- SSAC-Evo-Reso-WP - lists.icann.org

2023 ICANN DNS Symposium
by Andrew McConachie June 17, 2023

June 17, 2023

<https://www.icann.org/en/announcements/details/2023-icann-dns-symposium-to-…> > This year, ICANN will invite speakers to present on the integration and security of the Domain Name System (DNS) with emerging technologies, exploring the challenges and opportunities that this integration presents. The symposium invites researchers, developers, and operators to present on subjects including, but not limited to, blockchains, Internet of Things, and novel uses of the DNS, such as IP-to-location translation and blocklists. Looks relevant to this work party. —Andrew

2 1

Evolution of the DNS Resolution Work Party Meeting @ICANN77
by Kathy Schnitt June 10, 2023

June 10, 2023

SSAC Work Session (4 of 8) Date: Wednesday, 14 June 2023 17:45-19:00 UTC Room: Independence A/B/C Remote Participation Details: * Zoom Link: https://icann.zoom.us/j/92380368741?pwd=V0VxRFVkSGRFbHpGZk10N2lpKzJrUT09 Agenda: * Evolution of the DNS Resolution Work Party Meeting

1 0

Evolution of the DNS Resolution Work Party Meeting @ICANN77
by Kathy Schnitt June 10, 2023

June 10, 2023

SSAC Work Session (4 of 8) Date: Wednesday, 14 June 2023 17:45-19:00 UTC Room: Independence A/B/C Remote Participation Details: * Zoom Link: https://icann.zoom.us/j/92380368741?pwd=V0VxRFVkSGRFbHpGZk10N2lpKzJrUT09 Agenda: * Evolution of the DNS Resolution Work Party Meeting

1 0

Transcription from our meeting held on 1 Jun 2023 20:00 UTC
by Kathy Schnitt June 6, 2023

June 6, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 1 Jun 2023 20:00 UTC. Best, Kathy

1 0

New Text in Working Document
by Andrew McConachie June 5, 2023

June 5, 2023

Dear SSAC Members, Geoff and I have put some new text in the working document. <https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F…> -Old Section 5 moved to a new Section 9 -Three new paragraphs added to beginning of Section 3 -New paragraph in Section 4 -Significant edits made to the two paragraphs following the new paragraph in Section 4 -New text added to end of Sections 5.1, 5.2, and 5.4 -New Section 5.5 added The big chunks have been commented with “New Text” while the smaller chunks have been left as Suggestions. Thanks, Andrew

1 0

Our next SSAC Evo of Reso Work Party meeting is scheduled for 8 Jun 2023 20:00 UTC
by Kathy Schnitt June 2, 2023

June 2, 2023

Dear SSAC Evo of Reso Work Party, Our next work party meeting is scheduled for Thursday, 8 Jun 2023 20:00 UTC. Work Party Links: Working Document: https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F… Work Party Wiki: https://community.icann.org/display/ssac/Evolution+of+DNS+Resolution+Work+P… Participation Links: Zoom Link: https://icann.zoom.us/j/96832257588?pwd=c09UckZFY0FDMGVXaTNzQk42RUFoQT09Zoom Session ID: 968 3225 7588Zoom Session Passcode: 23!evoresoZoom International Dial-In Numbers: https://icann.zoom.us/u/adHPmmvQPoZoom Phone Passcode: 0712317359SSAC 2023 Calendar: https://calendar.google.com/calendar/ical/icann.ssac.calendar%40gmail.com/p… Best, Kathy

1 0

Our next SSAC Evo of Reso Work Party meeting is scheduled for 1 Jun 2023 20:00 UTC
by Kathy Schnitt May 29, 2023

May 29, 2023

Dear SSAC Evo of Reso Work Party, Our next work party meeting is scheduled for Thursday, 1 Jun 2023 20:00 UTC. Work Party Links: Working Document: https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F… Work Party Wiki: https://community.icann.org/display/ssac/Evolution+of+DNS+Resolution+Work+P… Participation Links: Zoom Link: https://icann.zoom.us/j/96832257588?pwd=c09UckZFY0FDMGVXaTNzQk42RUFoQT09Zoom Session ID: 968 3225 7588Zoom Session Passcode: 23!evoresoZoom International Dial-In Numbers: https://icann.zoom.us/u/adHPmmvQPoZoom Phone Passcode: 0712317359SSAC 2023 Calendar: https://calendar.google.com/calendar/ical/icann.ssac.calendar%40gmail.com/p… Best, Kathy

2 1

Transcription from our meeting held on 18 May 2023 20:00 UTC
by Kathy Schnitt May 26, 2023

May 26, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 18 May 2023 20:00 UTC. Best, Kathy

2 1

Our next SSAC Evo of Reso Work Party meeting is scheduled for 18 May 2023 20:00 UTC
by Kathy Schnitt May 19, 2023

May 19, 2023

Dear SSAC Evo of Reso Work Party, REMINDER: Our next work party meeting is scheduled for Thursday, 18 May 2023 20:00 UTC. Work Party Links: Working Document: https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F… Work Party Wiki: https://community.icann.org/display/ssac/Evolution+of+DNS+Resolution+Work+P… Participation Links: Zoom Link: https://icann.zoom.us/j/96832257588?pwd=c09UckZFY0FDMGVXaTNzQk42RUFoQT09Zoom Session ID: 968 3225 7588Zoom Session Passcode: 23!evoresoZoom International Dial-In Numbers: https://icann.zoom.us/u/adHPmmvQPoZoom Phone Passcode: 0712317359SSAC 2023 Calendar: https://calendar.google.com/calendar/ical/icann.ssac.calendar%40gmail.com/p… Best, Kathy

3 2

Transcription from our meeting held on 11 May 2023 20:00 UTC
by Kathy Schnitt May 17, 2023

May 17, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 11 May 2023 20:00 UTC. Best, Kathy

1 0

New Text for Review in Section 3
by Andrew McConachie May 17, 2023

May 17, 2023

Dear SSAC Members, Geoff has written a significant amount of new text in Section 3 of the document that we will be discussing in 30 minutes. <https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F…> —Andrew

1 1

regrets for today
by James Galvin May 11, 2023

May 11, 2023

Please note my apologies for today. Thanks, Jim

1 0

evo-reso call this week (4 May)
by Barry Leiba May 4, 2023

May 4, 2023

Last week we had only me, Jaap, and Geoff on the call, and the time was spend with Geoff and me discussing the direction of the document, with mostly Geoff talking. I agree with a good deal of what Geoff said, and the plan was to ask the work party members to listen to the recording and to discuss it on this week's call. Unfortunately, the recording has only now been posted, so there's not been time to have people listen yet. We will therefore CANCEL this week's call (4 May) and ask participants to use the time of the call to instead listen to last week's recording, to think about it, and to be prepared to discuss it next week (11 May). I hope we can have a good discussion of Geoff's suggestions and comments next week... so please do prioritize listening to the recording: https://drive.google.com/drive/u/0/folders/1WbUSW_XMHhO7iVZFomnMP_L9wqhEMnPT Thanks, Barry

3 2

Transcription from our meeting held on 27 Apr 2023 20:00 UTC
by Kathy Schnitt May 3, 2023

May 3, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 27 Apr 2023 20:00 UTC. Best, Kathy

1 1

Recording of April 27 2023 Call
by Steve Sheng May 3, 2023

May 3, 2023

Dear Evo of Resolution WP members, Please see below the recording of the 27 April 2023 call. https://drive.google.com/drive/u/0/folders/1WbUSW_XMHhO7iVZFomnMP_L9wqhEMnPT Best Steve

1 0

Transcription from our meeting held on 20 Apr 2023 21:00 UTC
by Kathy Schnitt April 26, 2023

April 26, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 20 Apr 2023 21:00 UTC. Best, Kathy

1 0

Our next SSAC Evo of Reso Work Party meeting is scheduled for 27 Apr 2023 20:00 UTC
by Kathy Schnitt April 26, 2023

April 26, 2023

Dear SSAC Evo of Reso Work Party, Our next work party meeting is scheduled for Thursday, 27 Apr 2023 20:00 UTC. Work Party Links: Working Document: https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F… Work Party Wiki: https://community.icann.org/display/ssac/Evolution+of+DNS+Resolution+Work+P… Participation Links: Zoom Link: https://icann.zoom.us/j/96832257588?pwd=c09UckZFY0FDMGVXaTNzQk42RUFoQT09Zoom Session ID: 968 3225 7588Zoom Session Passcode: 23!evoresoZoom International Dial-In Numbers: https://icann.zoom.us/u/adHPmmvQPoZoom Phone Passcode: 0712317359SSAC 2023 Calendar: https://calendar.google.com/calendar/ical/icann.ssac.calendar%40gmail.com/p… Best, Kathy

3 2

Time change for future evo-reso meetings
by Barry Leiba April 21, 2023

April 21, 2023

Hey, all. As you may have seen from Kathy's reminder about next week's meeting, we have confirmed the time change for meetings beginning next week. The new time is one hour earlier than it has been, 20:00 UTC. Barry

1 0

Our next SSAC Evo of Reso Work Party meeting is scheduled for 20 Apr 2023 21:00 UTC
by Kathy Schnitt April 20, 2023

April 20, 2023

Dear SSAC Evo of Reso Work Party, Our next work party meeting is scheduled for Thursday, 20 Apr 2023 21:00 UTC. Work Party Links: Working Document: https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F… Work Party Wiki: https://community.icann.org/display/ssac/Evolution+of+DNS+Resolution+Work+P… Participation Links: Zoom Link: https://icann.zoom.us/j/96832257588?pwd=c09UckZFY0FDMGVXaTNzQk42RUFoQT09Zoom Session ID: 968 3225 7588Zoom Session Passcode: 23!evoresoZoom International Dial-In Numbers: https://icann.zoom.us/u/adHPmmvQPoZoom Phone Passcode: 0712317359SSAC 2023 Calendar: https://calendar.google.com/calendar/ical/icann.ssac.calendar%40gmail.com/p… Best, Kathy

3 2

Transcription from our meeting held on 13 Apr 2023 21:00 UTC
by Kathy Schnitt April 18, 2023

April 18, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 13 Apr 2023 21:00 UTC. Best, Kathy

1 0

Time for Evo-Reso WP meetings
by Barry Leiba April 14, 2023

April 14, 2023

We currently have the Evo-Reso meetings at 21:00 UTC. We would like to change the time to 20:00 UTC, one hour earlier. Those on today's meeting thought that was fine, but I wanted to check on the list: does anyone have an objection to the change? The next meeting will be on 20 April at 21:00 UTC, with no time change. But if we don't hear objections by then we will change the time going forward to 20:00 UTC beginning on 27 April. Please respond here if you have comments. Thanks, Barry

1 0

Our next SSAC Evo of Reso Work Party meeting is scheduled for 13 Apr 2023 21:00 UTC
by Kathy Schnitt April 13, 2023

April 13, 2023

Dear SSAC Evo of Reso Work Party, Our next work party meeting is scheduled for Thursday, 13 Apr 2023 21:00 UTC. Work Party Links: Working Document: https://docs.google.com/document/d/1_eOj_csXgOi3hzkobsY6SgA7b4CcMPhTLKvQ_8F… Work Party Wiki: https://community.icann.org/display/ssac/Evolution+of+DNS+Resolution+Work+P… Participation Links: Zoom Link: https://icann.zoom.us/j/96832257588?pwd=c09UckZFY0FDMGVXaTNzQk42RUFoQT09Zoom Session ID: 968 3225 7588Zoom Session Passcode: 23!evoresoZoom International Dial-In Numbers: https://icann.zoom.us/u/adHPmmvQPoZoom Phone Passcode: 0712317359SSAC 2023 Calendar: https://calendar.google.com/calendar/ical/icann.ssac.calendar%40gmail.com/p… Best, Kathy

2 1

Transcription from our meeting held on 6 Apr 2023 21:00 UTC
by Kathy Schnitt April 12, 2023

April 12, 2023

Dear SSAC Evo of Reso Work Party, Attached is the transcription from our meeting held on 6 Apr 2023 21:00 UTC. Best, Kathy

1 0

Fwd: dns-operations Digest, Vol 206, Issue 7
by Andrew McConachie March 30, 2023

March 30, 2023

This is a followup to the mail Rod sent to the list on March 14. Basically they increased the number of times a UDP src port can be reused from 2 to 3. Thereby reducing the probability of Chrome switching to TCP. —Andrew > Begin forwarded message: > > From: Adam Casella <acasella(a)infoblox.com> > Subject: Re: dns-operations Digest, Vol 206, Issue 7 > Date: 29 March 2023 at 23:03:28 CEST > To: "dns-operations(a)dns-oarc.net" <dns-operations(a)dns-oarc.net>, "dns-operations(a)lists.dns-oarc.net" <dns-operations(a)lists.dns-oarc.net> > > Just following up on this. This issue was narrowed down to a need to increase the entropy threshold on Chrome’s DNS source port logic on Windows 10 and 11 to prevent the built-in DNS client from falling back to TCP. This impacts all Chromium based browsers and the fix can be found here: > > Chrome Bug tracking this issue: > > https://bugs.chromium.org/p/chromium/issues/detail?id=1413620 [bugs.chromium.org] <https://urldefense.com/v3/__https://bugs.chromium.org/p/chromium/issues/det…> > > Fix (a one-liner) can be found here: > > https://chromium.googlesource.com/chromium/src/+/59d686c1417b5aea7b1d94a28b… [chromium.googlesource.com] <https://urldefense.com/v3/__https://chromium.googlesource.com/chromium/src/…> > > This looks like the fix will be added in Chrome 112 or 113. > > Thanks, > > Adam Casella | Solutions Architect > Infoblox | infoblox.com <http://infoblox.com/> > 914.953.8571 > > From: dns-operations <dns-operations-bounces(a)dns-oarc.net <mailto:dns-operations-bounces@dns-oarc.net>> on behalf of dns-operations-request(a)dns-oarc.net <mailto:dns-operations-request@dns-oarc.net> <dns-operations-request(a)dns-oarc.net <mailto:dns-operations-request@dns-oarc.net>> > Date: Friday, March 17, 2023 at 5:02 AM > To: dns-operations(a)lists.dns-oarc.net <mailto:dns-operations@lists.dns-oarc.net> <dns-operations(a)lists.dns-oarc.net <mailto:dns-operations@lists.dns-oarc.net>> > Subject: dns-operations Digest, Vol 206, Issue 7 > > !-------------------------------------------------------------------| > This Message Is From an External Sender > This message came from outside your organization. > |-------------------------------------------------------------------! > > Send dns-operations mailing list submissions to > dns-operations(a)lists.dns-oarc.net <mailto:dns-operations@lists.dns-oarc.net> > > To subscribe or unsubscribe via the World Wide Web, visit > https://urldefense.com/v3/__https://lists.dns-oarc.net/mailman/listinfo/dns… <https://urldefense.com/v3/__https:/lists.dns-oarc.net/mailman/listinfo/dns-…> > or, via email, send a message with subject or body 'help' to > dns-operations-request(a)lists.dns-oarc.net <mailto:dns-operations-request@lists.dns-oarc.net> > > You can reach the person managing the list at > dns-operations-owner(a)lists.dns-oarc.net <mailto:dns-operations-owner@lists.dns-oarc.net> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of dns-operations digest..." > > > Today's Topics: > > 1. Re: Increase in DNS over TCP from Chrome Browser on Windows > 11 (David Zych) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 16 Mar 2023 11:57:00 -0500 > From: David Zych <dmrz(a)illinois.edu <mailto:dmrz@illinois.edu>> > To: "dns-operations(a)lists.dns-oarc.net <mailto:dns-operations@lists.dns-oarc.net>" > <dns-operations(a)lists.dns-oarc.net <mailto:dns-operations@lists.dns-oarc.net>> > Subject: Re: [dns-operations] Increase in DNS over TCP from Chrome > Browser on Windows 11 > Message-ID: <13b9d8bc-55d3-a069-d907-299b8dad9d53(a)illinois.edu <mailto:13b9d8bc-55d3-a069-d907-299b8dad9d53@illinois.edu>> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 3/15/23 11:29, Adam Casella wrote: > > It seems that Chrome is leveraging 1 TCP session per DNS query to prevent tracking of the DNS traffic, which unfortunately does not take advantage of TCP pipelining/multiplexing or out-of-order TCP DNS responses over a single TCP stream. > > Hi Adam, thanks for sharing this! > > We definitely noticed a dramatic increase in TCP DNS requests circa Mon 2022-11-07, for which I'm grateful to finally have a plausible explanation. > > The use of 1 TCP session per query is especially significant because our recursive resolvers have iptables rules designed to prevent them from being monopolized by a single misbehaving client, which includes limiting the number of parallel inbound 53/tcp connections per client IP. The sudden increase in throttling by that particular iptables rule was quite a surprise. > > Thanks, > David > > -- > David Zych (he/him) > Lead Network Service Engineer > > University of Illinois Urbana-Champaign > Office of the Chief Information Officer > Technology Services > > Under the Illinois Freedom of Information Act any written communication to or from university employees regarding university business is a public record and may be subject to public disclosure. > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > dns-operations mailing list > dns-operations(a)lists.dns-oarc.net <mailto:dns-operations@lists.dns-oarc.net> > https://urldefense.com/v3/__https://lists.dns-oarc.net/mailman/listinfo/dns… <https://urldefense.com/v3/__https:/lists.dns-oarc.net/mailman/listinfo/dns-…> > > > ------------------------------ > > End of dns-operations Digest, Vol 206, Issue 7 > **********************************************

1 0

Fwd: [dns-operations] Increase in DNS over TCP from Chrome Browser on Windows 11
by Rod Rasmussen March 14, 2023

March 14, 2023

This came in on the DNS Ops list. Seems like both an interesting potential problem, but also something that is rather pertinent to our work on this WP. Will be interesting to see how this issue evolves! > Begin forwarded message: > > > Hey Folks, > > Has anyone else seen an increase in DNS over TCP traffic in their environment? We have been seeing a steady increase since late last year and have believe we have narrowed down a major cause. After reaching out to the Chromium folks and Cricket Liu reaching out to the Microsoft folks it seems that there has been a recent behavior change that is incompatible with each other, which is causing DNS over TCP to be preferred over UDP. > > Based on my discussion with the Chromium team, It appears that for about 3 years Chrome has a bit of internal logic around falling back to TCP when there is a detection of reduced UDP port entropy being handed out by the OS. When the Chrome stack falls back to TCP, according to the Chromium folks, it will continue to use TCP until Chrome is restarted or there is a network change (port flap, IP address change, etc). The code that tracks the low entropy can be found here net::DnsUdpTracker <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?…>. > > The Chromium folks confirmed that they are seeing an increase of TCP traffic from Windows client only. Crickey Liu reach out to the Microsoft folks and dfound that starting with Windows 11, the OS began to use socket caching due to exhaustion occurring with UDP ports. Meaning that DNS UDP port is cached when communicating with the same server and any DNS client will continue to get the same UDP src-port when connecting to that DNS server. Now starting in Chrome 105, there was a change made by the Chromium folks to leverage the internat Chrome DNS stack to to run more Windows DNS queries through the Chrome stack instead of delegating the resolutions to the OS. Due to the low UDP port entropy logic discussed above in combination to the socket caching introduced Windows 11, we are seeing DNS clients preferring TCP over UDP for what seemed like to discernable reason until these discussions with the Chromium and Microsoft folks. > > From our perspective this is and will cause a lot of issues for DNS providers as more and more Chrome + Windows clients begin to prefer TCP over UDP for DNS. And believe this has the potential to quickly become a rather large issue for DNS providers, especially at scale. > > Is anyone here seeing a seemingly unexplained increase in DNS over TCP traffic and if it is causing any issues within their network? > > For reference, Google Chrome version 105 was released on August 30th, 2022 and Windows 11 was released on October 5th, 2021. Only with the combination of the two (post August 30th, 2022) would the issue be seen. > > Thanks, > > Adam Casella | Solutions Architect > Infoblox | infoblox.com <http://infoblox.com/>

1 0