent . It costs less than a cup of coffee per month.

This makes sense for larger providers but just for a small/personal website there is literally zero advantages to having distributed authoritative DNS servers when the webserver is on a single host. Ironically, denic still requires you to have two separate name servers with different IPs for your domain (which can be worked around by changing the IP of the registered name server afterwards lol), a requirement that al…

For a domain owned by someone in North America, it costs me literally $1.50 a month to have an authoritative only ns3 in Europe on a totally different ISP.

Re: DNSSEC disruption affecting .de domains – Resolved

#415

Post by walrus01 »

psd1 wrote: post #387
belorn wrote: post #350

Earlier quoted context omitted.

For a very long time, the computer club I was in operated a DNS server on a Pentium 75MHz and after the last major hardware upgrade it had a total of 110MB RAM memory and 2G disk space. It worked great except that before the upgrade it tended to run out of ram whenever there was a Linux kernel update, a problem we solved forever by populating all the ram slots with the maximum that the motherboard could handle to tha…

Did you populate the motherboard with the most it could handle, or the most you could assemble from a box of assorted sticks? Otherwise, 110MB would hint at a fascinating engineering culture at the motherboard manufacturer.

If I remember right there were certain very early pentium 3 processor competitors from VIA and other non-intel, non-AMD sources (with much worse performance) that had integrated onboard SVGA video, where the video RAM was shared with the system DRAM. Meaning that depending how you configured the video in the BIOS, you could have something like a 128GB RAM server "minus" 16GB RAM withheld for video, with like 112GB usable by the OS.

But if this guy is talking about a pentium 75 MHz (socket 5 CPU) that's a totally different generation of stuff several generations before that.

Re: DNSSEC disruption affecting .de domains – Resolved

#416

Post by matteocontrini »

whh wrote: post #358
thayne wrote: post #263

Earlier quoted context omitted.

Probably the most common reason to use DNSSEC is to check a box on a list of compliance rules. And I don't think this will change anything for people who need DNSSEC for compliance.

I found another reason... MS365 require DNSSEC to be enabled if you want DANE for TLS-enforced SMTP. You could also use MTA-STS.

As far as I know, the DANE spec (RFC 7671) requires DNSSEC to be enabled, while MTA-STS does not.

Re: DNSSEC disruption affecting .de domains – Resolved

#417

Post by tptacek »

matteocontrini wrote: post #416
whh wrote: post #358

Earlier quoted context omitted.

I found another reason... MS365 require DNSSEC to be enabled if you want DANE for TLS-enforced SMTP. You could also use MTA-STS.

As far as I know, the DANE spec (RFC 7671) requires DNSSEC to be enabled, while MTA-STS does not.

MTA-STS was standardized explicitly to support the (nearly universal) use case of mail providers without DNSSEC. Even O365, which ostensibly supports DANE/DNSSEC for email security, does so only for select customers and not for ordinary ones (go look for the TLSAs).

Re: DNSSEC disruption affecting .de domains – Resolved

#418

Post by tptacek »

Bender wrote: post #292
tptacek wrote: post #250

Earlier quoted context omitted.

The Tranco list is an academic research project to generate a "top N zones" list. Here's the portion of the top 1000 that is signed: https://dnssecmenot.fly.dev/

That's cool, ty for that. The only one I put credentials into is Amazon it is unsigned. [1] There probably needs to be a DNSSECv2 .vbis that reduces risk somehow to get more adoption. [1] - https://dnssec-analyzer.verisignlabs.com/amazon.com

For what it's worth, technically we're already on something like DNSSEC-ter or DNSSEC-quater. -bis was back in the early 2000s with the typecode roll. It was really called DNSSEC-bis!

Re: DNSSEC disruption affecting .de domains – Resolved

#419

Post by icedchai »

qingcharles wrote: post #268
gerdesj wrote: post #260

Earlier quoted context omitted.

Cool. Feel free to explain how to tighten things up. I've just given them part of a recipe for using DNSSEC. I suspect you are not actually human .. qingcharles.

I don't even understand what your comment is about, my dude. Given who a recipe? DENIC?

Look at his previous post. He described how to set up DNSSEC with PowerDNS.

Re: DNSSEC disruption affecting .de domains – Resolved

#420

Post by pocksuppet »

Bender wrote: post #292
tptacek wrote: post #250

Earlier quoted context omitted.

The Tranco list is an academic research project to generate a "top N zones" list. Here's the portion of the top 1000 that is signed: https://dnssecmenot.fly.dev/

That's cool, ty for that. The only one I put credentials into is Amazon it is unsigned. [1] There probably needs to be a DNSSECv2 .vbis that reduces risk somehow to get more adoption. [1] - https://dnssec-analyzer.verisignlabs.com/amazon.com

Do we know what their root mistake was? I've studied and deployed DNSSEC, and as I see it, the current version is pretty much the simplest thing that could possibly work, given the way DNS works.
Post reply on HN