Just a guy in Vermont trying to connect all the dots...
Dan York
Author's posts
Feb 09
InterContinental Toronto Centre
InterContinental Toronto Centre225 Front Street W., Toronto, ON, Canada
Feb 09
Sheraton Libertador
Sheraton LibertadorAvenida Córdoba 690, Capital Federal, CP C1054AAS, Buenos Aires,
Feb 09
IPv6exchange.net Aims To Provide Q&A-Style Forum For IPv6 Discussion
Looking to post a specific IPv6 question and receive an answer? Or looking to see what kinds of questions people are asking about IPv6? If so, the folks at Network Revolution, an IPv6 consultancy based in London, have set up a web forum at ipv6exchange.net where people can ask IPv6 questions and receive answers from others in the community. They’re seeking to make it a member-driven community where people can collectively build up a knowledgebase of information related to IPv6. While I’ve not yet set up my own free account to join the discussions, it does look like a useful resource and as we approach World IPv6 Launch on June 6 it is great to see more and more resources like this coming online!
Feb 09
DNSSEC HOWTO, a tutorial in disguise
Looking for a comprehensive guide to what DNSSEC is all about? If so, Olaf Kolkman and the team at NLnet Labs have created and maintained for many years now the extremely detailed “DNSSEC HOWTO, a tutorial in disguise.” You can find it at:
It is available as both a web page and as a PDF for download.
The document was last updated in July 2009, which unfortunately means that it pre-dates the signing of the root zone in July 2010 and therefore does not truly represent the current state of affairs with regard to DNSSEC. However, the document is still an excellent resource for anyone looking to learn more about DNSSEC in general.
The HOWTO is a long document that covers a great range of material related to DNSSEC. As Olaf Kolkman writes in the beginning, the document includes:
Part I, intends to provide some background for those who want to deploy DNSSEC.Part II, about the aspects of DNSSEC that deal with data security.
- Creating an island of security (Chapter 2, ”Configuring a recursive name server to validate answers” and Chapter 3, ”Securing a DNS zone”) by configuring a recursive name server to validate the signed zones served by your organisations authoritative name servers. When you have learnt and implemented this, you can be sure that DNS data in your organisation is protected from change. Once you have created an island of security it is a small step to become part of a chain of trust.
- Delegating signing authority; building a chain of trust (Chapter 4, ”Delegating of signing authority; becoming globally secure”). You will learn how to exchange keys with your parent and with your children.
- Chapter 5, ”Rolling keys” covers maintaining keys and ensuring that during the rollover process clients will be able to maintain a consistent view of your DNS data.
- Part IV, covering aspects that deal with server to server security and transaction security.
- Chapter 9, ”Securing zone transfers” is on the use of transaction security (TSIG) to provide authorisation and integrity for zone transfers.
Part III, describes a few tools that may turn out handy while figuring out what might have gone wrong.
We understand that the NLnet Labs team would like to update the document and would welcome any contributions of time to help bring the document up-to-date. If you are interested, we suggest you contact NLnet Labs at labs@nlnetlabs.nl.
Feb 09
Deploy360 Team
The Internet Society team that supports the Deploy360 Programme includes:
- Richard Jimmerson, Director, Deployment & Operationalization
- Dan York, Senior Content Strategist
- Megan Kruse, Outreach Manager
The team monitors email and social media channels and welcomes any communication about the programme.
Feb 08
DNSSEC-Tools Project
The goal of the DNSSEC-Tools Project is “to create a set of software tools, patches, applications, wrappers, extensions, and plugins that will help ease the deployment of DNSSEC related technologies.” The project website is at:
There you will find information about the available tools, tutorials, installation information and of course the actual DNSSEC tools available for download in a number of different formats for different operating systems.
The available DNSSEC tools can be broken down into the following categories:
- Zone Administration Tools
- Authoritative Domain Name Server Tools
- Recursive Domain Name Server Tools
- Application/Script Writers
- End Users (patches to add DNSSEC support to applications like Firefox, sendmail, jabberd, etc.)
- DNS Error Checking Tools
- DNSSEC Management Tools
The DNSSEC-Tools Project is open to public participation and operates a wiki full of documentation a number of public mailing lists, a public bug tracker, and a Subversion/SVN repository.
Feb 08
DNSSEC-Tools 1.12.1 Released – New DNSSEC apps, updated tools, Android support, more…
The DNSSEC-Tools Project today announced the release of DNSSEC-Tools version 1.12.1 with a range of new DNSSEC applications, updates to a number of tools and porting of the DNSSEC validator library to the Android platform.
The new release can be downloaded in various forms from:
The release announcement mentions these new features and capabilities:
- A new and improved DNSSEC-check utility with a completely re-written GUI and support for a number of platforms including Android and Harmattan (N9) devices.
- dnssec-nodes now parses unbound log files
- dnssec-system-tray now parses unbound log files
- rollerd
- Added support for phase-specific commands in rollerd. This allows the zone operator to customize processing of the rollerd utility during different rollerd phases.
- Added support for zone groups in rollerd. This allows a collection of zones to be controlled as a group, rather each of those zones individually.
- Improved the manner in which rollerd indexes the zones being managed, with the significantly decreased access times for rollerd’s data files. This results in rollerd being able to support a lot more zones with a single rollerd instance.
- rollctl and the rollover GUI programs may have new commands to allow for immediate termination of rollerd.
- New DNSSEC-capable applications
- Added a patch to enable DNSSEC validation in Qt based applications
- Added patch to enable local validation in NTP, with the ability to handle a specific chicken and egg problem related to the interdependency between DNSSEC and an accurate system clock.
- Validator library:
- The library has been ported to the Android OS
- Added support for hard-coding validator configuration information that gets used in the absence of other configuration data. This feature allows the validator library to be self-contained in environments where setting up configuration data at specific locations in the file system is not always feasible.
It’s very cool to see these new features added and we look forward to seeing what developers build with these new capabilities!
P.S. The DNSSEC-Tools project also seems to have a brand new Twitter account, @DNSSECTools, that could use some followers! 
