Comments on: DNSSec – And Why the Internet Probably Won’t Break Today.

By: DNSSEC unlikely to break Internet on May 5 « AccuBlog

DNSSEC unlikely to break Internet on May 5 « AccuBlog — Thu, 06 May 2010 12:51:53 +0000

[...] DNSSec – And Why the Internet Probably Wonít Break Today (Etherealmind.com) [...]

By: Everything is a Freaking DNS problem

Everything is a Freaking DNS problem — Wed, 05 May 2010 17:43:30 +0000

Today everything could have been a freaking dnssec problem…

You might have read about it .. al over the internets. but today a big step for the implementation of global DnsSec implementation is being made . You might want to read up about the impact. And test here if you are unsure about your situation. Tech…

By: DNSSEC unlikely to break Internet on May 5 | TR Dojo | TechRepublic.com

Wed, 05 May 2010 02:56:40 +0000

[...] DNSSec – And Why the Internet Probably Won’t Break Today (Etherealmind.com) [...]

By: ProblÈma lehet egyes helyeken a DNS-sel m·jus 5-Èn - NLG-System – BEL¸gyek

ProblÈma lehet egyes helyeken a DNS-sel m·jus 5-Èn - NLG-System – BEL¸gyek — Tue, 04 May 2010 09:29:00 +0000

[...] RÈszletek: Warning: Why your Internet might fail on May 5 Will DNSSEC kill your internet? DNSSec?ó?and Why the Internet Probably Wonít Break Today [...]

By: adam

adam — Tue, 27 Apr 2010 02:24:30 +0000

as a follow up to my first question: if a resolver that is forwarding to another dns server fails the RIPE test, will it necessarily fail to resolve anything after may 4 or any of the other upcoming implementation deadlines? and you say little needs to be done in the short term… what about the long term?

thanks.

By: adam

adam — Tue, 27 Apr 2010 02:06:31 +0000

it took a lot of googling on this subject to find this… thanks.

so if i am using a good forwarder (opendns, perhaps my isp), my dns server will get a response that includes an authenticated flag… my concern is that if the dns server does not understand that flag, it will fail not because it is too large to pass throught the network infrastructure but because the dns server does not know how to interpret this new and improved response… is that a rational concern? or is everyone that is forwarding ok as long as they are forwarding to a dns server that can perform the auth?

i tried the ripe tool (replysizetest-1.1.jar) on one windows 2003 dns server. the first time it said, edns=disabled, dnssec=disabled, could not pass large udp. then i ran “dnscmd /config /enableednsprobes 1″. i ran the tool again and it said edns=enabled, dnssec=disabled, could pass large udp (yeah!). is this server safe to use root hints even though dnssec is not enabled?

thanks in advance for giving this post any consideration at all

By: danhughes

danhughes — Thu, 15 Apr 2010 10:16:38 +0000

It seems that most ISP resolvers I could find didn’t.. To the point where I was starting to think it was either me, or my testing methodology was wrong. Lot of relief when I found one which gave the response I was looking for..

I think that fact probably tells us how far along this whole project is. It’s something we need to keep an eye on, but no need to panic yet

By: Dylan

Dylan — Thu, 15 Apr 2010 10:04:13 +0000

Yay! – some clear and helpful information on this issue. I started to investigate after I saw the article on ‘theregister’ mentioned in the article. Now I understand that there are 2 protocols (DNS & EDNS) and that there are DNS servers that understand EDNS. Unfortunately my ISPs DNS, nor Google’s seem to support EDNS (at least not yet).

Thanks

Dylan