DNS

DNS-over-QUIC in Unbound

By Wouter Wijngaards, with contributions from Yorgos Thessalonikefs DNS-over-QUIC (DoQ) uses the QUIC transport mechanism to encrypt queries and responses. The DoQ transport for DNS is defined in RFC 9250. With the recent release, Unbound can be configured to support DoQ clients downstream. This feature is not a standard component

Policy

Supply chain security obligations for NIS2 regulated entities vs. developers of open source software

How do supply chain security obligations under the European NIS2 legislation affect those that develop the Free and Open Source Software used by "essential providers" of digital infrastructure? An overview of the response to the public comment period to the NIS2 draft implementing act.

Policy

Tracking CRA implementation for Free and Open Source Software and its Stewards

Active engagement on the Cyber Resilience Act helped to change the outcome of the negotiations for FOSS. With final text expected this fall, our focus is shifting towards CRA implementation. This includes collaborating on the "open-source software steward" role in a working group at Eclipse.

Newsletter

Introducing new DNS Diagnostics Tooling

In this DNS-centric edition of “Of Trees and Tries” we’re excited to share what we’ve been working on over the last few months. Before we get started, we have something special to share. Frances Brazier, legendary computer scientist and one of the founders of NLnet Labs, received a

Newsletter

The Spring 2024 Newsletter

Welcome back to our newsletter “Of Trees and Tries”. In this spring edition, we’re excited to share what we’ve been working on and what’s coming up in the world of open-source, open standards and tech policy. DNS Benno and Alex started the year by sharing our thoughts

Dev

NLnet Labs 💞 Packagers

We are at our best when we can focus on Internet protocols and building elegant implementations in software. That is why we love it when others help out with packaging and distributing our software. And, on February 14th, it feels appropriate to express some love and appreciation for the many

Policy

What I learned in Brussels: the Cyber Resilience Act

Last weekend I co-organised an EU policy devroom at FOSDEM, marking the end of a wild ride in EU policy land working on the Cyber Resilience Act. In this post I want to contribute to a shared understanding of how the CRA will most likely affect developers of open source

DNS

The Sovereign Tech Fund Bolsters Our Sustainable Open-Source Efforts

This year, NLnet Labs will celebrate its 25th anniversary. For two and a half decades, we have stayed true to our founding principle to offer free, open-source, liberally licensed software to support core Internet infrastructure.  Throughout 2024, the Sovereign Tech Fund will support the development of one of our projects,

DNS

Domain – DNS Building Blocks for Application Developers

In the previous article of this series, we presented our vision for DNS for the coming five years. In this post, we'll outline this year's milestones for expanding the domain crate, our Rust library serving as a collection of building blocks to include components of the

DNS

The Next Five Years of DNS at NLnet Labs

2024 marks 25 years of NLnet Labs. We have delivered on our mission to make the domain name system (DNS) more dependable and trustworthy, and we are full of ambitions for the future.  DNS standards and operations have evolved significantly in the last decades as technology advances and increasingly sophisticated

Newsletter

Destination: Brussels – Navigating the Open-Source Waters

In this newsletter all of our open-source efforts are headed for Brussels. The European Commission received our feedback on the proposed Cyber Resilience Act and we'll be presenting on these efforts at FOSDEM, the Brussels-based event centered on free and open-source software development. While we're there,

RPKI

Running Krill Under RIPE NCC

When using RPKI in the RIPE NCC service region you have the choice between using the Hosted RPKI service in the LIR Portal, or running Delegated RPKI. While using the RIPE NCC's web interface to manage Route Origin Authorisations (ROAs) works great, running Delegated RPKI with free, open-source

Newsletter

DNS and Rust in Critical Infrastructure

Last month we skipped our regularly scheduled newsletter to give centre stage to Maarten's article on open-source software vs. the proposed Cyber Resilience Act. In the new year we'll give you an update on what has happened since, but now we'd like to tell

Policy

Open-source software vs. the proposed Cyber Resilience Act

By Maarten Aertsen NLnet Labs is closely following a legislative proposal by the European Commission affecting almost all hardware and software on the European market. The Cyber Resilience Act (CRA) intends to ensure cybersecurity of products with digital elements by laying down requirements and obligations for manufacturers. 🥳update, december 2023:

DNS

Somebody Told Me

Proxying client information to your favorite resolver and more.

Newsletter

Cooking with SIMD

When developers gather around a screen like in this picture, you know something special is cooking. We're very excited about our prototyping with single instruction, multiple data (SIMD) processing, but this newsletter is not about that yet (nor about better kerning). More on that soon! Now, with the

Newsletter

⛱ The Things We Did Last Summer

We hope you enjoyed your summer! Our caipirinha-infused break was sprinkled with train trips and community gardening. 🍸🚂👩🏼‍🌾 Now that we're all back, it's time for a new edition of our newsletter "Of Trees and Tries", covering exciting new projects, releases and standards work we&

Research

Where Did My Packet Go? Measuring the Impact of RPKI ROV

Merely doing RPKI ROV does not provide any guarantees where your packet ends up. We conducted an experiment where we look into the impact of RPKI ROV on whether the packet ends up in the intended location based on active beaconing with two servers.

Research

Journeying into XDP: XDPerimenting with DNS telemetry

By Luuk Hendriks The XDP programs we’ve so far described in this series have been actively modifying DNS packets to perform functions such as response rate limiting (RRL), cookies and padding. This time, we’ll look into a passive BPF-program which enables us to plot graphs of DNS metrics

Newsletter

🛠 A confidence building toolbox

Nobody likes pushing the "Go" button to deploy and just hope things will be okay. 🤞 In this newsletter we'll cover some of the recent additions to our software aimed at giving you more operational confidence... 💬 In this issue: * Zone Verification in NSD. Prevent zones with errors

DNS

Zone verification, the feature formerly known as CreDNS, formerly known as dnSƧexy

NLnet Labs is pleased to announce version 4.6.0 of NSD. This release integrates and revives zone verification, a feature previously shipped in a separate product called CreDNS, which had its last release (0.2.10) in June 2012.

RPKI

Running Krill under APNIC

As you may know APNIC offers their members the option of running their own delegated RPKI CA instead of using the APNIC portal RPKI service. Moreover, APNIC also allows their members to make use of the APNIC managed RPKI repository infrastructure for publication of their RPKI objects. The latter is

RPKI

Running Krill under ARIN

When using RPKI in the ARIN region you have the choice between using the Hosted RPKI service in ARIN Online, or running Delegated RPKI. While using ARIN's web interface to manage Route Origin Authorizations (ROAs) works okay, running Delegated RPKI with free, open-source Krill has several advantages: * Krill

DNS

Extended DNS Error support for Unbound

Unbound 1.16.0 adds support for Extended DNS Errors (EDEs) as codified in RFC 8914. While EDE was already supported in NSD since version 4.3.6 released in April of 2021, as with most things in a resolver, EDE support took more time to implement. As a short

Newsletter

DNS-over-QUIC coming to Unbound

Welcome to this new edition of the NLnet Labs newsletter, bringing you the latest on our adventures from the shores of DNS and BGP land. 🏖 In this issue we continue work on our all-singing, all-dancing RPKI library 🕺, uncover the difference between the two NLnets, prove that time spent with catz