Benno Overeinder

DNSOP WG Virtual Interim By Benno Overeinder

DNSOP WG is planning a virtual interim to discuss two I-Ds:
- draft-ietf-dnsop-structured-dns-error
- draft-nottingham-public-resolver-errors

See also announcement email on mailing list for planning details, mailarchive.ietf.org/arch/msg/dns...

News - End-of-Life Roadmap for OpenDNSSEC OpenDNSSEC will reach end of life in two years, October 2027.

OpenDNSSEC will reach End-of-Life in Oct 2027.

Since 2010, it’s been a trusted DNSSEC signer, pioneering automated key management and zone signing. As operational needs evolved, maintenance became complex. Our focus now shifts to Cascade, a modern, efficient successor.

nlnetlabs.nl/news/2025/Oc...

Whiteboard with Hackathon room layout and the projects.

Picture of the Hackathon overflow room.

Picture of main Hackathon room.

Kicking off this weekend in Madrid, #IETF123 began with the #IETFHackathon on Saturday and Sunday. A fantastic way to start the week coding and connecting. Nearly 500 people registered and almost 60 projects. The Hackathon rooms are buzzing!

Unbound 1.23.1 is out — a security update fixing the Rebirthday Attack (CVE‑2025‑5994), affecting DNS resolvers with ECS servers replying without ECS.

Details: nlnetlabs.nl/downloads/un...
Release: github.com/NLnetLabs/un...

Thanks to Xiang Li for reporting!

Introducing Roto: A Compiled Scripting Language for Rust By Terts Diepraam We are working on an embedded scripting language for Rust. This language, called Roto, aims to be a simple yet fast and reliable scripting language for Rust applications. The nee...

...speaking about the Roto language: it was featured on the front page of Hacker News after @terts introduced it on our blog:

blog.nlnetlabs.nl/introducing-...

Mijn grootvaders broer, Pieter Slooten, koos niet de makkelijke weg. Hij koos verzet. Vandaag denk ik aan hem, en aan allen die hun leven gaven voor iets groters dan henzelf. #4mei #dodenherdenking

www.dodenakkers.nl/herdenkings-...

Release 0.4.0 'Bold and Undaunting Youth' · NLnetLabs/rotonda Released 2025-04-24. Breaking changes Roto filter names have changed, as dashes are replaced with underscores. New An RTR component is introduced, enabling Rotonda to receive RPKI information fr...

A new release of Rotonda, our composable, programmable #BGP engine, is now available. Version 0.4.0 'Bold and Undaunting Youth' features and #RPKI RTR component, as well as Route Origin Validation on incoming routes.
github.com/NLnetLabs/ro...

Release NSD 4.12.0 · NLnetLabs/nsd This release introduces Prometheus metrics that can be configured with enable-metrics (see nsd.conf(5)). nsd 4.12.0 FEATURES: Merge #418: Support for DSYNC, EID, NIMLOC, SINK, TALINK, DOA, AMTRELA...

NSD 4.12.0 is now available. Our authoritative #DNS server now offers Prometheus metrics, along with several other enhancements.
github.com/NLnetLabs/ns...

News - Unbound 1.23.0 released fast reload, redis replica, error reporting, and bug fixes.

Unbound 1.23.0 is out! Our #DNS resolver now supports 'fast reload'—it reads new configs in a thread and only briefly pauses to apply them. Also includes Redis replica support, DNS Error Reporting, and bug fixes.

nlnetlabs.nl/news/2025/Ap...

Our Director of DNS Engineering, Ondřej Surý, is now a co-chair of the DNS operations working group in the IETF. Congratulations!

datatracker.ietf.org/group/dnsop/...

Deadline extended to 29 April 2025 – still time to submit your papers

A bronze plaque that reads "Jaap Akkerhuis-zaal" in the NLnet Labs' office.

In equal honour to his induction into the Internet Hall of Fame, we have honoured our colleague of many years, Jaap Akkerhuis, by naming our meeting room after him. Jaap’s response was heartwarming, but as modest as he is, he said a broom closet would also be fine.

white board with tables and projects

And as usual, old technology helps in social environments: what is going on and who is where? ❤️
#IETF122 #IETFHackathon #OpenSource #OpenStandards

IETF Hackathon room

The #IETF122 Hackathon is halfway through the first day, with a good atmosphere and plenty of discussions and coding underway. The venue is spacious, with daylight, and is working well for us!

#IETFHackathon #OpenSource #OpenStandards

The DNSOP WG has two sessions at #IETF122—Monday and Thursday!

We’ve got a full agenda with ongoing WG drafts and new work. Check out the agenda and see how you can participate (including remotely) here: datatracker.ietf.org/doc/agenda-1....

Looking forward to seeing you! #DNS #IETF

This weekend, the #IETF122 Hackathon is happening in Bangkok! Over 400 people have registered for the #IETFHackathon, including 50 remote participants!

Check out the listed projects or add your own on the Hackathon wiki: wiki.ietf.org/en/meeting/1....

See you all on Saturday and Sunday!

Best job in the world, working at @nlnetlabs.bsky.social!

We need your help! We're making good progress with #XDP support for our #DNS software. However, to properly test it we need access to two metal boxes with 10Gb/s NICs that have XDP driver support, e.g. docs.cilium.io/en/latest/re.... Please contact us if you can help out. 💚

We’re heading to Brussels! 🇧🇪

Our team will be in the heart of Europe this week for a packed schedule of events, and we’d love to connect with you. Whether you're attending the same events or just in the area, don’t hesitate to say hi.

News - Routinator 0.14.1 ‘Black Cats and Voodoo Dolls’ released CVE-2025-0638, less disk consumption, ASPA

Routinator 0.14.1 is out, fixing CVE-2025-0638, where non-ASCII characters in the file names listed in an #RPKI manifest lead to a crash of Routinator.

You should also note CVE-2024-12084, fixing a flaw found in the rsync daemon.

Please update both applications.
nlnetlabs.nl/news/2025/Ja...

Release 0.14.1 ‘Black Cats and Voodoo Dolls’ · NLnetLabs/routinator This release fixes a crash when the file names listed in a manifest contain illegal characters. We recommend all users to upgrade to this version. New ASPA support is now always compiled in and av...

Routinator offered support for #RPKI Autonomous System Provider Authorization (ASPA) as an experimental feature for quite some time. #IETF standardization has now progressed far enough to make #ASPA a core feature in Routinator 0.14.1. #OpenSource #OpenStandards github.com/NLnetLabs/ro...

Important commit of the day... #OpenSource #Anniversary github.com/NLnetLabs/.g...

#nowstreaming "Directed by... David Lynch" on Qobuz

server stacks wiht a pink and purple hue overlay and the Quad9 logo

First blog of year!

Why You Should Be Using a Privacy-Centric DNS Service in 2025
www.quad9.net/news/blog/wh...

#DNS #privacy #security

Dit is wel voor hardcore geeks. ;-)

Domain Foundations – The first of our five year vision By Arya Khanna, Martin Hoffmann and Alex Band About a year ago, we unveiled our vision for the next five years of DNS at NLnet Labs. In this series of articles, we’d like to provide you with an updat...

2024 has been a pivotal year for us. Our vision for #DNS, our commitment to #rustlang and, in its wake, the influx of new talent, all combined with the support from @sovereign.tech, we’ve been able to make a giant leap forward in realizing our #OpenSource goals. blog.nlnetlabs.nl/domain-found...

Open Source Software: The $9 Trillion Resource Companies Take for Granted | Working Knowledge Measuring open source impact

💸 Open Source Software: The $9 Trillion Resource Companies Take for Granted
— Harvard Business School

#opensource #funding

News - NSD 4.11.0 released SIGHUP reloads config, bug fixes.

We have released NSD 4.11.0. One notable feature is that configuration can be reloaded and evaluated on SIGHUP, when enabled with the new "reload-config" option. Also, #DNS cookie secrets will be reevaluated from config.
nlnetlabs.nl/news/2024/De...

Registration for #IETF122 Bangkok (15-21 March 2025) is open! All the details are at: www.ietf.org/meeting/122/

GitHub - NLnetLabs/dnst: Reimplementation of important ldns programs Reimplementation of important ldns programs. Contribute to NLnetLabs/dnst development by creating an account on GitHub.

Our #DNS toolkit for #rustlang using our domain crate is nearing completion. We'll offer tools to transform a DNSKEY RR to DS RR, create a #DNSSEC key pair, print out the NSEC3 hash for the given domain name, generate a DNSSEC signed zone, and more. github.com/NLnetLabs/dn...