DNSSEC Testbed for Germany

In June 2009, DENIC launched a joint testbed for the Domain Name Security Extensions (DNSSEC) together with the Federal Agency for Security in Information Technology (BSI) (now: Federal Office for Information Security) and the Association of the German Internet Economy eco e.V. (now: eco - Association of the Internet Industry) in order to evaluate the potential effects of DNSSEC if introduced for .de domains. The purpose of DNSSEC is to close security holes in the Internet, such as cache poisoning, DNS redirection and DNS spoofing. Testbed participants had the opportunity to gain technical and operational experience in a test environment and to find out the impacts DNSSEC was going to have on security and reliability on the Internet. The project goal was to rule out operational risks of DNSSEC at an early stage and to find out about user acceptance. The testbed infrastructure was maintained until July 2011, when it was finally shut down.

DNSSEC Testbed Meetings

Final Meeting Will Take Stock

The fifths and last DNSSEC testbed meeting was held on 8 February 2011. With this meeting, the DNSSEC testbed initiated by the Federal Agency for Security in Information Technology (BSI), the Association of the German Internet Economy (eco) and DENIC was concluded.

The testbed offered the opportunity to collect operational and technical experience, to assess risks and to find out about user acceptance. The previous meetings informed in detail about these aspects and discussed and solved many pending questions. At the final meeting, the initiators gave a concise summary and DENIC presented its plans for implementing DNSSEC in the praxis. As starting date for DNSSEC the 31 May 2011 was announced.

DNSSEC Testbed Final Report

Final Report (in German)

Presentations

Agenda

  • DNSSEC@DENIC: Current Status in the Testbed
    Peter Koch / Marcos Sanz Grossón, DENIC eG

  • Experience Report of a Testbed Participant
    Andreas Schulze, DATEV eG

  • DNSSEC in the Global Context: Current Status
    Thorsten Dietrich, BSI

  • Validation of DNSSEC under MS Windows
    Carsten Strotmann, Men & Mice

  • Tools & Emerging Services all around DNSSEC:

    • Nominum DNSSEC Packs – Ralf Weber, Nominum Inc.
    • GSLB / Global Service Loadbalancing – Ralf Brünig, F5 Networks GmbH
    • Nixu NameSurfer Suite – Jürgen Joswig & Toni Lampela, Nixu Ltd.
    • Exanames – Kariem Hussein & Wolfgang Nagele, Exabit GmbH
    • OpenDNSSEC – Carsten Strotmann, Men & Mice
    • The Infoblox DNSSEC Solution – Dominic Stahl, Infoblox Inc.

Meeting Programme (in German)

Presentations

Live Videos of the Event

Agenda

  • DNSSEC@DENIC: Testbed "Halftime"
    Peter Koch / Marcos Sanz Grossón, DENIC eG

  • Participation in the Testbed and Measurements Relating to NSEC3: An Experience Report
    Florian Obser, Hostserver GmbH

  • DNSSEC in the Leibniz Data Center
    Bernhard Schmidt, LRZ – The data center for Munich's universities and for the Bavarian Academy of Sciences)

  • DNSSEC Introduction of "bund.de"
    Thorsten Dietrich, Federal Agency for Security in Information Technology

  • DNSSEC as a Safety Means within the FRITZ!Box Home Router Network
    Martin Duzy, AVM GmbH

  • Signing of the Root Zone: Finals have Begun
    Peter Koch, DENIC eG

  • DNSSEC@Earth: Seeing the "Big Picture"
    Carsten Strotmann, Men & Mice

  • Software Support for DNSSEC
    Ralf Weber, Nominum Inc.

  • DNSSEC from a Registrar's Point of View
    Volker Janzen, InterNetX GmbH

  • Domain Transfer with DNSSEC
    Samuel Benz, SWITCH – Serving Swiss Universities

Meeting Programme (in German)

Synopsis (in German)

Presentations

Live Videos of the Event

Agenda

  • Introduction and current status of DNSSEC (optional)
    Peter Koch, DENIC

  • Welcome
    Sabine Dolderer, DENIC

  • Presentation of the DNSSEC testbed at DENIC
    Peter Koch / Marcos Sanz Grossón, DENIC

  • Around the world with DNSSEC: The status in other TLDs
    Hans Peter Dittler, BRAINTEC Netzwerk-Consulting

  • DNSSEC in Switzerland: Initial experiences in productive operation
    Samuel Benz, SWITCH

  • DNSSEC support via home routers
    Thorsten Dietrich, BSI

  • Signing the root zone
    Wolfgang Nagele, RIPE NCC

  • DNSSEC zone management with the open source tool ZKT
    Holger Zuleger, HZNET

Meeting Programme (in German)

Presentations

Live Videos of the Event

Agenda

  • Welcome address
    BSI

  • Presentation of the project and schedule
    Sabine Dolderer

  • Background and introduction to DNSSEC
    Hans Peter Dittler

  • DNSSEC for .de – Presentation of the test environment and setup
    Dr Jörg Schweiger

  • DNSSEC for an ISP/registrar – What does an ISP/registrar need to do to make its infrastructure DNSSEC-ready and participate in the testbed
    Ralf Weber, COLT

  • DNSSEC for network access devices – To what extent do access software/routers already support DNSSEC? Presentation of study
    BSI

  • Discussion and Q&A session on the topic of DNSSEC testbed for .de
    moderator: Thomas Rickert

Presentations

Introduction of DNSSEC for the .de zone

The introduction of DNSSEC for the .de zone was based on the DURZ procedure for the root zone. The DUdeZ (deliberately unvalidatable DE zone) contained DS records based on the key signing keys (KSKs) stored in the registration system and was also fully signed in all other respects. However, the DNSKEY RRs were replaced by those with the same key tag that explicitly did not allow validation. This data was gradually supplied to the 16 name server locations.

For reasons of internal consistency of processes, DENIC had already published the DS records for the key signing keys of second-level domains registered to date in the unsigned .de zone for a short transition period and then as part of the DUdeZ. This affected approximately 180 participants in the test phase preceding the introduction, known as the DNSSEC testbed. These records were unusable because they were not signed, but otherwise harmless, as the common validating resolvers only make requests for DS records if there is a prospect of success.

On 31 May 2011 – the official launch date of DNSSEC – the DNSKEY RRSet was published and the DS RR was sent to IANA. This DS RR appeared in the root zone for the first time on 7 June 2011. Since then, it has been possible to validate .de domains.

Further Links and Documents

Bundesamt für Sicherheit in der Informationstechnik - BSI

Verband der Internetwirtschaft -eco