- Ns.se - lists.iis.se

Obscure DNS vulnerability
by Anne-Marie Aug. 29, 2025

Aug. 29, 2025

Hi, Got this from a friend of mine, I can’t verify. Any comments? So this is an interesting one: Updated info yesterday from Microsoft regarding a DNS protocol (?) vulnerability in dns resolvers - with no CVE reference. First released on Dec 8,2020, last updated Aug 28 2025. No CVE. No PoC or known exploitation. A dns cache poisoning caused by IP fragmentation (!), and the suggested (temporary?) workaround is to reduce the Maximum UDP packet size to 1221 bytes, so that larger requests will switch to TCP. I've seen some weird issues & workarounds throughout my years. This is absolutely one of those cases! https://msrc.microsoft.com/update-guide/vulnerability/ADV200013 /amel ________________________ Anne-Marie Eklund Löwinder Amelsec AB Hägervägen 27, 122 39 Enskede +46 734315310 @amelsec.bsky.social

2 2

DNS-dagen. Anmälan är nu öppen – säkra din plats redan idag!
by Kristian Ørmen Aug. 3, 2025

Aug. 3, 2025

DNS-dagen Välkommen till en heldag som enbart handlar om DNS Du anmäler dig till DNS-dagen via följande länk: https://registryt.wufoo.com/forms/dns-dagen/ Bekräftade talare: Jakob Schlyter Mikael Kullberg Torbjörn Eklöv Jonathan Magnusson Ulrich Wisser Pamela Davidsson Mats Dufberg Johan Stenstam Kristian Ørmen 10 september 2025 kl. 10:00 - 19:30 på Internetstiftelsen Internetstiftelsen Hammarby Kaj 10D 120 07 Stockholm Agenda: 10:00 – 12:00 Talks 12:00 – 13:00 Lunch 13:00 – 15:00 Talks 15:30 – 15:30 Fika 16:00 – 17:30 Talks 17:30 – 19:30 AW Dela gärna inbjudan, även med personer som inte finns med på ns.se-listan. Välkommen! Med vänliga hälsningar, Kristian Ørmen Internetstiftelsen

1 0

Summer greetings from DNS TAPIR
by Olle E. Johansson June 10, 2025

June 10, 2025

Hello DNS gurus! Just a quick update from the DNS TAPIR project before summer holidays: * DNS TAPIR is moving forward During the spring we have built a new core platform, running on Kubernetes infrastructure. This cloud-based platform scales much better than our previous test servers. We have done a lot of infrastructure work to get this up and running, including the realtime analysis platform. * Linux packaging The DNS TAPIR Edge platform is now packaged for ease of installation and we are expanding to multiple Linux distributions - starting with RHEL. * The TAPIR Core analysis platform The core platform consists of two major parts, one that manages the data flows to the various edge installations and stores it for analysis and one part that is the heart of DNS TAPIR - the analysis platform. During the spring we presented more details about the analysis platform that is beginning to take shape. We will produce micro analytics components that run continuously on the realtime data flows received. In addition, live data will be available for our team to work with, creating and testing new algorithms, looking for new attack patterns and events that come up. We hope to create a video of our presentation of the architecture soon and publish on YouTube. * TAPIR Edge improvements We have worked hard to package and make our edge components easy to install, configure and manage. The security services, the RPZ management and the query log management and filtering now works well and we’re continously improving them based on feedback from our own tests. The TAPIR Edge Policy Processor (POP) is a hidden gem, that we’re going to talk more about in the fall. It not only manage the communication from the DNS TAPIR Core, but also manage and merge various sources of data into one set of RPZ zones in a new way, based on years of experience of operating DNS servers. If you want to take a look today, find it in our github repository https://github.com/dnstapir . * Privacy report An external company has analysed our methods to protect the privacy of DNS users to make sure that the data flows from the DNS TAPIR EDGE installations does not contain any personal information. The conclusion was clear: DNS TAPIR Core will not contain any personal data collected in the edge. We can provide this report on request. To learn more about the DNS TAPIR platform, please visit www.dnstapir.se <http://www.dnstapir.se/>. Please don’t hesitate to contact us - info(a)dnstapir.se <mailto:info@dnstapir.se> will put you in contact with the team. May your name servers run without interruption so you get a great summer! Best regards, The DNS TAPIR team /Olle DNS TAPIR is a Swedish project supported by Internetstiftelsen, Netnod and SUNET/Vetenskapsrådet. The first part of the work was funded by PTS.SE.

1 0

DNS extended
by Anne-Marie May 14, 2025

May 14, 2025

Hej, Jag har en fråga till alla DNS-gurus i världen. Det har ju dykt upp en del saker som man kan stoppa in i dns, som security.txt och robots.txt. Det senaste jag hör de var om llm.txt. Finns det och hur övertygar man en AI om att respektera respektive kringgå en sådan? Hur många txt finns det i världen. Liman och andra, som försvarat dns från onödig börda genom åren, hur ser ni på det? Många hälsningar, Anne-Marie ________________________ Anne-Marie Eklund Löwinder Amelsec AB Hägervägen 27, 122 39 Enskede +46 734315310 @amelsec.bsky.social

9 16

DNS day September 10th 2025
by Kristian Ørmen May 13, 2025

May 13, 2025

Please block your calendars for our next meeting. September 10th 10:00 – 19:30 with lunch and a light AW Internetstiftelsen Hammarby Kaj 10D 120 07 Stockholm Agenda: 10:00 – 12:00 Talks 12:00 – 13:00 Lunch 13:00 – 15:00 Talks 15:30 – 15:30 Fika 16:00 – 17:30 Talks 17:30 – 19:30 AW Participation is free. We will follow up with a sign-up link at a later point. We will of course talk about what happens at the registry, IETF, zonemaster, DNS Tapir etc. Please contact me if you would like to contribute with a presentation as well. -- Kristian Ørmen Internetstiftelsen +46 765607953 https://internetstiftelsen.se<https://internetstiftelsen.se/> Besöksadress: Hammarby Kaj 10D, Stockholm Postadress: Box 92073, 120 07 Stockholm

1 0

Fwd: [dns-operations] OARC 45 Call for Contributions
by Jerry Lundström May 9, 2025

May 9, 2025

FYI / TL;DR The DNS-OARC workshop is coming to Stockholm, Sweden - for the first time ever! :) Save the date! Cheers, Jerry -------- Forwarded Message -------- Subject: [dns-operations] OARC 45 Call for Contributions Date: Wed, 30 Apr 2025 17:21:28 +0100 From: Cathy Almond <cathya(a)isc.org> To: dns-operations(a)lists.dns-oarc.net The OARC 45 workshop Call for Contributions is now open! This workshop will be a hybrid event. Date - 7-8 October 2025 Location - Stockholm, Sweden Time - Approx 10:00 CEST (08:00 UTC) - 17:00 CEST (15:00 UTC) Adjacent to Netnod Tech Meeting 2025 (9 October 2025) (https://www.netnod.se/netnod-tech-meeting-2025) Deadline for Submissions - 2025-07-29 23:59 UTC https://indico.dns-oarc.net/event/55/abstracts/ All DNS-related subjects and discussion topics are welcome although we're particularly keen to hear more about operational and security related experiences, best practices and practical advice; both for newcomers to the DNS arena and those who have been around for longer who want to learn more about new features and opportunities to improve resilience, security and privacy. (These topics we think will complement the usual high-quality data-based research submissions we always hope to receive!) If you have something interesting to share with the community that lies outside of the focus above, please don't be put off - if it's good, we'll be happy to include it. If you'd like to offer a talk, but are not quite sure what to pick, here's a non-exhaustive list of ideas: 1. Operations & Deployment Configuration management, deployment processes, and interoperability experiences. Tools, tips, and making effective use of DNS software features. 2. Performance, Resilience & Scaling Provisioning, load-balancing, and planning for resilience. DNS performance management, efficiency improvements, and metrics. Monitoring infrastructure: log pipelines, analytics, and anomaly detection. 3. Security, Privacy & Policy DoS attacks, DNS abuse, DNSSEC signing and validation. Privacy considerations, for example: encrypted transport, qname minimization, data anonymization. Relevant global and regional policies, legislation, and compliance. 4. Research & Innovation Data-driven testing, measurement, and analysis. New protocols, protocol extensions, and next-generation namespace management. 5. Lessons & Learnings Outage experiences, recovery stories, and cautionary tales For further details please see https://www.dns-oarc.net/oarc45 Cathy Almond, for the DNS-OARC Programme Committee _______________________________________________ dns-operations mailing list dns-operations(a)lists.dns-oarc.net https://lists.dns-oarc.net/mailman/listinfo/dns-operations

1 0

Lär dig mer om DNS TAPIR den 6 maj i Gamla Stan, Stockholm
by Olle E. Johansson April 22, 2025

April 22, 2025

Hej! DNS TAPIR har under våren jobbat vidare med delfinansiering som hållit oss igång. Vi har fokuserat på att få igång en testmiljö där vi kan ansluta “riktiga” namnservrar i operatörsmiljö för test. Vi har också jobbat vidare med paketering för att underlätta installation i det vi kallar DNS TAPIR Edge, den miljö som körs ute på en resolver. Utöver det har vi också en tydligare arkitektur av analys-verkstaden i DNS TAPIR Core att berätta mer om. Den 6 maj kl 15 berättar vi mer i en after-work på Agical, Västerlånggatan 79 i Gamla Stan, Stockholm. Nära både till tunnelbana och SF-bokhandeln. Anmäl dig till info(a)dnstapir.se <mailto:info@dnstapir.se> så vi vet att du kommer och så vi kan förse dig med portkoden. Ser fram emot att träffa dig i Gamla Stan! /Olle

1 0

Fwd: Secure Domain Name System (DNS) Deployment Guide | Comment on NIST SP 800-81r3
by Anne-Marie April 11, 2025

April 11, 2025

1 0

.se cds-automatisering ej komplett?
by Daniel Lublin Feb. 10, 2025

Feb. 10, 2025

Hej, Jag har nyligen fått upp DNSSEC för några av mina domäner. För .se visade sig automatiseringen med CDS RR som registry plockar upp vara praktisk. För ett par .se-domäner så verkar dock allt inte gå riktigt rätt. För dessa så plockar IIS CDS-automatisering bara upp den ena av de två hasharna (bara 4:an, SHA384). Ett exempel: ``` $ dig +short lublin.se. ds 37136 13 4 DBF142555D55ECC9798E91F586FAB7550B772F4F06574D6F1D9724DD 927A9775521CD2C5BCB35618484E33C480C2D6C5 $ dig +short @ns1.desec.io lublin.se. cds 37136 13 2 A2E09560E47CA304BA4773FEED73733936470ED7D429A94055DEE1CB E1ECB09D 37136 13 4 DBF142555D55ECC9798E91F586FAB7550B772F4F06574D6F1D9724DD 927A9775521CD2C5BCB35618484E33C480C2D6C5 ``` https://cds.registry.se/ säger om lublin.se: Domain lublin.se Status Done = The scanning process has completed successfully. FirstValidAt 2025-02-01 14:36:24 LastValidAt 2025-02-01 14:36:24 Message Region Timestamp ok North America 2025-02-09 14:36:23 ok Europe ... Jag har åtminstone en annan .se-domän där båda hasharna plockas upp och läggs in som två DS RR uppe vid delegeringspunkten. Saker fungerar generellt även om bara en hashvariant ligger som DS-post, men det ger ju varning hos Zonemaster mfl. -- Daniel lublin.se

4 5

Påminnelse: DNS Hackathon 2025
by Lars-Johan Liman Jan. 20, 2025

Jan. 20, 2025

Halloj! Jag har sett att flera av er har anmält er till DNS Hackathon här hos oss på Netnod, i samarbete med RIPE NCC och DNS-OARC. Jätteroligt! Jag vill bara påminna om att det blir _ännu_ roligare om ni andra också kommer ... 😉 Glada hälsningar /Liman #---------------------------------------------------------------------- Välkommen till DNS Hackathon 2025 i Stockholm! Netnod, DNS-OARC och RIPE NCC bjuder in dig till vårt andra gemensamma DNS Hackathon den 15–16 mars 2025 på Netnods kontor i Solna, helgen innan Netnod-mötet. Hackathonet samlar deltagare med olika bakgrunder för att utveckla verktyg, idéer och lösningar kring DNS – allt i en kreativ och samarbetande miljö. Viktiga datum: - 15 okt 2024: Ansökan öppnar - 2 feb 2025: Sista deadline - 15–16 mars 2025: Hackathonet Deltagandet är gratis, inklusive mat och dryck. Platserna är begränsade, så ansök idag! Ansök och läs mer här: https://labs.ripe.net/author/becha/join-the-dns-hackathon-2025/ Har du frågor? Kontakta oss på <dnshackathon2025(a)dns-oarc.net>. Välkommen! Johanna Eriksson (Netnod) Denesh Bhabuta (DNS-OARC), Vesna Manojlovic (RIPE NCC) Johanna Eriksson, Event Manager Netnod AB Tel: +46-8-562 860 00, Mobile: +46-70-813 55 62 Greta Garbos väg 13 | SE-169 40 SOLNA | SWEDEN

1 0