The DNS Server That Lagged Behind
• 3 min read
Around the end of October and beginning of November 2024, twenty six African TLDs had a technical problem - one of their authoritative name servers served stale data. This is a tale of monitoring, anycast, and debugging.
Although it is not part of the three mentioned possible themes, I'm thinking about DELEG. After the recent IETF in Dublin, DELEG seems to be advancing well and, in march, we may already have experimental implementations to play with. Would it be a good subject? (A hackathon could be a good interoperability event.) Are other people interested? (Note that the IETF hackathon will be the exact same week-end, which is unfortunate.)
"This was a precursor to DNS." whois, a precursor of the DNS??? "IDN TLD's (Internationalised Domain Names in Unicode) were defined much later on in RFC5890 in 2010." No, seven years before (RFC 3490) "Some TLDs even need a registrar to send an email to the TLD management organisation to create register a new domain. A human then has to manually edit the zone" There is nothing wrong with that, if that suits their constituency. The whole point of decentralisation (a strong feature of the DNS) is the ability to have different policies. "the amount of servers" It is an useful information, yes, but less important than the "strength" of the servers. bortzmeyer.fr has eight name servers but cannot be compared to .de (six servers) "It [ICANN] sadly can't enforce it on the legacy ones" See my point above about the freedom brought by decentralisation.
"the NixOS infrastructure relies heavily on GitHub" Why? NixOS needs to contact Github daily like ChromeOS needs to talk to Google? And if it is just to update packages, aren't they alternative sources?
“These are all good points. I especially like the idea of search suggestions. Another useful refinement would be to default search results newest first and oldest last. At the moment, documents and pages are mixed together and not ordered by date. This can make searching for the one document you want a real slog.”
As an example, searching "IP address" returns the RIPE NCC Activity Plan 2012 :-)
Many people visiting RIPE Web site have a RIPE Access account. Are there plans to use their search history to provide context, which helps a lot in Web search? (And also raises a lot of touchy privacy issues. IMHO, "anonymous" users, those not logged in RIPE Access must be excluded of this feature. But the privacy issue also holds for logged-in users.)
I'm not sure about the consequences. Does it mean that Afrinic could lose its accreditation?
I like the IP address 2610:a1:1072::1:42 since the name is an IDN. But, alas, no DNSSEC.
"They may also receive more spam and phishing e-mails, since modern e-mail security protocols rely on DNSSEC as well." I would like to see email servers use SPF, DKIM and DMARC records only if they have been validated with DNSSEC but I strongly doubt it is the case today.
Developping something new (no installed base) and mission-critical in C, today, is a bit strange. Why not using a safer language?
Nice and useful article. For OpenDNSSEC, the important parameter is named Jitter and is enabled by default. Check that you have something like "<Policy name="default">...<Signatures>... <Jitter>PT12H</Jitter>" It would be nice to document here how it is done for other signing programs.
Showing 57 comment(s)