DNSSEC Workshop Dan York, Internet Society | ICANN 55 | March 2016

Remote Participation Slides and audio streams at: • https://meetings.icann.org/en/marrakech 55/schedule/wed-dnssec Live video stream via YouTube at: • http://bit.ly/dnssec55am • http://bit.ly/dnssec55pm | 2

Program Committee • Steve Crocker, Shinkuro, Inc. • Mark Elkins, DNS/ZACR • Cath Goulding, Nominet • Jean Robert Hountomey, AfricaCERT • Jacques Latour, CIRA • Xiaodong Lee, CNNIC • Luciano Minuchin, NIC.AR • Russ Mundy, SPARTA, A Parsons Company • Ond ř ej Sur ý , CZNIC • Yoshiro Yoneya, JPRS • Dan York, Internet Society • Julie Hedlund and Kathy Schnitt, ICANN | 3

Luncheon Sponsors • Afilias • CIRA • Dyn • SIDN • Opportunity for a fifth sponsor! | 4

DNSSEC Implementer’s Gathering Sponsors The Program Committee held a DNSSEC Implementers Gathering on 07 March sponsored by: | 5

DNSSEC Implementer’s Gathering Thanks to: Who can sponsor the gathering at ICANN 56? | 6

Support The DNSSEC Workshop and associated activities at ICANN are an organized activity of the: • ICANN Security and Stability Advisory Committee (SSAC) with additional assistance from the: • Internet Society Deploy360 Programme | 7

Program 0900-0915 – Presentation: Dan York, Internet Society – DNSSEC Workshop Introduction, Program, Deployment Around the World – Counts, Counts, Counts 0915-0930 – Presentation: Update on the ‘Sunset’ of the DNSSEC Look-aside Validation Registry (DLV) 0930-1030 – Panel Discussion: DNSSEC Activities in the African Region 1030-1045 – Coffee Break 1045-1115 – Presentation: Open DNSSEC SIGNER Switchover Experience 1115-1145 – Presentation: DNSSEC At Scale 1145-1200 – Great DNS/DNSSEC Quiz 1200-1315 – Lunch Break in Grand Bleu 1315-1415 – Panel Discussion: DNSSEC and Elliptic Curve Cryptography 1415-1500 – Panel Discussion: DNSSEC Root Key Signing Key (KSK) Rollover 1500-1515 – Presentation: DNSSEC - How Can I Help? | 8

DNSSEC Deployment Around the World: Counts, Counts, Counts Dan York, Internet Society | ICANN 55 | March 2016

The Two Parts of DNSSEC Signing Validating Registries Applications Registrars Enterprises DNS Hosting ISPs

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=0&r=0&w=7&r=1 11 | 11

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=0&w=7&r=1 12 | 12

http://stats.labs.apnic.net/dnssec/XB?o=cXHw7x1g1r1 13 | 13

http://stats.labs.apnic.net/dnssec/XB?o=cXHw7x1g1r1 14 | 14

https://rick.eng.br/dnssecstat/ 15 | 15

Note: Only includes the TLDs for which Rick Lamb can get statistics. (Example, .GOV is not listed.) https://rick.eng.br/dnssecstat/ 16 | 16

TLD DNSSEC Implementation Status Experimental – internal experiments Announced – Public commitment to deploy Partial – Zone is signed but not in operation DS in Root Operational – Accepting signed delegations | 17

Note About Operational Status Please let Dan York know if your ccTLD is now “Operational”: • Accepting DS records from signed zones Send updates to york@isoc.org Need your help as we have no automated way of knowing Operational status. | 18

Botswana - .BW December 2015 | 20

Azerbaijan - .AZ January 2016 | 21

Receiving the DNSSEC Deployment Maps The DNSSEC Deployment Maps are published via email every Monday morning through the Internet Society Deploy360 Programme. To subscribe, visit: www.internetsociety.org/deploy360/dnssec/maps/ | 25

DNSSEC Event Calendar New calendar to track DNSSEC/DANE-related events. Two views – event listing: https://www.dnssec-deployment.org/events/ Calendar view: http://www.dnssec-deployment.org/calendar/ Send event submissions to york@isoc.org | 26

IETF 95 Hackathon Sat/Sun, Apr 2/3 – Buenos Aires – IETF 95 • https://www.ietf.org/hackathon/95- hackathon.html • https://www.ietf.org/registration/MeetingWiki/wiki /95hackathon • Opportunity to work on new tools or services for DNSSEC / DANE / DNS Privacy • Join us! | 27

DNSSEC History Project The DNSSEC History Project is an ongoing project to collect and record the history of the work that went into bringing about the deployment of DNSSEC. To view – or to contribute – please see: https://wiki.tools.isoc.org/DNSSEC_History_Project | 28

Thank you and Questions Dan York, Internet Society | ICANN 55 | March 2016

DNSSEC Workshop Dan York, Internet Society | ICANN 55 | March 2016 - PowerPoint PPT Presentation

DNSSEC Workshop Dan York, Internet Society | ICANN 55 | March 2016 Remote Participation Slides and audio streams at: https://meetings.icann.org/en/marrakech 55/schedule/wed-dnssec Live video stream via YouTube at:

DNSSEC in .at (and beyond) Panel discussion DNSSEC activities in Europe DNSSEC workshop

DNSSEC activities @ nic.at Panel discussion DNSSEC activities in Europe DNSSEC workshop

Deploying New DNSSEC Algorithms ICANN 53 DNSSEC Workshop June 24, 2015 Buenos Aires, Argentina

Challenges To Deploying New DNSSEC Algorithms ICANN 55 DNSSEC Workshop March 8, 2016 Marrakech,

Deployment of DNSSEC at .ee ICANN 49: DNSSEC Workshop Timo Vhmar | 26.03.2014 | Introduction

DNSSEC Workshop @ ICANN Activities from the Region: - DNSSEC deployment in .pt 23 June 2010

.SE-DNSSEC Commercial launch of .SE-DNSSEC Feb 16, 2007 Signing Soft launch of service the

DNS Operator Role Bootstrapping DNSSEC Chain of Trust Update since ICANN53 Buenos Aires ICANN54

DNSSEC CS 161: Computer Security Prof. David Wagner April 11, 2016 DNSSEC Last lecture, you

DNSSEC Trust Anchor Repositories (TAR) Update Russ Mundy Co-Chair DNSSEC Deployment Initiative

An Overview of DNSSEC Cesar Diaz cesar@ lacnic.net 1 DNSSEC??? The DNS Security

Update on .GOV Matt Larson, VP, Office of the CTO, Verisign DNSSEC Workshop, ICANN 45,

.ke DNSSec Update Toilem Poriot Godwin .ke DNSsec update Update on what .ke registry

DNSSEC for Legacy Applications - POC Presenter: Sara Dickinson (Sinodun) Allison Mankin, Gowri

DNSSEC Workshop San Jos, Costa Rica ICANN Meeting 14 March 2012 1 Program Committee

13 Things to Consider Before DNSSEC John Kristoff jtk@cymru.com FIRST 2010 John Kristoff

DNS and DNSSEC Management and Monitoring Changes Required During A Transition To DNSSEC Wes

DNS Workshop @CaribNOG12 Mark Kosters Carlos Martnez {ARIN, LACNIC} CTO DNS Refresher and

DNSSEC security without maintenance ... with the right software and registry Petr paek

DNSSEC Workshop Singapore ICANN Meeting 22 June 2011 1 Program Committee Steve Crocker,

DNSSEC Workshop Silicon Valley ICANN Meeting 16 March 2011 1 Program Committee Markus

DNSSEC usage sta-s-cs and some observa-ons SEE 5, Tirana Sergey Myasoedov 20.4.2016 DNSSEC

Measuring DNSSEC using RIPE Atlas Kaveh Ranjbar RIPE NCC RIPE Atlas Coverage RIPE Atlas 2

DNSSEC at Scale Dani Grant | DNS @ CloudFlare CloudFlare - Authoritative DNS provider (includes