June 2017 - ksk-rollover - lists.icann.org

Windows Server 2016 Accelerated DNSSEC Root Rollover HowTo
by Richard Lamb June 26, 2017

June 26, 2017

Given the Infoblox note on this list and recently being (pleasantly) surprised by my students at the number of Windows DNS resolver installations out there considering DNSSEC, I felt the need to run through the exercise of stress testing Win Server 2016 DNS against accelerated RFC5011 rollover https://icksk.dnssek.info/fauxroot.html (did Win Server 2012 R2 a while back). The platform follows the root key rollover steps in a continuous accelerated fashion and has been operation since 2015 testing against various resolvers specially configured to work with accelerated RFC5011. RESULT: I saw no problems with Windows Server 2016 out of the box. The DNS server properly tracked continual accelerated root key rolls (ever 27 minutes) with no validation failures and keys recorded in C:\windows\system32\dns\rfc5011.csv. I know this should not be new info but just call me cautious. The steps I took are at https://icksk.dnssek.info/w2k16howto.html if you want to replicate. Hope it helps. -Rick

2 2

Infoblox does not support RFC5011
by Lagerholm, Stephan June 21, 2017

June 21, 2017

Hi , About a week or so ago I got a notification email from Infoblox that they do not support RFC5011. They are referring to a Knowledge base article on their site on how to enable the new key in the products, see below. I know that Infoblox is a common product in the marketplace. It worries me that some of their customers will not get/read/take action on the notification resulting in that resolution will start to fail on Oct 11th. Especially the US Govt. sector worries me as they have various mandates to implement DNSSEC but (based on my own experience and some speculation) sometimes lacks the skills and long term vision to maintain it properly. Is there any additional outreach or action that can be taken to make sure that the KSK rollover don't break Infoblox customers? Dear Customer, In 2016 the Internet Corporation for Assigned Names and Numbers (ICANN) announced<http://app.e.infoblox.com/e/er?s=953&lid=5086&elqTrackId=EDFAFB40787A8022D6…> a two-year execution plan for rolling the Root Zone Domain Name System Security Extensions (DNSSEC) KSK key. According to that plan, on October 11, 2017, a new KSK key will be used to sign the Root Zone DNSKEY resource record set (the actual rollover event). This requires an action on your part. Rolling the KSK key means generating a new cryptographic public and private key pair and distributing the new public component to parties who operate validating resolvers, including: Internet Service Providers; enterprise network administrators and other Domain Name System (DNS) resolver operators; DNS resolver software developers; system integrators; and hardware and software distributors who install or ship the root's "trust anchor." The KSK is used to cryptographically sign the Zone Signing Key (ZSK), which is used by the Root Zone Maintainer to DNSSEC-sign the root zone of the Internet's DNS. Maintaining an up-to-date KSK is essential to ensuring DNSSEC-validating DNS resolvers continue to function following the rollover. Failure to have the current root zone KSK will mean that DNSSEC-validating DNS resolvers will be unable to resolve any DNS queries which would lead to an outage. Currently Infoblox NIOS does not support "Automated Updates of DNS Security (DNSSEC) Trust Anchors" feature (RFC-5011) that automatically updates the key. Therefore, the new Root Zone KSK key must be manually updated on all DNSSEC validation enabled servers. Please refer to Infoblox Support KB # 5729<https://support.infoblox.com/app/utils/login_form/redirect/answers%252Fdeta…> for the ICANN plan details and steps to update the new Root Zone KSK key to prevent potential DNS resolution issues. Sincerely, Infoblox Support Team

2 1

The timing of publication of signatures by new KSK
by Ólafur Guðmundsson June 8, 2017

June 8, 2017

Dear Icann and Verisign, It is real important for Resolver operators to know when this happens as the publication time starts the clock on when validation failures begin. About 48 after last root server starts advertising the new DNSKEY closes the window of when last resolvers will start returning errors. Thus I request that ICANN + Verisign commit to publish the DNSKEY set signed by the new KSK on October 11'th at 12:00 UTC as that is the only time it is October 11'th everywhere in the world. This way we can know that all errors will be visible before 13:00 UTC on Oct 13'th, as over 99% of root servers load up new zone in less than an hour (I hope) Olafur

2 1