11th October: KSK Rollover time
On the 16th of September the ICANN board made the final decision to go forward with the Key-Signing-Key (KSK) Rollover in the root zone. After an earlier roll got cancelled, it is now set in motion again.
-
-
New major Zonemaster release
The Swedish Internet Foundation and Afnic have released a new major release of Zonemaster on 2018-05-25. Zonemaster is a DNS (Domain Name System) validation tool which aims to improve the security and resilience of the internet infrastructure.
-
Critical IT-services in focus at the DNS reference group
Increased robustness for critical municipal IT-services to prepare them for a major crisis, an update on the root KSK rollover and insight into the DNS architecture of Facebook were some of the topics at DNS reference group meeting in May.
-
Lessons learned from the .SE algorithm rollover
The Swedish Internet Foundation was the first TLD to sign their zone, but eventually you come to a point where an overhaul is needed. This is what we learned from that process.
-
Rolling, Rolling, Rolling...
Most probably by now you are tired of all the talk about rolling the root KSK. Yes, we are too! So, today we are not going to talk about that one.
-
The renaming of .nu
No, of course we won't change the name of the TLD, just the hostname of some of the name servers serving the .nu zone.
-
.SE KSK Algorithm Rollover
At The Swedish Internet Foundation we are very security concious. We were the first TLD in the world to sign their zone with DNSSEC. Being on the forefront of things is a nice feeling, but sometimes you get to feel the pain of it. Having signed so early means that at the time there was only one algorithm to use, RSA-SHA1. The security of SHA1 has been discussed in the community for some time now and even though there is no need for panic, there are more secure alternatives available today.
-
Remember, remember 11th of October
Let's talk Root KSK Rollover! If you run your own resolver at home, or at the office, you need to act now. Let us show you how.
-
Packet size and name server authorative zone
As preparation for the changing of keys used in the .se zone I have done some tests about packet sizes with different key sizes and algorithms. Currently the .se zone is signed by a 2048 bit Key Signing Key (KSK) and a 1024 bit Zone Signing Key (ZSK) both in RSA-SHA1 format.
-
Monitoring of IIS Anycast
In January 2017 The Swedish Internet Foundation started a new service "IIS Anycast". We offer our registrars a secondary DNS. We do this in cooperation with CIRA (the Canadian ccTLD Registry). Our secondary DNS is a DNS anycast network.
