- Ns.se - lists.iis.se

Gonemaster

by Patrik Wallstrom

Hej! Jag har precis publicerat första betaversionen på Gonemaster, en Zonemaster-klon skriven i Go. Den är just nu tänkt att vara helt kompatibel med Zonemaster, åtminstone utresultatet. I all afall ett litet tag framåt, sedan tänkte jag ta tag i en del saker jag retat mig på under åren, bl.a. formatteringen på argument i JSON, och prestanda. Så nu kör jag inte Zonemaster längre, utan Gonemaster. Framöver blir det väl ett REST API också. Det är en del saker som återstår att göra, men det är egentligen mest smådetaljer. Och tester av ännu ej delegerade domäner. Testa gärna! https://codeberg.org/pawal/gonemaster / Patrik

Jan. 26, 2026

Välkomna på Julmingel med DNS tema - Torsdag 27. november!

by Kristian Ørmen

DNS julmingel 2025 Välkomna på Julmingel med DNS tema - Torsdag 27. november! Internetstiftelsen och Netnod välkomnar dig till julmingel med DNS-tema, i år hos Internetstiftelsen Vi bjuder på julskinka, flera sorters senap, god dryck, julöl, glögg och alkoholfritt. Sedan blir det kaffe och lussebullar. Såklart blir det DNS-prat Agenda: 16.00 Välkomna 16.15 Presentation 1 16.45 Presentation 2 17.15 Övrigt 17.30 Julmingel med DNS prat 20.00 Vi avslutar DNS julmingel När: Torsdag 27 november kl 16.00 - 20.00 Var: Internetstiftelsen. Hammarby kaj 10D, Stockholm Anmäl senast 9 november. OBS, begränsat antal platser. Registrera dig här: https://registryt.wufoo.com/forms/dns-julmingel-2025/ Varmt välkomna! Leon, Erik, Johan, Mats, Jonas, Pamela & Kristian Internetstiftelsen, DNS-Labs

Oct. 20, 2025

DNS Week

by Kristian Ørmen

Hi everyone Just a quick reminder about DNS week next month. It’s still possible to apply to attend for DNS Hackathon. Please do so within a week https://internetstiftelsen.se/dns-labs/tech/dns-hackathon/ And for DNS OARC, even though it’s looking to be very well attended, it’s still possible to get tickets. https://indico.dns-oarc.net/event/55/ Netnod tech meeting has a waiting list. https://www.netnod.se/netnod-tech-meeting-2025 Kind regards Kristian Ørmen Internetstiftelsen

Sept. 8, 2025

Re: Obscure DNS vulnerability

by Ulrich Wisser

Just for reference: DNS Flag Day 2020 https://www.dnsflagday.net/2020/ EDNS0 size 1232 Ibland är det inte så svårt att göra det rätta. Bara lyssna på folk som vet. /Ulrich Am 29.08.25 um 14:24 schrieb Anne-Marie via Ns.se: > Update: there is a CVE from 2020: CVE-2020-25705, known as SAD DNS > (Side-channel AttackeD DNS), and also affected Linux, macOS and DNS > resolvers like BIND, Unbound & dnsmasq. > > But Microsoft updated their advisory *yesterday* saying this > vulnerability also affects Windows Server 2025. > > "Unsolvable" DNS protocol error? > > /amel > > ________________________ > Anne-Marie Eklund Löwinder > Amelsec AB > Hägervägen 27, 122 39 Enskede > +46 734315310 > @amelsec.bsky.social > > >> 29 aug. 2025 kl. 14:17 skrev Anne-Marie <amel(a)lowinder.se>: >> >> Hi, >> >> Got this from a friend of mine, I can’t verify. Any comments? >> >> So this is an interesting one: Updated info yesterday from Microsoft >> regarding a DNS protocol (?) vulnerability in dns resolvers - with no >> CVE reference. First released on Dec 8,2020, last updated Aug 28 >> 2025. No CVE. No PoC or known exploitation. A dns cache poisoning >> caused by IP fragmentation (!), and the suggested (temporary?) >> workaround is to reduce the Maximum UDP packet size to 1221 bytes, so >> that larger requests will switch to TCP. >> >> I've seen some weird issues & workarounds throughout my years. This >> is absolutely one of those cases! >> >> https://msrc.microsoft.com/update-guide/vulnerability/ADV200013 >> >> /amel >> >> ________________________ >> Anne-Marie Eklund Löwinder >> Amelsec AB >> Hägervägen 27, 122 39 Enskede >> +46 734315310 >> @amelsec.bsky.social >> >> -- >> Ns.se mailing list -- ns.se(a)lists.iis.se >> To unsubscribe send an email to ns.se-leave(a)lists.iis.se >

Aug. 29, 2025

Re: Obscure DNS vulnerability

by Anne-Marie

Update: there is a CVE from 2020: CVE-2020-25705, known as SAD DNS (Side-channel AttackeD DNS), and also affected Linux, macOS and DNS resolvers like BIND, Unbound & dnsmasq. But Microsoft updated their advisory *yesterday* saying this vulnerability also affects Windows Server 2025. "Unsolvable" DNS protocol error? /amel ________________________ Anne-Marie Eklund Löwinder Amelsec AB Hägervägen 27, 122 39 Enskede +46 734315310 @amelsec.bsky.social > 29 aug. 2025 kl. 14:17 skrev Anne-Marie <amel(a)lowinder.se>: > > Hi, > > Got this from a friend of mine, I can’t verify. Any comments? > > So this is an interesting one: Updated info yesterday from Microsoft regarding a DNS protocol (?) vulnerability in dns resolvers - with no CVE reference. First released on Dec 8,2020, last updated Aug 28 2025. No CVE. No PoC or known exploitation. A dns cache poisoning caused by IP fragmentation (!), and the suggested (temporary?) workaround is to reduce the Maximum UDP packet size to 1221 bytes, so that larger requests will switch to TCP. > > I've seen some weird issues & workarounds throughout my years. This is absolutely one of those cases! > > https://msrc.microsoft.com/update-guide/vulnerability/ADV200013 > > /amel > > ________________________ > Anne-Marie Eklund Löwinder > Amelsec AB > Hägervägen 27, 122 39 Enskede > +46 734315310 > @amelsec.bsky.social > > -- > Ns.se mailing list -- ns.se(a)lists.iis.se > To unsubscribe send an email to ns.se-leave(a)lists.iis.se

Aug. 29, 2025

Obscure DNS vulnerability

by Anne-Marie

Hi, Got this from a friend of mine, I can’t verify. Any comments? So this is an interesting one: Updated info yesterday from Microsoft regarding a DNS protocol (?) vulnerability in dns resolvers - with no CVE reference. First released on Dec 8,2020, last updated Aug 28 2025. No CVE. No PoC or known exploitation. A dns cache poisoning caused by IP fragmentation (!), and the suggested (temporary?) workaround is to reduce the Maximum UDP packet size to 1221 bytes, so that larger requests will switch to TCP. I've seen some weird issues & workarounds throughout my years. This is absolutely one of those cases! https://msrc.microsoft.com/update-guide/vulnerability/ADV200013 /amel ________________________ Anne-Marie Eklund Löwinder Amelsec AB Hägervägen 27, 122 39 Enskede +46 734315310 @amelsec.bsky.social

Aug. 29, 2025

DNS-dagen. Anmälan är nu öppen – säkra din plats redan idag!

by Kristian Ørmen

DNS-dagen Välkommen till en heldag som enbart handlar om DNS Du anmäler dig till DNS-dagen via följande länk: https://registryt.wufoo.com/forms/dns-dagen/ Bekräftade talare: Jakob Schlyter Mikael Kullberg Torbjörn Eklöv Jonathan Magnusson Ulrich Wisser Pamela Davidsson Mats Dufberg Johan Stenstam Kristian Ørmen 10 september 2025 kl. 10:00 - 19:30 på Internetstiftelsen Internetstiftelsen Hammarby Kaj 10D 120 07 Stockholm Agenda: 10:00 – 12:00 Talks 12:00 – 13:00 Lunch 13:00 – 15:00 Talks 15:30 – 15:30 Fika 16:00 – 17:30 Talks 17:30 – 19:30 AW Dela gärna inbjudan, även med personer som inte finns med på ns.se-listan. Välkommen! Med vänliga hälsningar, Kristian Ørmen Internetstiftelsen

Aug. 3, 2025

Summer greetings from DNS TAPIR

by Olle E. Johansson

Hello DNS gurus! Just a quick update from the DNS TAPIR project before summer holidays: * DNS TAPIR is moving forward During the spring we have built a new core platform, running on Kubernetes infrastructure. This cloud-based platform scales much better than our previous test servers. We have done a lot of infrastructure work to get this up and running, including the realtime analysis platform. * Linux packaging The DNS TAPIR Edge platform is now packaged for ease of installation and we are expanding to multiple Linux distributions - starting with RHEL. * The TAPIR Core analysis platform The core platform consists of two major parts, one that manages the data flows to the various edge installations and stores it for analysis and one part that is the heart of DNS TAPIR - the analysis platform. During the spring we presented more details about the analysis platform that is beginning to take shape. We will produce micro analytics components that run continuously on the realtime data flows received. In addition, live data will be available for our team to work with, creating and testing new algorithms, looking for new attack patterns and events that come up. We hope to create a video of our presentation of the architecture soon and publish on YouTube. * TAPIR Edge improvements We have worked hard to package and make our edge components easy to install, configure and manage. The security services, the RPZ management and the query log management and filtering now works well and we’re continously improving them based on feedback from our own tests. The TAPIR Edge Policy Processor (POP) is a hidden gem, that we’re going to talk more about in the fall. It not only manage the communication from the DNS TAPIR Core, but also manage and merge various sources of data into one set of RPZ zones in a new way, based on years of experience of operating DNS servers. If you want to take a look today, find it in our github repository https://github.com/dnstapir . * Privacy report An external company has analysed our methods to protect the privacy of DNS users to make sure that the data flows from the DNS TAPIR EDGE installations does not contain any personal information. The conclusion was clear: DNS TAPIR Core will not contain any personal data collected in the edge. We can provide this report on request. To learn more about the DNS TAPIR platform, please visit www.dnstapir.se <http://www.dnstapir.se/>. Please don’t hesitate to contact us - info(a)dnstapir.se <mailto:info@dnstapir.se> will put you in contact with the team. May your name servers run without interruption so you get a great summer! Best regards, The DNS TAPIR team /Olle DNS TAPIR is a Swedish project supported by Internetstiftelsen, Netnod and SUNET/Vetenskapsrådet. The first part of the work was funded by PTS.SE.

June 10, 2025

Re: DNS extended

by Patrik Fältström

On 14 May 2025, at 10:08, Johan Stenstam via Ns.se wrote: > Very easy to register: no. > > Been there, done that, carry the scars. In *theory* you’re absolutely correct, but in practice… well you know the rest. What we have is a process that "only" require expert review. Standard action is not needed (compared to many other IANA parameters). See https://www.rfc-editor.org/rfc/rfc6895.html#page-14 Sure, that can be hard, but...YMMV. From my point of view the hard part is not to get the RR Type registered, but used. See URI which was my last one. Patrik

May 14, 2025

Re: DNS extended

by Lars-Johan Liman

Hi Johan! OK, I stand corrected. Thanks for putting the me straight. Then maybe the good idea we (the IETF) had at the time – to make it simple to register new RR types – has fallen into implementation problems. Maybe it should be looked into. Out of curiosity: the RR type(s) you wanted to register – did they warrant "special processing" in the DNS servers? I.e., did they require altereted/new code paths in the servers, or were they simple data-carrying records to just be picked up from a shelf and shipped to the client? I guess my question is: do you see a difference between the two categories of records in how difficult it is to get a requst processed? Cheers, /Liman johan.stenstam(a)internetstiftelsen.se 2025-05-14 08:08 [+0000]: > Liman, >> And mind you: new record types are dirt cheap, and very easy to > create and register. 😉 > Umm… no. Cheap: yes. Easy to create: well, that obviously depends. > Very easy to register: no. > Been there, done that, carry the scars. In *theory* you’re absolutely > correct, but in practice… well you know the rest. > Johan

May 14, 2025