NLnet Labs

NSD 4.14.1 released

NLnet Labs — Tue, 24 Feb 2026 12:00:00 +0100

Today, we released version 4.14.1 of the authoritative DNS nameserver NSD.

The previous release promised reduced memory footprint from refactored RDATA storage (and it did for the vast majority of cases), but just after the release, we received a report that NSD was consuming more memory for specific …

Krill 0.15.1 ‘Contains Adult Language’ Released

NLnet Labs — Mon, 19 Jan 2026 15:00:00 +0100

We have just published the latest release of Krill, versions 0.15.1 ‘Contains Adult Language.’

Krill is a daemon for running delegated RPKI, featuring a Certificate Authority and a publication server that allows you to create and publish signed statements about routing intent.

This release fixes a bug introduced …

Rotonda 0.5.1 released

NLnet Labs — Fri, 09 Jan 2026 14:00:00 +0100

We are delighted to announce a new minor release of Rotonda, version 0.5.1.

Rotonda is a programmable, analytical BGP engine, that allows users to gather routing data from various sources, such as routers, routing software and files, and over various protocols, such as BMP, BGP and MRT. Rotonda …

New OpenPGP keys for release signing and vulnerability reporting

NLnet Labs — Tue, 09 Dec 2025 15:00:00 +0100

We are performing a routine roll of our software signing and vulnerability reporting OpenPGP keys.

From January 1st 2026, releases of ldns, NSD and Unbound will be signed with the following OpenPGP key:

User ID: NLnet Labs releases signing key G2 <[email protected]>
Key ID: A144 323D EAAC DF45 …

NSD 4.14.0 released

NLnet Labs — Thu, 04 Dec 2025 12:00:00 +0100

Today, we released version 4.14.0 of the authoritative DNS nameserver NSD.

NSD 4.14.0 comes with refactored RDATA storage, reducing the memory footprint of NSD.

You can get source packages of this version from the downloads page.

Related links:

Unbound 1.24.2 released

NLnet Labs — Wed, 26 Nov 2025 00:00:00 +0100

We are pleased to announce the release of version 1.24.2 of the Unbound recursive DNS resolver.

This security release provides an additional fix for CVE-2025-11411.

Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for …

Unbound 1.24.1 released

NLnet Labs — Wed, 22 Oct 2025 00:00:00 +0200

We are pleased to announce the release of version 1.24.1 of the Unbound recursive DNS resolver.

This security release fixes CVE-2025-11411.

Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data.

Unbound is vulnerable for some of these cases that could lead to …

Routinator 0.15.1 ‘Ain’t No Country Club Either’ released

NLnet Labs — Tue, 07 Oct 2025 15:00:00 +0200

We are pleased to announce the latest release of Routinator, version 0.15.1 ‘Ain’t No Country Club Either.’

Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them available to the BGP …

Cascade 0.1.0-alpha ‘Globen' released

NLnet Labs — Tue, 07 Oct 2025 11:00:00 +0200

We are pleased to announce the first release of Cascade, version 0.1.0-alpha ‘Globen’.

Cascade is a purpose-built, standalone DNSSEC signer, shaped by the real-world demands of TLD operators. Written from the ground up in Rust for safety, stability and speed, Cascade will be the next generation DNSSEC signing …

End-of-Life Roadmap for OpenDNSSEC

NLnet Labs — Fri, 03 Oct 2025 14:00:00 +0200

We would like to inform our users and the wider DNS community about the planned End-of-Life (EOL) timeline for OpenDNSSEC. Operators are encouraged to start planning replacement. We will offer Cascade, a new DNSSEC signer, as a drop-in successor.

OpenDNSSEC has served the community for many years as a trusted …

Rotonda 0.5.0 ‘Mosaïque Public’ released

NLnet Labs — Tue, 30 Sep 2025 21:00:00 +0200

We are delighted to announce a new release of Rotonda, version 0.5.0 ‘Mosaïque Public’.

Routinator 0.15.0 ‘This Ain’t No Disco’ released

NLnet Labs — Tue, 30 Sep 2025 15:00:00 +0200

We are pleased to announce the latest release of Routinator, version 0.15.0 ‘This Ain’t No Disco’

Unbound 1.24.0 released

NLnet Labs — Thu, 18 Sep 2025 10:00:00 +0200

We are pleased to announce the release of version 1.24.0 of the Unbound recursive DNS resolver.

This release features increased defaults, num.valops statistic, unbound-control cache_lookup, and bug fixes.

The default value increase for num-queries-per-thread is to make saturation of the task queue more resource intensive and less …

NSD 4.13.0 released

NLnet Labs — Wed, 03 Sep 2025 15:00:00 +0200

Today, we released version 4.13.0 of the authoritative DNS nameserver NSD.

NSD 4.13.0 now comes with the features --enable-bind8-stats, --enable-zone-stats, --enable-ratelimit, --enable-dnstap enabled by default, reducing confusion when using the same version of NSD packaged by different distributions with different configure options.

Additionally, NSD 4.13 …

Krill 0.15.0 ‘But I Digress’ Released

NLnet Labs — Tue, 12 Aug 2025 15:00:00 +0200

We are pleased to announce the release of Krill, versions 0.15.0 ‘But I Digress.’

Krill is a daemon for running delegated RPKI, featuring a Certificate Authority and a publication server that allows you to create and publish signed statements about routing intent.

This release primarily contains a lot …

Unbound 1.23.1 released

NLnet Labs — Wed, 16 Jul 2025 00:00:00 +0200

We are pleased to announce the release of version 1.23.1 of the Unbound recursive DNS resolver.

This security release fixes CVE-2025-5994.

A multi-vendor cache poisoning vulnerability named "Rebirthday Attack" has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with …

Rotonda 0.4.1 ‘Melolontha²’ released

NLnet Labs — Tue, 20 May 2025 14:30:00 +0200

We are delighted to announce a new release of Rotonda, version 0.4.1 ‘Melolontha²’.

RTRTR 0.3.2 ‘Based on a True Story’ released

NLnet Labs — Tue, 06 May 2025 17:00:00 +0200

We are happy to announce the latest release of RTRTR, version 0.3.2 ‘Based on a True Story.’

RTRTR is a tool to collect RPKI data from one or more sources in multiple formats and dispatch it onwards. It provides the means to implement multiple distribution architectures for RPKI …

Rotonda 0.4.0 ‘Bold and undaunting Youth’ released

NLnet Labs — Thu, 24 Apr 2025 14:30:00 +0200

We are happy to announce a new release of Rotonda, version 0.4.0 ‘Bold and undaunting Youth’.

NSD 4.12.0 released

NLnet Labs — Thu, 24 Apr 2025 10:30:00 +0200

Today, we released version 4.12.0 of the authoritative DNS nameserver NSD.

This release introduces Prometheus metrics that can be configured with enable-metrics (see nsd.conf(5)).

You can get source packages of this version from the downloads page.

Related links:

Unbound 1.23.0 released

NLnet Labs — Thu, 24 Apr 2025 10:00:00 +0200

We are pleased to announce the release of version 1.23.0 of the Unbound recursive DNS resolver.

This release features changed defaults, fast reload, redis replica, DNS Error Reporting, and bug fixes.

The fast reload is a feature that is listed as experimental. With unbound-control fast_reload the server can …

The Phone Book of the Internet

NLnet Labs — Tue, 01 Apr 2025 12:00:00 +0200

In light of a recent motion of the Dutch parliament [1], keeping with the trend of internet centralisation and considering the general state of the world [2], we are bringing the full DNS chain to a doormat close to you*. (Re-)introducing [3] The Phone Book of the Internet.

Whenever …

Routinator 0.14.2 ‘Roll Initiative!’ released

NLnet Labs — Tue, 04 Mar 2025 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.14.2 ‘Roll Initiative!’

This release updates …

Routinator 0.14.1 ‘Black Cats and Voodoo Dolls’ released

NLnet Labs — Wed, 22 Jan 2025 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.14.1 ‘Black Cats and Voodoo Dolls.’

NSD 4.11.1 released

NLnet Labs — Sat, 18 Jan 2025 12:00:00 +0100

Today, we released version 4.11.1 of the authoritative DNS nameserver NSD.

NSD version 4.11.0 had a serious bug in which applying updates to zones (and other modifications that require a reload, such as adding and deleting zones), could stop entirely after reception of a broken or …

NSD 4.11.0 released

NLnet Labs — Thu, 12 Dec 2024 12:00:00 +0100

Updated 2025-01-18: THIS VERSION HAS A SERIOUS BUG. Please upgrade to NSD 4.11.1 at the earliest opportunity.

Today, we released version 4.11.0 of the authoritative DNS nameserver NSD.

Version 4.11.0 sees various small features and bugfixes.

One notable feature is that configuration can be …

Rotonda 0.2.0 ‘Happy Fuzzballs’ released

NLnet Labs — Thu, 21 Nov 2024 16:30:00 +0100

We are super happy to announce a new - the second - release of Rotonda, version 0.2.0 ‘Happy Fuzzballs’.

Unbound 1.22.0 released

NLnet Labs — Thu, 17 Oct 2024 11:00:00 +0200

We are pleased to announce the release of version 1.22.0 of the Unbound recursive DNS resolver.

This release has an option to harden against unverified glue, it is enabled with harden-unverified-glue: yes. It was contributed by Karthik Umashankar from Microsoft. This protects Unbound against bad glue, that is …

Unbound 1.21.1 released

NLnet Labs — Thu, 03 Oct 2024 00:00:00 +0200

We are pleased to announce the release of version 1.21.1 of the Unbound recursive DNS resolver.

This security release fixes CVE-2024-8508.

A vulnerability has been discovered in Unbound when handling replies with very large RRsets that Unbound needs to perform name compression for.

Malicious upstreams responses with very …

Unbound 1.21.0 released

NLnet Labs — Thu, 15 Aug 2024 10:00:00 +0200

We are pleased to announce the release of version 1.21.0 of the Unbound recursive DNS resolver.

This release has a fix for the CAMP and CacheFlush issues. They have a low severity for Unbound, since it does not affect Unbound so much.

The Compositional Amplification (CAMP) type of …

NSD 4.10.1 released

NLnet Labs — Fri, 02 Aug 2024 12:00:00 +0200

Today, we released version 4.10.1 of the authoritative DNS nameserver NSD.

Version 4.10.1 consists primarily of bug fixes.

@bilias implemented mutual TLS authentication for zone transfers. Please consult the nsd.conf manual for details on the newly introduced configuration options tls-auth-port and tls-auth-xfr-only.

Michael Orlitzky provided …

Krill 0.13.2 and 0.14.5 Released

NLnet Labs — Thu, 27 Jun 2024 15:00:00 +0200

We are pleased to announce the two releases of Krill, versions 0.13.2 ‘Be kind, rewind’ and 0.14.5 ‘Who dis? New Phone.’

Krill is a daemon for running delegated RPKI, featuring a Certificate Authority and a publication server that allows you to create and publish signed statements …

Routinator 0.14.0 ‘You Must Gather Your Party Before Venturing Forth’ released

NLnet Labs — Thu, 20 Jun 2024 15:00:00 +0200

We are pleased to announce the latest release of Routinator, version 0.14.0 ‘You Must Gather Your Party Before Venturing Forth.’

Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them available to …

NSD 4.10.0 released

NLnet Labs — Thu, 13 Jun 2024 12:00:00 +0200

Today, we released version 4.10.0 of the authoritative DNS nameserver NSD.

Version 4.10.0 integrates simdzone and drops the Flex+Bison zone parser.

NSD used a Flex+Bison based zone parser since version 1.4.0. The parser served NSD well, but zones have increased in size …

RTRTR 0.3.0 ‘Filmed Before a Live Studio Audience’ released

NLnet Labs — Thu, 06 Jun 2024 17:00:00 +0200

We are happy to announce the latest release of RTRTR, version 0.3.0 ‘Filmed Before a Live Studio Audience.’

RTRTR is a tool to collect RPKI data from one or more sources in multiple formats and dispatch it onwards. It provides the means to implement multiple distribution architectures for …

Gezocht: Voorzitter voor de Raad van Toezicht

NLnet Labs — Fri, 17 May 2024 17:00:00 +0200

Wij zoeken per 1 juli 2024 een nieuwe voorzitter voor onze Raad van Toezicht (RvT) vanwege het aflopen van de termijn van onze huidige voorzitter.

Over NLnet Labs

NLnet Labs is een stichting, opgericht in 1999. Onze missie is het ontwikkelen van open-source software en open protocolstandaarden voor het internet …

Unbound 1.20.0 released

NLnet Labs — Wed, 08 May 2024 10:00:00 +0200

We are pleased to announce the release of version 1.20.0 of the Unbound recursive DNS resolver.

This release has a fix for the DNSBomb issue CVE-2024-33655. This has a low severity for Unbound, since it makes Unbound complicit in targeting others, but does not affect Unbound so much …

Domain 0.10.0 released

NLnet Labs — Mon, 29 Apr 2024 15:00:00 +0200

We are pleased to announce the release of version 0.10.0 of domain, our Rust crate for interacting with the Domain Name System (DNS).

This release is the result of the first three months of increased focus on the library. We have written more about our plans for the …

NSD 4.9.1 released

NLnet Labs — Thu, 04 Apr 2024 14:56:00 +0200

Today, we released version 4.9.1 of the authoritative DNS nameserver NSD.

This release fixes the builds scripts in the release of version 4.9.0.

Version 4.9.0 adds support for DNS Catalog Zones (RFC 9432) version "2".

Both producer and consumer roles for catalog zones are …

NSD 4.9.0 released

NLnet Labs — Wed, 03 Apr 2024 16:37:00 +0200

Today, we released version 4.9.0 of the authoritative DNS nameserver NSD.

This release adds support for DNS Catalog Zones (RFC 9432) version "2".

Both producer and consumer roles for catalog zones are implemented, but only a single consumer zone is allowed. The "coo" property, relevant when multiple consumer …

Unbound 1.19.3 released

NLnet Labs — Thu, 14 Mar 2024 10:00:00 +0100

We are pleased to announce the release of version 1.19.3 of the Unbound recursive DNS resolver.

This release has a number of bug fixes. The CNAME synthesized for a DNAME record uses the original TTL, of the DNAME record, and that means it can be cached for the …

Unbound 1.19.2 released

NLnet Labs — Thu, 07 Mar 2024 00:00:00 +0100

We are pleased to announce the release of version 1.19.2 of the Unbound recursive DNS resolver.

This security release fixes CVE-2024-1931.

NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain …

Routinator 0.13.2 ‘Existential Funk’ released

NLnet Labs — Mon, 26 Feb 2024 15:00:00 +0100

Today we released version 0.13.2 ‘Existential Funk’ of Routinator.

This release fixes an issue in the RTR …

Unbound 1.19.1 released

NLnet Labs — Tue, 13 Feb 2024 13:00:00 +0100

We are pleased to announce the release of version 1.19.1 of the Unbound recursive DNS resolver.

This security release fixes two DNSSEC validation vulnerabilities: CVE-2023-50387 (referred here as the KeyTrap vulnerability) and CVE-2023-50868 (referred here as the NSEC3 vulnerability).

The KeyTrap vulnerability works by using a combination of …

Routinator 0.13.1 ‘Aziz, Light!’ released

NLnet Labs — Wed, 24 Jan 2024 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.13.1 ‘Aziz, Light!’

This release includes …

NSD 4.8.0 released

NLnet Labs — Wed, 06 Dec 2023 10:00:00 +0100

Today, we released version 4.8.0 of the authoritative DNS nameserver NSD.

This release introduces PROXYv2 support and faster statistics gathering, removes the database option and fixes bugs.

The proxy protocol support is an implementation of PROXYv2 for NSD. It can be configured with proxy-protocol-port: portnum with the port …

Unbound 1.19.0 released

NLnet Labs — Wed, 08 Nov 2023 11:00:00 +0100

We are pleased to announce the release of version 1.19.0 of the Unbound recursive DNS resolver.

This release fixes a number of bugs, and adds some smaller features. The redis-logical-db option and cachedb-no-store option can be used for cachedb configuration. The disable-edns-do option can be used for working …

Routinator 0.13.0 ‘Should Have Started This in a Screen’ released

NLnet Labs — Thu, 21 Sep 2023 15:00:00 +0200

We are pleased to announce the latest release of Routinator, version 0.13.0 ‘Should Have Started This in a Screen.’

Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them available to the …

Routinator 0.12.2 ‘Brutti, sporchi e cattivi’ released

NLnet Labs — Wed, 13 Sep 2023 15:00:00 +0200

Today we have released version 0.12.2 of Routinator.

This release fixes two issues in Routinator that can …

Unbound 1.18.0 released

NLnet Labs — Wed, 30 Aug 2023 11:00:00 +0200

We are pleased to announce the release of version 1.18.0 of the Unbound recursive DNS resolver.

This release adds DNS cookies downstream, support to respond with EDE error codes from cache, NAT64 support, and the capability to use a socket queue timeout to discard old packets, and other …

NSD 4.7.0 released

NLnet Labs — Wed, 07 Jun 2023 10:00:00 +0200

Today, we released version 4.7.0 of the authoritative DNS nameserver NSD.

This release adds a script for bash autocompletion for nsd-control. Also nsd-control can be configured to use unencrypted operation also when compiled without openssl. There is also a systemd service unit example file contributed. The dnstap log …

Krill 0.12.1 'Safety Belts' Released

NLnet Labs — Tue, 17 Jan 2023 12:30:00 +0100

This release introduces two fixes for the Krill Publication Server. If you only use Krill as an RPKI Certificate Authority and publish elsewhere, e.g. in an RPKI Publication Server provided by your RIR or NIR, then there is no need to update to this release.

Firstly, this release fixes …

Unbound 1.17.1 released

NLnet Labs — Thu, 12 Jan 2023 10:00:00 +0100

We are pleased to announce the release of version 1.17.1 of the Unbound recursive DNS resolver.

This release fixes a number of bugs. There are also new configuration options that by default do not change the existing behaviour of Unbound.

With statistics-inhibit-zero the printout of zero values by …

Routinator 0.12.1 ‘Plan uw reis in de app’ released

NLnet Labs — Wed, 04 Jan 2023 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.12.1 ‘Plan uw reis in de app.’

Routinator 0.12.0 ‘Brutalism and Gardening’ released

NLnet Labs — Thu, 10 Nov 2022 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.12.0 ‘Brutalism and Gardening.’

This release …

NSD 4.6.1 released

NLnet Labs — Thu, 10 Nov 2022 10:00:00 +0100

Today, we released version 4.6.1 of the authoritative DNS nameserver NSD.

This release has a couple of bug fixes. The alpn is set for dns over tls connections. And the SVCB type supports the dohpath parameter.

You can get source packages of this version from the downloads page …

Unbound 1.17.0 released

NLnet Labs — Thu, 13 Oct 2022 10:00:00 +0200

We are pleased to announce the release of version 1.17.0 of the Unbound recursive DNS resolver.

This release has new interface acl configuration options. These allow access-control actions, per interface. Also tags, and views can be configured per interface, queries over the interface are answered with these tags …

Unbound 1.16.3 released

NLnet Labs — Wed, 21 Sep 2022 12:00:00 +0200

We are pleased to announce the release of version 1.16.3 of the Unbound recursive DNS resolver.

This release fixes CVE-2022-3204 'Non-Responsive Delegation Attack'. It was reported by Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr and Shani Stajnrod from Reichman University.

This fixes for better performance when under …

Routinator 0.11.3 released

NLnet Labs — Tue, 13 Sep 2022 15:00:00 +0200

We have just released Routinator 0.11.3. This release fixes a vulnerability present in Routinator 0.9.0 up to and including 0.11.2 which causes Routinator to exit if it encounters invalid data in RRDP snapshot or delta files. We have assigned CVE-2022-3029 to this issue.

Due …

ldns 1.8.3 quickfix release

NLnet Labs — Mon, 15 Aug 2022 00:00:00 +0200

Version 1.8.2 of ldns had a crash bug when creating packets with an EDNS OPT resource record without options. For example when just setting the DO bit (DNSSEC OK) or when specifying a larger UDP payload size.

This quick fix release has this resolved. Also the unit tests …

ldns 1.8.2 released

NLnet Labs — Fri, 12 Aug 2022 00:00:00 +0200

I am pleased to announce that version 1.8.2 of ldns is now available. Besides some bugfixes, this release also has a few new features, most notably:

Since draft-ietf-dnsop-svcb-https will become RFC now anytime soon, SVCB and HTTPS RR types are now compiled by default.
Functionality for parsing and …

Unbound 1.16.2 released

NLnet Labs — Mon, 01 Aug 2022 14:00:00 +0200

We are pleased to announce the release of version 1.16.2 of the Unbound recursive DNS resolver.

This release fixes the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. They were reported by Xiang Li from the Network and Information Security Lab of Tsinghua University.

Other than that there are …

Unbound 1.16.1 released

NLnet Labs — Mon, 11 Jul 2022 11:00:00 +0200

We are pleased to announce the release of version 1.16.1 of the Unbound recursive DNS resolver.

This release fixes a number of bugs. The number of nxdomains encountered when looking up a nameserver is not counted as such when the lookup was from cache. Also parent side queries …

NSD 4.6.0 released

NLnet Labs — Thu, 30 Jun 2022 10:00:00 +0200

Today, we released version 4.6.0 of the authoritative DNS nameserver NSD.

This release adds the zone verification support from the CreDNS code. There are also some bug fixes in the ixfr out code.

Zone verification can start a verifier program that reads the new zone data. It can …

RTRTR 0.2.2 released

NLnet Labs — Mon, 13 Jun 2022 12:00:00 +0200

We have just released RTRTR 0.2.2.

This release fixes a one bug and two issues that were introduced in the 0.2 series. All users of RTRTR 0.2.0 and 0.2.1 are advised to upgrade.

The more severe of those is that RTRTR starts to …

Unbound 1.16.0 released

NLnet Labs — Thu, 02 Jun 2022 14:00:00 +0200

We are pleased to announce the release of version 1.16.0 of the Unbound recursive DNS resolver.

This release has EDE support, for extended EDNS error reporting, it fixes unsupported ZONEMD algorithms to load, and has more bug fixes.

The EDE errors can be turned on by ede: yes …

NSD 4.5.0 released

NLnet Labs — Fri, 13 May 2022 10:00:00 +0200

Today, we released version 4.5.0 of the authoritative DNS nameserver NSD.

This release fixes a couple of minor bugs and adds IXFR out functionality. With this functionality NSD can respond to IXFR queries and serve IXFR transfers downstream.

It is default disabled, that means it does not store …

Routinator 0.11.2 released

NLnet Labs — Wed, 20 Apr 2022 15:00:00 +0200

We have just released Routinator 0.11.2 which fixes an issue causing the integrated RTR server to not always report the complete set of withdrawn VRPs and router keys to a router. This could cause a router to possibly retain withdrawn VRPs or router keys for some time.

This …

Routinator 0.11.1 released

NLnet Labs — Thu, 07 Apr 2022 15:00:00 +0200

We are pleased to announce the latest release of Routinator, version 0.11.1.

This release improves the output …

Routinator 0.11.0 released

NLnet Labs — Mon, 28 Feb 2022 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.11.0.

This release adds TLS support …

NSD 4.4.0 released

NLnet Labs — Thu, 17 Feb 2022 10:00:00 +0100

Today, we released version 4.4.0 of the authoritative DNS nameserver NSD.

This release changes the memory allocation for outgoing zonetransfers, and this reduces the memory footprint. The defaults for the amounts are the same as before, but there are config options to configure the memory usage. There are …

Unbound 1.15.0 released

NLnet Labs — Thu, 10 Feb 2022 10:00:00 +0100

We are pleased to announce the release of version 1.15.0 of the Unbound recursive DNS resolver.

This release has bug fixes for crashes that happened on heavy network usage. The default for the aggressive-nsec option has changed, it is now enabled.

The ratelimit logic had to be reworked …

RTRTR 0.2.0 ‘Arts and Crafts and Tactical Gear’ released

NLnet Labs — Wed, 19 Jan 2022 12:00:00 +0100

We are happy to announce the latest release of RTRTR, version 0.2.0 ‘Arts and Crafts and Tactical Gear.’

RTRTR is a tool to collect RPKI data from one or more sources in multiple formats and dispatch it onwards. It provides the means to implement multiple distribution architectures for …

NSD 4.3.9 released

NLnet Labs — Thu, 09 Dec 2021 10:00:00 +0100

Today, we released version 4.3.9 of the authoritative DNS nameserver NSD.

This release contains a small number of bug fixes. The reconfig failure is fixed for cpu-affinity config re-read. Version repository and continuous integration files are removed from the sourcecode tarball.

You can get source packages of this …

Unbound 1.14.0 released

NLnet Labs — Thu, 09 Dec 2021 10:00:00 +0100

We are pleased to announce the release of version 1.14.0 of the Unbound recursive DNS resolver.

This release contains bug fixes and a full set of RPZ triggers and actions that are supported. This works with RPZ zones, configured with rpz:.

It is possible to selectively enable use …

ldns 1.8.1 released

NLnet Labs — Fri, 03 Dec 2021 00:00:00 +0100

This is a quickfix release fixing bugs that had 1.8.0 installing incorrectly. Compared to the 1.7.1 release, this release has many bugfixes and also a few new features, most notably:

ZONEMD support in ldns-signzone and ldns-verify-zone
Draft implementation of the SVCB and HTTPS RR types. Use …

ldns 1.8.0 released

NLnet Labs — Fri, 26 Nov 2021 00:00:00 +0100

Besides many bugfixes, this release also has a few new features:

ZONEMD support in ldns-signzone and ldns-verify-zone
Draft implementation of the SVCB and HTTPS RR types. Use --enable-rrtype-svcb-https with configure to compile with these supported.

Related links:

Routinator 0.10.2 ‘Skuffet, men ikke overrasket’ released

NLnet Labs — Tue, 09 Nov 2021 15:00:00 +0100

We are pleased to announce the latest release of Routinator, version 0.10.2 ‘Skuffet, men ikke overrasket.’

This release is part of a Coordinated Vulnerability Disclosure for vulnerabilities in RPKI relying party implementations conducted by the University of Twente and the National Cyber Security Centre of the Netherlands (NCSC-NL …

NSD 4.3.8 released

NLnet Labs — Tue, 12 Oct 2021 10:00:00 +0200

Today, we released version 4.3.8 of the authoritative DNS nameserver NSD.

This release fixes a crash bug in delegation answers, and fixes in NSEC3 answers. Also compile fixes for OpenSSL. The OpenSSL 3.0 API is supported.

The Mutual TLS feature allows for client authentication for XFR-over-TLS connections …

Routinator 0.10.1 ‘That's No Moon’ released

NLnet Labs — Mon, 20 Sep 2021 15:00:00 +0200

We are happy to announce the latest release of Routinator, version 0.10.1 ‘That's No Moon.’

This release …

Routinator 0.10.0 ‘Through Many Dangers, Toils, and Snares’ released

NLnet Labs — Mon, 23 Aug 2021 15:00:00 +0200

We are happy to announce the latest release of Routinator, version 0.10.0 ‘Through Many Dangers, Toils, and Snares.’

Unbound 1.13.2 released

NLnet Labs — Thu, 12 Aug 2021 10:00:00 +0200

We are pleased to announce the release of version 1.13.2 of the Unbound recursive DNS resolver.

The release contains a bugfix to fix the make install of the python module after build changes introduced in this release rc1.

This release contains a number of bug fixes. There is …

NSD 4.3.7 released

NLnet Labs — Thu, 22 Jul 2021 16:00:00 +0200

Today, we released version 4.3.7 of the authoritative DNS nameserver NSD.

This release fixes a crash in dnstap. New features are XoT which provides AXFR and IXFR over TLS, and DNS Cookies support and SVCB and HTTPS RR type support.

For zone transfer TLS can be turned on …

Routinator 0.9.0 ‘Raptor Bash for Life’ released

NLnet Labs — Sat, 03 Jul 2021 15:00:00 +0200

We are happy to announce the latest release of Routinator, version 0.9.0 ‘Raptor Bash for Life.’

This …

tsuNAME vulnerability and Unbound

NLnet Labs — Mon, 10 May 2021 17:00:00 +0200

Last week, SIDN Labs, InternetNZ and USC/ISI researchers announced the vulnerability called tsuNAME [1]. With the analysis of the impact of tsuNAME, the researchers have also evaluated a number of open source DNS software, including Unbound. In their research they have assessed that Unbound is not vulnerable to the …

OpenDNSSEC 2.1.9 released

NLnet Labs — Thu, 06 May 2021 13:45:00 +0200

This release contains two changes that avoid some problems with certain HSM configuration, one of them is SoftHSMv2 in database back-end mode. This can lead to temporarily not being able to sign zones, hence upgrading is really recommended. It does not occur on all systems and configurations though.

The 2 …

NSD 4.3.6 released

NLnet Labs — Tue, 06 Apr 2021 14:00:00 +0200

Today, we released version 4.3.6 of the authoritative DNS nameserver NSD.

This release contains a bug fix for a zone file parse failure for text records. The release also adds the feature to print a local address, if the address is configured, in dnstap logs. The interface for …

Discontinuing the 1-Click Apps for Krill

NLnet Labs — Thu, 25 Feb 2021 12:30:00 +0100

About one year ago we introduced a 1-Click App for Krill on the AWS Marketplace and DigitalOcean Marketplace. It was introduced in a time when installing and configuring Krill involved quite some steps. The goal was to allow operators to get started with Krill quickly, to gain operational experience with …

OpenDNSSEC 2.1.8 released

NLnet Labs — Tue, 23 Feb 2021 16:20:00 +0100

This release of 2.1.8 fixes a number of bugs related to the purging of keys, a potential denial of service vulnerability in some installations, and a few rare but nasty potential crashes. Earlier versions of OpenDNSSEC 2.1 might not have all keys purged from the HSM if …

Unbound 1.13.1 released

NLnet Labs — Tue, 09 Feb 2021 10:00:00 +0100

We are pleased to announce the release of version 1.13.1 of the Unbound recursive DNS resolver.

This release contains a number of bug fixes. There is added support for the EDNS Padding option (RFC7830 and RFC8467), and the EDNS NSID option (RFC 5001). Unbound control has added commands …

Routinator 0.8.3 ‘Like and Subscribe’ released

NLnet Labs — Tue, 02 Feb 2021 15:00:00 +0100

We are happy to announce the latest release of Routinator, version 0.8.3 ‘Like and Subscribe.’*

While we …

NSD 4.3.5 released

NLnet Labs — Tue, 26 Jan 2021 10:00:00 +0100

Today, we released version 4.3.5 of the authoritative DNS nameserver NSD.

This release fixes a number of bugs. It fixes a number of corner case differences for the output more similar to Bind. The configure sources are compatible with the new autoconf 2.70.

You can get source …

RTRTR 0.1.1 ‘Death Metal Karaoke‘ released

NLnet Labs — Fri, 11 Dec 2020 12:00:00 +0100

We are happy to announce the second release of RTRTR, version 0.1.1 ‘Death Metal Karaoke.’

RTRTR is a tool to collect RPKI data from one or more sources in multiple formats and dispatch it onwards. It provides the means to implement multiple distribution architectures for RPKI such as …

Routinator 0.8.2 ‘Once More, with Feeling’ released

NLnet Labs — Wed, 09 Dec 2020 15:00:00 +0100

We are happy to announce the latest release of Routinator, version 0.8.2 ‘Once More, with Feeling.’

This …

Unbound 1.13.0 released

NLnet Labs — Thu, 03 Dec 2020 10:00:00 +0100

We are pleased to announce the release of version 1.13.0 of the Unbound recursive DNS resolver.

This version has fixes to connect for UDP sockets, slowing down potential ICMP side channel leakage. The fix can be controlled with the option udp-connect: yes, it is enabled by default.

Additionally …

NSD 4.3.4 released

NLnet Labs — Tue, 01 Dec 2020 13:30:00 +0100

Today, we released version 4.3.4 of the authoritative DNS nameserver NSD.

This release fixes CVE-2020-28935, this solves a problem where the pidfile is altered by a symlink, and fails if a symlink is encountered. See https://nlnetlabs.nl/downloads/nsd/CVE-2020-28935.txt for more information.

Also there are …

Routinator 0.8.1 ‘Pure as New York Snow’ released

NLnet Labs — Mon, 30 Nov 2020 15:00:00 +0100

We are happy to announce the latest release of Routinator, version 0.8.1 ‘Pure as New York Snow.’

Introducing JDR

NLnet Labs — Thu, 19 Nov 2020 16:45:00 +0100

We've launched the first version of JDR, our hosted tool to check anything in the RPKI. While not yet 100% feature complete, we think it already offers useful insights to operators and implementors, and moreover, we would like their input and ideas for further developments of JDR. In this blogpost …

SAD DNS and NLnet Labs DNS software

NLnet Labs — Wed, 18 Nov 2020 11:09:00 +0100

During the recent ACM CCS conference 2020, researchers presented a clever new variant of DNS cache poisoning attack that they call "SAD DNS". This attack is yet more proof that DNS cache poisoning remains a threat, and all the more reason to invest in the only real protection against this …

Krill 0.8.1 'The Gentle Art' Released

NLnet Labs — Tue, 17 Nov 2020 12:30:00 +0100

We are happy to introduce Krill 0.8.1 'The Gentle Art'. This release is less restrictive when creating ROAs, while still providing enough guidance to accurately reflect your routing intent.

Krill automatically downloads BGP announcement information from RIPE RIS and uses this to analyse the known BGP announcements for …

NLnet Labs becomes a CVE Numbering Authority (CNA)

NLnet Labs — Wed, 28 Oct 2020 18:00:00 +0100

We are delighted to announce that NLnets Labs joins over 140 other leading technology organisations authorised to be a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA).

Common Vulnerabilities and Exposures (CVE) is an international, cybersecurity, community effort that maintains a list of standarised common identifiers for publicly disclosed cybersecurity …

Krill 0.8.0 'The Art of ROA Maintenance' Released

NLnet Labs — Wed, 28 Oct 2020 13:30:00 +0100

We are happy to introduce Krill 0.8.0 'The Art of ROA Maintenance'. In this version we have added further refinements to the ROA management interface to give users the confidence that their authorisations accurately reflect their BGP announcements.

The first of these improvements are warnings about ROAs that …

Routinator 0.8.0 ‘Strikes and Gutters, Ups and Downs’ released

NLnet Labs — Mon, 19 Oct 2020 15:00:00 +0200

We are happy to announce the latest release of Routinator, version 0.8.0 ‘Strikes and Gutters, Ups and Downs.’

NSD 4.3.3 released

NLnet Labs — Thu, 08 Oct 2020 09:00:00 +0200

Today, we released version 4.3.3 of the authoritative DNS nameserver NSD.

This release contains the DNS Flag Day 2020 fixes. This sets the default EDNS buffer size to 1232, that should reduce fragmentation. https://dnsflagday.net/2020/

There is a new feature where it is possible to list …

Unbound 1.12.0 released

NLnet Labs — Thu, 08 Oct 2020 09:00:00 +0200

We are pleased to announce the release of version 1.12.0 of the Unbound recursive DNS resolver.

This release contains the DNS Flag Day 2020 changes. This sets the default EDNS buffer size to 1232, that should reduce fragmentation. https://dnsflagday.net/2020/

There is inclusive language in the …

Unbound 1.11.0 released

NLnet Labs — Mon, 27 Jul 2020 11:00:00 +0200

We are pleased to announce the release of version 1.11.0 of the Unbound recursive DNS resolver.

This release contains a number of bug fixes. Also new features are introduced. The configure --with-dynlibmodule enables dynamic library support that can have code modules function like the python library scripts. It …

NSD 4.3.2 released

NLnet Labs — Tue, 14 Jul 2020 14:00:00 +0200

Today, we released version 4.3.2 of the authoritative DNS nameserver NSD.

This release fixes a number of bugs, and adds options to set log-only-syslog and min-expire-time in nsd.conf and nsd -v for configure line and library versions.

You can get source packages of this version from the …

Krill 0.7.2 'Small Bites' Released

NLnet Labs — Mon, 29 Jun 2020 13:30:00 +0200

This release fixes an issue where BGP RIS Dump files that were not properly retrieved would cause a thread to choke. As this can lead to lock poisoning this type of event could cause other Krill processes to stop functioning properly. All users of Krill 0.7.0 and 0 …

Krill 0.7.1 'Sobremesa' Released

NLnet Labs — Thu, 25 Jun 2020 13:30:00 +0200

We are incredibly excited that six months after the first release of Krill it already powers delegated RPKI for over 150 organisations. Today we are launching Krill 0.7.1 'Sobremesa', the biggest update yet of our open source RPKI Certificate Authority software. This version lets you create and maintain …

Routinator 0.7.1 ‘Moonlight and Love Songs’ released

NLnet Labs — Tue, 16 Jun 2020 15:00:00 +0200

We are happy to announce the latest release of Routinator, version 0.7.1 ’Moonlight and Love Songs.’

While …

Researching a New NSD Database: Adaptive Radix Tree

NLnet Labs — Thu, 11 Jun 2020 10:00:00 +0200

NLnet Labs' authoritative nameserver NSD currently supports two different data structures for its main memory database: red-black tree en radix tree. Both data structures have their strengths and weaknesses, red-black tree implementation is more memory efficient and the radix tree is more performant (faster). Jeroen Koekkoek explores a new data …

Unbound 1.10.1 released

NLnet Labs — Tue, 19 May 2020 10:00:00 +0200

We are pleased to announce the release of version 1.10.1 of the Unbound recursive DNS resolver.

This release fixes CVE-2020-12662 and CVE-2020-12663.

For a full list of changes and binary and source packages, see the download page.

Related links:

Krill 0.6.0 'Go with the Flow' Released

NLnet Labs — Mon, 18 May 2020 13:30:00 +0200

A few days ago we released Krill 0.6.0 'Go with the Flow'. The most visible change in this release is that the embedded user interface now includes French, Greek and Spanish translations.

The Krill user interface in Greek

The vast majority of the work went into making Krill …

Krill available on the AWS Marketplace

NLnet Labs — Mon, 11 May 2020 10:00:00 +0200

We are excited to announce that Krill is available as a 1-Click App on the AWS Marketplace.

The Krill 1-Click App brings together all of the puzzle pieces needed to administer and run an RPKI Certificate Authority and publication server in the AWS cloud. It allows you to easily set …

Routinator 0.7.0 ‘Your Time Starts … Now’ released

NLnet Labs — Wed, 06 May 2020 15:00:00 +0200

We are happy to announce the latest release of Routinator, version 0.7.0 ’Your Time Starts … Now.’

The …

NSD 4.3.1 released

NLnet Labs — Thu, 16 Apr 2020 11:05:00 +0200

Today, we released version 4.3.1 of the authoritative DNS nameserver NSD.

This release fixes a number of bugs, and fixes a bug for FreeBSD start.

You can get source packages of this version from the downloads page.

Related links:

Krill available on the DigitalOcean Marketplace

NLnet Labs — Tue, 14 Apr 2020 10:00:00 +0200

We are delighted to announce that Krill is now available as a 1-Click App on the DigitalOcean Marketplace.

It was already easy to get started with Krill, our RPKI Certificate Authority and publication server software, as you could install and run it from a clean system with just seven commands …

NSD 4.3.0 released

NLnet Labs — Tue, 17 Mar 2020 11:05:00 +0100

Today, we released version 4.3.0 of the authoritative DNS nameserver NSD.

This release adds CPU affinity. By pinning a server process to a specific CPU, having a separate network card also for that CPU, and an interface address also for that server process, the throughput is increased. This …

Krill 0.5.0 'Serve no Turf' Released

NLnet Labs — Tue, 25 Feb 2020 12:30:00 +0100

We are very excited about introducing Krill 0.5.0 'Serve No Turf'. This release is a major step forward for the project, improving the installation, onboarding, interoperability and usability of Krill.

The most prominent change you will notice is that Krill now offers a multi-language user interface, allowing you …

Unbound 1.10.0 released

NLnet Labs — Thu, 20 Feb 2020 14:00:00 +0100

We are pleased to announce the release of version 1.10.0 of the Unbound recursive DNS resolver.

The 1.10.0 release has RPZ support and serve stale functionality according to draft draft-ietf-dnsop-serve-stale-10. And a number of other, smaller, features, and bug fixes.

The DNS Response Policy Zones (RPZ …

NLnet Labs adopts a Code of Conduct

NLnet Labs — Mon, 10 Feb 2020 14:19:00 +0100

We have adopted a code of conduct for NLnet Labs. As of February 2020, this code of conduct applies to all our projects and our interactions with the community. To explain a little bit more about why we adopted a code of conduct, and how we went about the writing …

OpenDNSSEC 2.1.6 released

NLnet Labs — Mon, 10 Feb 2020 11:30:00 +0100

The OpenDNSSEC 2.1.6 release fixes a number of issues with regard to the key list that was displayed incorrectly (a regression error in 2.1.5) and a small memomry leak in the enforcer (which can add up if you bang the enforcer with a lot of commands …

In Memory of Bill Manning

NLnet Labs — Sun, 26 Jan 2020 00:00:00 +0100

We have just learned from friends that Bill Manning died last night. Bill was a member of the original Unbound design team in 2006, and as such instrumental for the success of Unbound resolver.

From the doc/requirements.txt document that is distributed with the Unbound source code:

The Unbound …

Krill 0.4.2 'Finer Things' Released

NLnet Labs — Mon, 06 Jan 2020 16:00:00 +0100

We would like to kick off the new year with the launch of Krill 0.4.2 'Finer Things'. This release fixes a bug and introduces usability improvements based on the experiences users have had with running Krill since the production launch, several weeks ago.

The bug we fixed revolves …

Krill 0.4.1 'Fogo de Krill' Released

NLnet Labs — Fri, 13 Dec 2019 15:00:00 +0100

We are happy to launch Krill 0.4.1 'Fogo de Krill'. This is a bug fix release and we recommend everyone running Krill to update to this version.

Krill now powers the RPKI service that Brazilian National Internet Registry NIC.br offers. During the production launch we uncovered a …

Unbound 1.9.6 released

NLnet Labs — Thu, 12 Dec 2019 10:00:00 +0100

We are pleased to announce the release of version 1.9.6 of the Unbound recursive DNS resolver.

This release contains a number of security related fixes, contributed by X41 D-Sec. They have conducted a security audit of Unbound, funded by OSTIF. The previous CVEs fixed in 1.9.4 …

Mailing list migration

NLnet Labs — Thu, 12 Dec 2019 00:00:00 +0100

We are migrating our mailing lists over to MailmanLists.

On December 16th 2019 all mailing lists will be migrated to MailmanLists. The opportunity will also be used to move mailing lists to dedicated subdomains.

nlnetlabs.nl lists will be moved to lists.nlnetlabs.nl
lists.opendnssec.org lists will remain …

NSD 4.2.4 released

NLnet Labs — Tue, 10 Dec 2019 13:43:00 +0100

Today, we released version 4.2.4 of the authoritative DNS name server NSD.

This release mainly fixes regressions in the configuration file parser for the minimal-responses: yesno, round-robin: yesno and log-time-ascii: yesno options. There are some portability fixes too, make distclean will now cleanup config.h and a maintainer-clean …

Krill 0.4.0 'The Krill Factor' Released

NLnet Labs — Tue, 03 Dec 2019 12:00:00 +0100

We are incredibly proud to introduce Krill 0.4.0 'The Krill Factor'. This release is the culmination of one and a half years of designing, building, testing and documenting our RPKI Certificate Authority (CA) and Publication Server solution.

Ready for Production Use

The first three releases of Krill were …

Routinator 0.6.3 ‘That Escalated Fast’ released (Updated)

NLnet Labs — Thu, 28 Nov 2019 15:00:00 +0100

Updated: This release contained a critical bug that caused Routinator to completely hang on occasion. We have released Routinator 0.6.4 ‘Jeepers’ to fix this issue.

We are happy to announce the latest release of Routinator, version 0.6.3 ’That Escalated Fast.’

Routinator is an RPKI relying party …

Routinator 0.6.2 ‘Distiller’s Edition’ released

NLnet Labs — Wed, 20 Nov 2019 15:00:00 +0100

We are delighted to announce the latest release of Routinator, version 0.6.2 ’Distiller’s Edition.’

There aren …

NSD 4.2.3 released

NLnet Labs — Wed, 20 Nov 2019 08:15:00 +0100

Today, we released version 4.2.3 of the authoritative DNS name server NSD.

This release has log fixes, features of confine-to-zone and startup management, an implementation changes in the configuration parser and socket handling code simplifications. The implementation changes make the parser context aware, which is useful for the …

Unbound 1.9.5 released

NLnet Labs — Tue, 19 Nov 2019 10:00:00 +0100

We are pleased to announce the release of version 1.9.5 of the Unbound recursive DNS resolver.

This release is a fix for vulnerability CVE-2019-18934 that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered when all of the below conditions …

Best Paper Award for DNSSEC Root Key Rollover Paper

NLnet Labs — Fri, 08 Nov 2019 09:00:00 +0100

A team of researchers including two NLnet Labs staff members has won the best paper award at the Internet Measurement Conference 2019. Their paper, entitled "Roll, Roll, Roll Your Root" gives an in-depth analysis of the DNSSEC Root KSK Rollover that took place over 2017-2018. It shows that while the …

Longitudinal RPKI study presented at IMC 2019

NLnet Labs — Fri, 08 Nov 2019 08:30:00 +0100

Two NLnet Labs team members, Tim Bruijnzeels and Roland van Rijswijk-Deij, contributed to a longitudinal study of the RPKI ecosystem. The study, presented at the Internet Measurement Conference 2019, analyses the development of RPKI since its inception in 2011. The study uses an open data set of all RPKI repositories …

OpenDNSSEC 2.1.5 released

NLnet Labs — Tue, 05 Nov 2019 11:30:00 +0100

The previous release fixed an important issue, but unfortunately left in a memory leak, which this release fixes. This release of 2.1.5 fixes the memory issue, along with some additional issues primarily relating to minor migration reporting and configuration.

The 2.1.5 release is available immediately from …

Krill 0.2.0 'Interkrillactic, Planetary' released

NLnet Labs — Mon, 21 Oct 2019 11:00:00 +0200

We are incredibly happy to introduce Krill version 0.2.0 'Interkrillactic, Planetary'. Krill is software that allows organisations to run Delegated RPKI under one or more Regional Internet Registries, i.e. ARIN, APNIC, LACNIC, AFRINIC and RIPE NCC, offering centralised and automated management of route authorisations.

If you are …

Unbound 1.9.4 released

NLnet Labs — Thu, 03 Oct 2019 11:30:00 +0200

We are pleased to announce the release of version 1.9.4 of the Unbound recursive DNS resolver.

This release is a fix for vulnerability CVE-2019-16866 that causes a failure when a specially crafted query is received.

We would like to thank X41 D-Sec for notifying us about this vulnerability …

NLnet Labs Annual Report 2018

NLnet Labs — Wed, 11 Sep 2019 14:00:00 +0200

2018 was a great year for NLnet Labs. Our long running open source projects got a great number of improvements, we hired new staff members, started a major new project in the area of inter-domain routing and we increased our focus on research.

We are incredibly proud to be able …

Routinator 0.6.0 ‘Pink Sombrero’ released

NLnet Labs — Tue, 10 Sep 2019 15:00:00 +0200

We are jubilant to announce the latest release of Routinator, version 0.6.0 ’Pink Sombrero.’

This release adds …

Unbound 1.9.3 released

NLnet Labs — Tue, 27 Aug 2019 10:00:00 +0200

We are pleased to announce the release of version 1.9.3 of the Unbound recursive DNS resolver.

This release has a number of bug fixes. Added is the ipset module, that helps add ip-addresses that are looked up in a domain to a firewall ip-address filter. Also, the python …

Measuring the Impact of DNS Flag Day

NLnet Labs — Mon, 19 Aug 2019 16:00:00 +0200

DNS Flag Day was the result of a collaborative effort and agreement of DNS implementers and DNS resolver operators to commit to no longer providing workarounds for non-standards-compliant authoritative nameservers as of 1 February 2019.

In the lead up to DNS Flag Day, and as part of the outreach, the …

NSD 4.2.2 released

NLnet Labs — Mon, 19 Aug 2019 11:15:00 +0200

Today, we released version 4.2.2 of the authoritative DNS name server NSD.

This release fixes a number of, smaller, bugs. Several failures are fixed in the zone file parser, reported by fuzzing from Frederic Cambus.

NSD now warns when a zonefile is parsed with SSHFP records in it …

Progressing OpenDNSSEC

NLnet Labs — Tue, 30 Jul 2019 16:00:00 +0200

Since the release of OpenDNSSEC 2 we’ve made incremental updates leading to the most recent 2.1.4 release. These updates all have been geared towards ironing out issues and contained only minor improvements. The frequency of updates has been modest, mostly because because of good news: we have …

ldns 1.7.1 released

NLnet Labs — Fri, 26 Jul 2019 00:00:00 +0200

Besides many bugfixes, this release also has a few new features:

Support for DNSSEC algorithms ED25519 and ED448 when compiled with OpenSSL 1.1.1
An -I option to ldns-notify to specify a source IP address to send to notify from.
Complete OpenSSL engine support with ldns-signzone contributed by Vadim …

Routinator 0.5.0 ‘Why Not Try a Holiday in Sweden This Year?’ released

NLnet Labs — Thu, 18 Jul 2019 15:00:00 +0200

We are rather thrilled to announce the latest release of Routinator, version 0.5.0 ‘Why Not Try a Holiday in Sweden This Year?’

Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them …

NSD 4.2.1 released

NLnet Labs — Tue, 09 Jul 2019 10:00:00 +0200

Today, we released version 4.2.1 of the authoritative DNS name server NSD.

This release fixes issues in the stream handling, from 4.2.0, but also earlier, in the event handling of streams.

The new statistics counters for TLS can give information about how many incoming DNS over …

Hackathon @ Africa Internet Summit 2019

NLnet Labs — Thu, 04 Jul 2019 13:40:00 +0200

The ISOC African regional bureau has been organizing hackathons at the last three editions of the Africa Internet Summit in the same spirit as those of the IETF (hack to support Open Standards development). These hackathons also have the additional purpose to involve the Africa region better and more in …

Unbound 1.9.2 released

NLnet Labs — Mon, 17 Jun 2019 11:00:00 +0200

We are pleased to announce the release of version 1.9.2 of the Unbound recursive DNS resolver.

This release contains a number of bug fixes for crashes introduced in 1.9, session ticket code, stream pipeline code, auth zone code and it also fixes qname minimisation packet scrub failures …

DNSSEC Key Management Tools Research Project Awarded

NLnet Labs — Wed, 12 Jun 2019 13:40:00 +0200

NLnet Labs has recently been awarded a grant from the European Commission's NGI0 PET funding to invest in improving how operators of high-stakes domains (such as top-level domains) manage their sensitive key material for DNSSEC signing. The outcome of the project, open source tools and processes for secure key management …

NSD 4.2.0 released

NLnet Labs — Tue, 11 Jun 2019 14:20:00 +0200

Today, we released version 4.2.0 of the authoritative DNS name server NSD.

This release contains new features, contributed from Sinodun, that implement TCP fast open support and also support for service on DNS over TLS.

There is also TLS OCSP stapling support with the tls-service-ocsp option in nsd …

Routinator 0.4.0 ‘The Bumpy Road to Love’ released

NLnet Labs — Mon, 03 Jun 2019 15:00:00 +0200

We are euphoric to announce the latest release of Routinator, version 0.4.0 ‘The Bumpy Road to Love.’

NSD and Unbound repositories moving to GitHub on 1 May 2019

NLnet Labs — Fri, 19 Apr 2019 09:00:00 +0200

We are excited to announce that on the 1st of May 2019, we will migrate the NSD and Unbound repositories to git and use GitHub for maintaining them. We are also going to use the GitHub infrastructure to manage tasks and community contributions, collect user feedback and allow you to …

"A First Look at QNAME Minimization" paper wins Best Dataset Award at PAM2019

NLnet Labs — Fri, 29 Mar 2019 15:19:00 +0100

Three NLnet Lab rats - Ralph Dolmans, Roland van Rijswijk-Deij and Willem Toorop - worked together with Wouter de Vries (University of Twente), Moritz Müller (SIDN Labs) and Quirin Scheitle (TUM) on the paper A First Look at QNAME Minimization in the Domain Name System. The paper was awarded the "Best Dataset …

Routinator 0.3.2 ‘Bitter and Twisted’ released

NLnet Labs — Wed, 27 Mar 2019 12:00:00 +0100

We are disheartened to announce yet another bugfix release of the Routinator, version 0.3.2 ‘Bitter and Twisted.‘

Routinator is an RPKI relying party software that collects and validates statements made in the Resource Public Key Infrastructure (RPKI) about allowed route origins and provides them to routers and curious …

NSD 4.1.27 released

NLnet Labs — Mon, 25 Mar 2019 13:40:00 +0100

Today, we released version 4.1.27 of the authoritative DNS name server NSD.

This release contains improved deny-any responses, and on-the-fly changes for tsig keys via nsd-control. There is a number of bug fixes as well.

You can get source packages of this version from the downloads page.

Related …

Unbound 1.9.1 released

NLnet Labs — Mon, 11 Mar 2019 10:00:00 +0100

We are pleased to announce the release of version 1.9.1 of the Unbound recursive DNS resolver.

This release contains bug fixes for two issues in the out of order processing introduced in 1.9.0, one where the wrong answer was returned and a crash bug in file …

Routinator 0.3.1 ‘More Intensity’ released

NLnet Labs — Wed, 06 Mar 2019 15:00:00 +0100

We are enthused to announce the latest release of the Routinator, version 0.3.1 ‘More Intensity.‘

Routinator 0.3.0 ’It’s More Fun at the Zoo’ released

NLnet Labs — Thu, 14 Feb 2019 16:00:00 +0100

We are elated to announce the latest release of the Routinator, version 0.3.0 ’It’s More Fun at the Zoo’.

Routinator is an RPKI relying party software that collects and validates statements made in the Resource Public Key Infrastructure (RPKI) about allowed route origins and provides them to …

Unbound 1.9.0 released

NLnet Labs — Tue, 05 Feb 2019 10:00:00 +0100

We are pleased to announce the release of version 1.9.0 of the Unbound recursive DNS resolver.

This release contains the DNS Flag Day changes for Unbound. See the reference here, https://dnsflagday.net/ . Or this presentation: EDNS Flag Day - OARC29.pdf . The EDNS timeouts are not used to …

Mozilla Open Source Support programme awards grant for the Routinator

NLnet Labs — Mon, 07 Jan 2019 10:00:00 +0100

We are incredibly excited to announce that the Mozilla Open Source Support (MOSS) programme has awarded a grant for the development of the Routinator, NLnet Labs’ RPKI Relying Party software that helps make Internet routing more secure.

The MOSS awards programme supports open source projects that contribute to Mozilla’s …

Routinator 0.2.1 ‘Rated R’ released

NLnet Labs — Fri, 04 Jan 2019 12:00:00 +0100

We are stoked to announce the first release of Routinator in 2019, version 0.2.1 ‘Rated R.’

Dutch National Cyber Security Centre joins in funding NLnet Labs' RPKI toolset development

NLnet Labs — Tue, 18 Dec 2018 09:00:00 +0100

The National Cyber Security Centre (NCSC) of the Netherlands has pledged to participate in funding the development of the RPKI toolset by NLnet Labs.

The NCSC is the central information hub and centre of expertise for cyber security in the Netherlands. The NCSC's mission is to contribute to enhancing the …

Routinator 0.2.0 ‘Instant Gezellig’ released

NLnet Labs — Wed, 12 Dec 2018 15:00:00 +0100

We are exhilarated to announce the latest release of the Routinator, version 0.2.0 ‘Instant Gezellig.’

Unbound 1.8.3 released

NLnet Labs — Tue, 11 Dec 2018 11:42:00 +0100

We are pleased to announce the release of version 1.8.3 of the Unbound recursive DNS resolver.

This release fixes crash bug introduced in 1.8.2 in the dns64 processing.

For a full list of changes and binary and source packages, see the download page.

Related links:

Unbound …

OpenINTEL wins Research Data NL Prize

NLnet Labs — Tue, 04 Dec 2018 15:19:00 +0100

The OpenINTEL project that NLnet Labs recently joined has been awarded the Research Data NL Prize. OpenINTEL received the prize for making groundbreaking data on the long-term development of the DNS available for research.

Related links:

Blogpost: The Ongoing Story of OpenINTEL

Unbound 1.8.2 released

NLnet Labs — Tue, 04 Dec 2018 13:56:00 +0100

We are pleased to announce the release of version 1.8.2 of the Unbound recursive DNS resolver.

The option so-reuseport is by default disabled on FreeBSD, but it has support to work on FreeBSD 12 with the REUSEPORT_LB variant, if enabled in unbound.conf.

The python code in unbound …

NSD 4.1.26 released

NLnet Labs — Tue, 04 Dec 2018 11:40:00 +0100

Today, we released version 4.1.26 of the authoritative DNS name server NSD.

This version has DNSTAP support (http://dnstap.info). Use --enable-dnstap for ./configure to turn it on, then in nsd.conf enable the dnstap feature with dnstap-enable: yes and set one or more of dnstap-log-..-messages to …

Introducing a new logo family for our DNS projects

NLnet Labs — Tue, 20 Nov 2018 13:50:00 +0100

Who knew branding could be this much fun? As a small, open source organisation we mostly spend our time on writing code. But several months ago, we wanted to see if we could replace the generic icons we were using for our projects with some fresh and shiny logos. It …

NLnet Labs joins OpenINTEL

NLnet Labs — Mon, 12 Nov 2018 12:00:00 +0100

We're proud to join the OpenINTEL measurement platform.

The goal of OpenINTEL is to capture daily snapshots of the state of large parts of the global Domain Name System. Because the DNS plays a key role in almost all Internet services, recording this information allows OpenINTEL to track changes on …

Routinator 0.1.1 ‘Five-second Rule’ release

NLnet Labs — Mon, 05 Nov 2018 16:00:00 +0100

We are slightly embarrassed to announce the first bugfix release of the Routinator: version 0.1.1 ‘Five-second Rule.’

Routinator is an RPKI relying party software that collects and validates statements made in the Resource Public Key Infrastructure (RPKI) about allowed route origins and provides them to routers.

This release …

Routinator 0.1.0 ‘Godspeed!’ released

NLnet Labs — Thu, 01 Nov 2018 13:00:00 +0100

We are extremely delighted to announce the very first release of the Routinator, version 0.1.0 ‘Godspeed!’

In the modern Internet, routing security is becoming increasingly important. Resource Public Key Infrastructure (RPKI) is a powerful component in preventing BGP hijacking. The system allows network operators to create cryptographically validatable …

Unbound 1.8.1 released

NLnet Labs — Mon, 08 Oct 2018 13:20:00 +0200

We are pleased to announce the release of version 1.8.1 of the Unbound recursive DNS resolver.

This release of Unbound contains a number of bug fixes. A memory leak in the TLS lookup code is fixed. Leaked requests in the requestlist are fixed. Lookup failure due to qname …

NSD 4.1.25 released

NLnet Labs — Tue, 25 Sep 2018 00:00:00 +0200

Today, we released version 4.1.25 of the authoritative DNS name server NSD.

This release contains mostly just bug fixes. The NSEC3 fixup helps certain NSEC3 failures, and there is a fix for systemd integration.

You can get source packages of this version from the downloads page.

Related links …

Unbound 1.8.0 released

NLnet Labs — Mon, 10 Sep 2018 14:20:00 +0200

We are pleased to announce the release of version 1.8.0 of the Unbound recursive DNS resolver.

This release has a number of bug fixes, a list of features added and some defaults changed.

The defaults that are changed enable options that have been introduced in the past with …

NSD 4.1.24 released

NLnet Labs — Mon, 13 Aug 2018 00:00:00 +0200

Today, we released version 4.1.24 of the authoritative DNS name server NSD.

This version has a fix for a bug in resigning zones with different NSEC3 salt, where NSD would not pick up the NSEC3PARAM record, and serve answers that omit NSEC3 records. NSD is now lenient and …

Introducing Routinator, a new RPKI Validator

NLnet Labs — Mon, 06 Aug 2018 12:30:00 +0200

NLnet Labs has committed to building a full open source RPKI toolset to help make BGP routing more secure. This work consists of three projects. We will offer a Certificate Authority (CA) package, allowing network operators to run RPKI on their own systems instead of using the hosted platforms offered …

NSD 4.1.23 released

NLnet Labs — Mon, 30 Jul 2018 00:00:00 +0200

Today, we released version 4.1.23 of the authoritative DNS name server NSD.

NSD versions 4.1.22 and before are vulnerable in comparing TSIG information and this can be used to discover a TSIG secret.

NSD uses TSIG to protect zone transfers. The TSIG code uses a secret …

DNSSEC trigger 0.17

NLnet Labs — Mon, 25 Jun 2018 11:10:00 +0200

This release of version 0.17 fixes an infinite loop in dnssec-trigger introduced with fixes on the patch on the 0.16 release.

Related links:

DNSSEC trigger 0.16

NLnet Labs — Thu, 21 Jun 2018 14:00:00 +0200

This release has a fix for the reports about .uk.uk. The patchset from Martin Sehnoutka is integrated, it moves functionality from the linux network change script into the dnssec-trigger process.

Related links:

Unbound 1.7.3 released

NLnet Labs — Thu, 21 Jun 2018 10:10:00 +0200

We are pleased to announce the release of version 1.7.3 of the Unbound recursive DNS resolver.

This release fixes a bug in qname minimisation, from 1.7.1, that double counts CNAMEs and this causes resolution failures because the maximum CNAME count is hit. This caught attention because …

Unbound 1.7.2 released

NLnet Labs — Mon, 11 Jun 2018 11:40:00 +0200

We are pleased to announce the release of version 1.7.2 of the Unbound recursive DNS resolver. There are a number of bug fixes, but also some features.

This release fixes bugs in DNS-over-TLS for windows, and adds the option for Windows users to use the CA certificates from …

NSD 4.1.22 released

NLnet Labs — Mon, 11 Jun 2018 00:00:00 +0200

Today, we released version 4.1.22 of the authoritative DNS name server NSD.

This release fixes a bug where zone transfers would not succeed, because of an error in the selective NSEC3 allocation (introduced in 4.1.18).

The refuse ANY query feature now sends truncated answers over UDP …

Putting an End to Workarounds for Broken Software

NLnet Labs — Thu, 07 Jun 2018 00:00:00 +0200

The specification of the DNS protocol and its extensions in the IETF, the implementation of the protocol standards and its compliance, and the interoperability between DNS name server implementations give rise of complex interdependencies. For one, the IETF standards sometimes allow room for different interpretations resulting in slightly varying behavior …

NSD 4.1.21 released

NLnet Labs — Mon, 14 May 2018 00:00:00 +0200

Today, we released version 4.1.21 of the authoritative DNS name server NSD.

This release introduces query type ANY refusal. NSD already has RRL support that by default throttles queries, and also queries of type ANY. But an nsd.conf option has been added, this makes NSD refuse queries …

Unbound 1.7.1 released

NLnet Labs — Thu, 03 May 2018 11:20:00 +0200

We are pleased to announce the release of version 1.7.1 of the Unbound recursive DNS resolver. There are a number of bug fixes, but also some features.

This release has root key sentinel support, default on, from draft draft-ietf-dnsop-kskroll-sentinel. The root key sentinel helps the root key rollover …

Benno Overeinder appointed DNSOP co-chair

NLnet Labs — Thu, 12 Apr 2018 00:00:00 +0200

In the IETF, the DNS Operations (DNSOP) Working Group serves as the shepherd of the DNS protocols. It develops guidelines for the operation of DNS software and services as well as the operation of DNS zones. In addition, it has become the starting point for proposed extensions and improvements to …

New website launch

NLnet Labs — Wed, 04 Apr 2018 00:00:00 +0200

We are proud to launch a brand new website for NLnet Labs, with a sleek new logo and fresh content.

Our new home offers a comprehensive overview of the projects we maintain, as well as the research, community and standards work we do. The previous website was getting a bit …

Unbound 1.7.0 released

NLnet Labs — Thu, 15 Mar 2018 00:00:00 +0100

We are pleased to announce the release of version 1.7.0 of the Unbound recursive DNS resolver. Apart from numerous big fixes, this version introduces some important new features.

Authority zones is an option that makes it possible to transfer an authoritative zone to Unbound. These transfers can happen …

NSD 4.1.20 released

NLnet Labs — Tue, 20 Feb 2018 00:00:00 +0100

Today, we released version 4.1.20 of the authoritative DNS name server NSD.

This version is a bug fix release intended to close two memory leaks. One leak may occur when reading the data of unknown record types from zone files, while the other may happen when rehashing NSEC3 …

Net::DNS 1.15 released

NLnet Labs — Fri, 09 Feb 2018 00:00:00 +0100

This release has no bugs resolved nor any new features. Besides some minor code maintenance, this release only adds a Change notice to formalize the retirement of the GOST R 34.11-94 hash algorithm. However, the GOST algorithm will still work when a functional Digest::GOST module is present.

Related …

The peculiar case of NSEC processing using expanded wildcard records

NLnet Labs — Tue, 30 Jan 2018 00:00:00 +0100

We discovered a vulnerability in the processing of wildcard synthesized NSEC records. The result was Unbound, Google public DNS, PowerDNS and Dnsmasq contained a flaw that made it possible to downgrade secure connections. While synthesis of NSEC records is allowed by RFC 4592, these synthesized owner names should not be …

Bringing DNS Security and Privacy to the End User

NLnet Labs — Wed, 24 Jan 2018 00:00:00 +0100

How the getdns API project helps to achieve the goal of DNSSEC validation and DANE authentication at the end-points.

Related links:

Blog post

Unbound 1.6.8 released

NLnet Labs — Fri, 19 Jan 2018 00:00:00 +0100

Unbound 1.6.8 fixes CVE-2017-15105: vulnerability in the processing of wildcard synthesized NSEC records.

Related links:

NSD 4.1.19 released

NLnet Labs — Mon, 11 Dec 2017 00:00:00 +0100

This release fixes IPv6 for the notify sending feature from 4.1.18.

Related links:

DNSSEC trigger 0.15

NLnet Labs — Wed, 06 Dec 2017 00:00:00 +0100

This release fixes failure to start on OSX and Windows.

Related links:

NSD 4.1.18 released

NLnet Labs — Thu, 30 Nov 2017 00:00:00 +0100

This release has features for saving memory and faster notification.With --enable-packed, 33% memory savings could be had, or somethingalong that size. Notification of secondary servers happens in parallel,and has faster timeouts. More sockets are used for zone transfers.This speeds up communication with a larger set of servers …

Privacy: Using DNS-over-TLS with the new Quad9 DNS Service

NLnet Labs — Mon, 20 Nov 2017 00:00:00 +0100

Hands-on install & configure of getdns and stubby to use DNS-over-TLS with Quad9 DNS service.

Related links:

Blog post

Net::DNS 1.13 released

NLnet Labs — Wed, 18 Oct 2017 00:00:00 +0200

IDNA queries with Net::LibIDNS2

Related links:

DNSSEC trigger 0.14

NLnet Labs — Tue, 10 Oct 2017 00:00:00 +0200

This release fixes install problems on OSX Sierra and High Sierra. The binary packages bundle the just-released unbound 1.6.7 that sends telemetry data about the root trust anchor.

Related links:

Unbound 1.6.7 released

NLnet Labs — Tue, 10 Oct 2017 00:00:00 +0200

Unbound 1.6.7 sets the default for trust anchor signaling to yes. Thismakes a query with the key tags of the validation keys when the trustanchor DNSKEY is retrieved.

Related links:

Akkerhuis inductee Internet Hall of Fame

NLnet Labs — Tue, 19 Sep 2017 00:00:00 +0200

Jaap Akkerhuis, NLnet Lab's senior research engineer and longtime contributor to the Internet technical community, is inducted into the Internet Hall of Fame. Follow the link below to read more on the background and contributions of Jaap's work in the past 40 year.

Related links:

Akkerhuis inductee IHoF2017

Unbound 1.6.6 released

NLnet Labs — Mon, 18 Sep 2017 00:00:00 +0200

Unbound 1.6.6 blocks .test and .invalid by default. It has a -p optionto suppress pidfile creation (for startup script integration). And morestats and a shared secret cache for dnscrypt. And bug fixes.

Related links:

Sjoera Nas joined NLnet Labs board

NLnet Labs — Wed, 13 Sep 2017 00:00:00 +0200

Sjoera Nas joined the board of NLnet Labs. She is an Internet and telecom privacy expert affiliated with Autoriteit Persoonsgegevens (Dutch DPA). We are delighted that she joined the board and will contribute with advice and guidance.

DNSSEC training at APTLD 72

NLnet Labs — Mon, 11 Sep 2017 00:00:00 +0200

Berry van Halderen and Jaap Akkerhuis will give a two day DNSSEC course during the APTLD 72 meeting in Tbilisi (Sep 12-13). The course will cover DNS fundamentals, DNSSEC building blocks, policies and hands-on with OpenDNSSEC.

Related links:

APTLD 72 Agenda

Unbound 1.6.5 released

NLnet Labs — Mon, 21 Aug 2017 00:00:00 +0200

Unbound 1.6.5 fixes RFC5011 Trust Anchor tracking for users that install between September 11 and October 11, 2017.

Related links:

Net::DNS 1.12 released

NLnet Labs — Fri, 18 Aug 2017 00:00:00 +0200

Bugfixes and CDS and CDNSKEY printing according to erratum 5049 for RFC8078

Related links:

NSD 4.1.17 released

NLnet Labs — Fri, 21 Jul 2017 00:00:00 +0200

This release has a fix that likely stops zone transfer failures and this release can parse the pre-errata and fixed errata format for deletes in CDS and CDNSKEY records.

Related links:

NLnet Labs Annual Report 2016

NLnet Labs — Fri, 30 Jun 2017 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2016. In it we present an overview of Labs' various activities and describe their impact.

Related links:

Annual Report 2016 (PDF)

Unbound 1.6.4 released

NLnet Labs — Tue, 27 Jun 2017 00:00:00 +0200

Unbound 1.6.4 contains key tag signaling RFC8145 support. B root is renumbered in the default root hints. The dnscrypt code supports the chacha cipher. The Unbound DNSSEC validator supports the ED25519 algorithm. The redirect-bogus patch in contrib can send validation failure users to a landing page.

Related links …

Net::DNS 1.11 released

NLnet Labs — Mon, 26 Jun 2017 00:00:00 +0200

Maintenance work on IBM OS/390 support, ndots option in /etc/resolv.conf, workaround for hashpairs with cperl >= 5.27, zeroed waiting with bgbusy and EDNS size 512 queries

Related links:

Unbound 1.6.3 released

NLnet Labs — Tue, 13 Jun 2017 00:00:00 +0200

Unbound 1.6.3 fixes an assertion failure when a malformed packet is received with 0x20 enabled.

Related links:

Net::DNS 1.10 released

NLnet Labs — Fri, 05 May 2017 00:00:00 +0200

Bugfixes for Cygwin and MSWin32 environments. EBCDIC support updated. IBM OS/390 support

Related links:

NSD 4.1.16 released

NLnet Labs — Tue, 25 Apr 2017 00:00:00 +0200

This release contains the minimal response nsd.conf option and bug fixes.

Related links:

Unbound 1.6.2 released

NLnet Labs — Mon, 24 Apr 2017 00:00:00 +0200

Unbound 1.6.2 has a couple of new features and a list of bug fixes: trustanchor.unbound chaos query, response IP actions, stats from shm, --disable-sha1, dnscrypt support, and edns client subnet support merged in.

Related links:

getdns 1.1.0 released

NLnet Labs — Thu, 13 Apr 2017 00:00:00 +0200

Functions for serving DNS. Stubby on board!

Related links:

Net::DNS 1.09 released

NLnet Labs — Fri, 24 Mar 2017 00:00:00 +0100

Structured EDNS0 options

Related links:

Unbound 1.6.1 released

NLnet Labs — Tue, 21 Feb 2017 00:00:00 +0100

Unbound 1.6.1 has the 2017 root trust anchor in unbound-anchor. The libunbound API has changed slightly, the callback typedef ends in _type. Source IP rate limiting, log-replies, and the release also has other new features and bug fixes.

Related links:

Net::DNS 1.08 released

NLnet Labs — Mon, 20 Feb 2017 00:00:00 +0100

20th Anniversary, UPDATE and EDNS0 options handling for Net::DNS::Nameserver, better ineffective installs detection

Related links:

NSD 4.1.15 released

NLnet Labs — Thu, 16 Feb 2017 00:00:00 +0100

This release contains bugfixes, in serial number parsing and nsec3 hash collision reporting.

Related links:

getdns 1.0.0 released

NLnet Labs — Tue, 17 Jan 2017 00:00:00 +0100

First spec complete implementation of getdns

Related links:

Net::DNS 1.07 released

NLnet Labs — Thu, 29 Dec 2016 00:00:00 +0100

Bugfixes and general maintenance work

Related links:

ldns 1.7.0 released

NLnet Labs — Tue, 20 Dec 2016 00:00:00 +0100

Bugfixes and maintenance work, DANE verification delegated to OpenSSL functions, OpenSSL 1.1.0 support

Related links:

DNSSEC trigger 0.13

NLnet Labs — Thu, 15 Dec 2016 00:00:00 +0100

Updated included binaries and installer for OSX.

Related links:

Unbound 1.6.0 released

NLnet Labs — Thu, 15 Dec 2016 00:00:00 +0100

Unbound 1.6.0 has a number of features and bugfixes. More extensibleEDNS support. Views and local-zone tags provide for more feature rich filtering options, with CNAME support. SSL configuration features to turn on DNS over TLS for particular parts of the namespace. There were some bug fixes as well …

NSD 4.1.14 released

NLnet Labs — Thu, 08 Dec 2016 00:00:00 +0100

This version performs less zone transfer attempts, reducing load on the server. The xfrd state file has a new version number, to store theinformation. The new version of the file is written on exit of the daemon. And bug fixes.

Related links:

A Hybrid System for Automatic Exchanges of Routing Information

NLnet Labs — Fri, 02 Dec 2016 00:00:00 +0100

The exchange of routing information for BGP configurations is a critical functionality that help autonomous systems communicate with each other in an efficient and robust way. In this work, we propose a hybrid system for automatic exchange of routing information. It addresses security and benefits from using a hybrid model …

DNS-Based Email Security -- DRAFT

NLnet Labs — Wed, 02 Nov 2016 00:00:00 +0100

NLnet Labs contributed to the NIST SP 1800-6 DNS-Based Email Security report. Scenarios and practical instructions to use DNSSEC and DANE to secure email exchange (authentication and encryption of email and mail services).

Related links:

DNS-Based Secured Email

NSD 4.1.13 released

NLnet Labs — Tue, 27 Sep 2016 00:00:00 +0200

Some features, such as multi master check option that does not upgrade from the first master that answers, but picks the best one. Additional section handling for type SRV. And bug fixes.

Related links:

Unbound 1.5.10 released

NLnet Labs — Tue, 27 Sep 2016 00:00:00 +0200

In this release there is a fix for long downtime after connectivity loss, which was a longstanding unsolved issue. Features for tcp, TCPFast Open and timeout pressure to close connections when the tcp connections are getting full. Option to use ipv6 /64 for extra entropy. More bug fixes.

Related links …

NSD 4.1.12 released

NLnet Labs — Fri, 02 Sep 2016 00:00:00 +0200

Fix malformed edns query assertion failure, reported by Michal Kepien (NASK).

Related links:

Net::DNS::SEC 1.03 released

NLnet Labs — Fri, 26 Aug 2016 00:00:00 +0200

100% Code coverage in unit tests

Related links:

NSD 4.1.11 released

NLnet Labs — Tue, 09 Aug 2016 00:00:00 +0200

Fix for unlimited AXFR vuln, for build without IPv6 and serve DS records for co-hosted parent zone, and other fixes.

Related links:

NLnet Labs Annual Report 2015

NLnet Labs — Thu, 30 Jun 2016 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2015. In it we present an overview of Labs' various activities and describe their impact.

Related links:

Annual Report 2015 (PDF)

NSD 3.2.22 released

NLnet Labs — Tue, 14 Jun 2016 00:00:00 +0200

Bug fixes accrued before end of support. Note that 3.2.x has end-of-support.

Related links:

NSD 4.1.10 released

NLnet Labs — Tue, 14 Jun 2016 00:00:00 +0200

Transport preference for glue, DNAME occlusion, and other bug fixes.

Related links:

Unbound 1.5.9 released

NLnet Labs — Thu, 09 Jun 2016 00:00:00 +0200

New IPv6 address for one of the root servers in the default root server configuration. And a number of bug fixes, for CD flags to forwarders, for 0x20 compatibility, for qname-minimisation with DNSSEC.

Related links:

Net::DNS 1.06 released

NLnet Labs — Fri, 27 May 2016 00:00:00 +0200

Bugfixes and updated error reporting

Related links:

NSD 4.1.9 released

NLnet Labs — Tue, 15 Mar 2016 00:00:00 +0100

Fix crash on upgrade to 4.1.8 in nsd.db read.

Related links:

NSD 3.2.21 released

NLnet Labs — Thu, 10 Mar 2016 00:00:00 +0100

Fix segv in zone transfer. Note that 3.2.x has end-of-support.

Related links:

NSD 4.1.8 released

NLnet Labs — Thu, 10 Mar 2016 00:00:00 +0100

Fix segv in zone transfer, nanosecond file timestamps and other fixes.

Related links:

Net::DNS 1.05 released

NLnet Labs — Mon, 07 Mar 2016 00:00:00 +0100

Bugfixes + SMIMEA support

Related links:

Unbound 1.5.8 released

NLnet Labs — Wed, 02 Mar 2016 00:00:00 +0100

Bug fixes, fix unbound-control-setup lines, fix GOST-hash failures, block .onion leakage.

Related links:

getdns 0.9 released

NLnet Labs — Thu, 31 Dec 2015 00:00:00 +0100

Special New Year's Eve release of getdns. This release brings the implementation on par with the December 2015 version of the specification.

Related links:

NSD 3.2.20 released

NLnet Labs — Thu, 10 Dec 2015 00:00:00 +0100

Formerr ratelimits, expired zones are fully fetched, other fixes. Note that 3.2.x has the end-of-support announced.

Related links:

NSD 4.1.7 released

NLnet Labs — Thu, 10 Dec 2015 00:00:00 +0100

Fix TCP on Linux and other fixes.

Related links:

Unbound 1.5.7 released

NLnet Labs — Thu, 10 Dec 2015 00:00:00 +0100

Fix a validation failure, newly added qname minimisation option, and other fixes.

Related links:

DNSSEC trigger 0.13 for OS X 10.11 released

NLnet Labs — Tue, 08 Dec 2015 00:00:00 +0100

Update and correct install on Mac OS X 10.11 (El Capitan) systems.

Related links:

Net::DNS 1.04 released

NLnet Labs — Tue, 08 Dec 2015 00:00:00 +0100

Emergency recovery and bugfix release

Related links:

CDAR Root Stability Study commissioned by ICANN

NLnet Labs — Thu, 03 Dec 2015 00:00:00 +0100

NLnet Labs, SIDN and TNO have been commissioned by ICANN to examine the impact of the new gTLD programme on the root server system.

Related links:

Press release

Net::DNS 1.03 released

NLnet Labs — Fri, 06 Nov 2015 00:00:00 +0100

Better TCP support and persistent sockets for bg(send|read|isready) functions

Related links:

NSD 4.1.6 released

NLnet Labs — Thu, 22 Oct 2015 00:00:00 +0200

Fix segfault when configured with many interfaces, and fix EDNS bad version response.

Related links:

Unbound 1.5.6 released

NLnet Labs — Tue, 20 Oct 2015 00:00:00 +0200

Fix occasional segfault in dns64 module and smaller fixes.

Related links:

Unbound 1.5.5 released

NLnet Labs — Tue, 06 Oct 2015 00:00:00 +0200

Algorithm lenience, H root IP, fixes in RFC5011 code and other bug fixes.

Related links:

NSD 4.1.5 released

NLnet Labs — Mon, 21 Sep 2015 00:00:00 +0200

Fixes flaw in 4.1.4 that served 127.0.0.1 by default instead of 0.0.0.0.

Related links:

Net::DNS 1.02 released

NLnet Labs — Wed, 16 Sep 2015 00:00:00 +0200

Resolver bugfixes for handling ENTs in delegations

Related links:

Net::DNS::SEC 1.02 released

NLnet Labs — Wed, 16 Sep 2015 00:00:00 +0200

Bugfix in unit test

Related links:

NSD 4.1.4 released

NLnet Labs — Wed, 09 Sep 2015 00:00:00 +0200

Fix fetching expired zones with wrong serial management, fix short NSID responses, URI type.

Related links:

Net::DNS::SEC 1.01 released

NLnet Labs — Mon, 03 Aug 2015 00:00:00 +0200

Crypto funcs for Net::DNS 1.01 DNSSEC RR's

Related links:

getdns 0.3.1 released

NLnet Labs — Sat, 18 Jul 2015 00:00:00 +0200

Bugfixes, native stub DNSSEC validation, lists of transports

Related links:

Unbound 1.5.4 released

NLnet Labs — Thu, 09 Jul 2015 00:00:00 +0200

negative cache options, algorithm lenience option, rate limits and bug fixes.

Related links:

Net::DNS 1.01 released

NLnet Labs — Mon, 06 Jul 2015 00:00:00 +0200

First major release, DNSSEC RR's integrated

Related links:

NLnet Labs Annual Report 2014

NLnet Labs — Tue, 30 Jun 2015 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2014. In it we present an overview of Labs' various activities and describe their impact.

Related links:

Annual Report 2014 (PDF)

NSD 4.1.3 released

NLnet Labs — Tue, 23 Jun 2015 00:00:00 +0200

bug fixes, fix when remove child zone, tsig hash algorithms, add long list of zones more easily.

Related links:

NSD 3.2.19 released

NLnet Labs — Thu, 28 May 2015 00:00:00 +0200

Bugfixes, tsig hashes, CDS, CDNSKEY, DNAME TTL. End-of-life has been announced for NSD 3 support.

Related links:

NSD 3 end of support May 20th, 2016

NLnet Labs — Wed, 20 May 2015 00:00:00 +0200

With this notification, NLnet Labs makes known the end-of-support for NSD 3. Support for NSD 3 will be continued for one year (date May 20th, 2016).

Related links:

NSD 4.1.2 released

NLnet Labs — Tue, 14 Apr 2015 00:00:00 +0200

log level 1 improvements, log notify serial, zone reader crash fixes, integer overflow bugfixes.

Related links:

getdns 0.1.7 released

NLnet Labs — Wed, 08 Apr 2015 00:00:00 +0200

Bugfixes, internal rework and printing of JSON dicts

Related links:

Unbound 1.5.3 released

NLnet Labs — Tue, 10 Mar 2015 00:00:00 +0100

Fix daemon exit after reload, and Solaris portability.

Related links:

BGP Route Leaks Analysis

NLnet Labs — Fri, 06 Mar 2015 00:00:00 +0100

A route leak is a violation of the policies between the networks involved. In this project, we obtain routing information from differecent sources and make inferences to detect possible route leaks. These potential route leaks have been further investigated on their duration, the type of violation, and the type and …

Net::DNS 0.83 released

NLnet Labs — Thu, 26 Feb 2015 00:00:00 +0100

Bug fixes

Related links:

Unbound 1.5.2 released

NLnet Labs — Thu, 19 Feb 2015 00:00:00 +0100

Fix validation failure, poison issue with harden-glue off, and add RPZ-style 'inform' local-zone, and control over unix pipes.

Related links:

Net::DNS::SEC 0.22 released

NLnet Labs — Wed, 11 Feb 2015 00:00:00 +0100

RRSIG inception and exception in time values, ECDSA and Gost signature creation and verification, Version requirements detection for optional modules

Related links:

Akkerhuis selected for DNS Root Zone KSK design team

NLnet Labs — Thu, 05 Feb 2015 00:00:00 +0100

Jaap Akkerhuis from NLnet Labs has been selected for the DNS Root Zone KSK rollover plan design team.

Related links:

ICANN Announcements

NSD 4.1.1 released

NLnet Labs — Tue, 03 Feb 2015 00:00:00 +0100

zonestatistics, DNAME's CNAME TTL. Fixes for database growth, spinning, and other bugfixes.

Related links:

Net::DNS 0.82 released

NLnet Labs — Tue, 20 Jan 2015 00:00:00 +0100

Single bug fix

Related links:

Unbound 1.5.1 released

NLnet Labs — Mon, 08 Dec 2014 00:00:00 +0100

CVE-2014-8602 denial of service fixed. Crash fix, compile fix. AAAA-filter patch.

Related links:

Unbound 1.5.0 released

NLnet Labs — Tue, 18 Nov 2014 00:00:00 +0100

DNS64, DNSTAP, better random numbers and ub_ctx_add_ta_autr(), num.query.tcpout=value, flush_negative, unblock-lan-zones conf and bug fixes

Related links:

ISC and NLnet Labs Joins Forces

NLnet Labs — Mon, 10 Nov 2014 00:00:00 +0100

ISC and NLnet Labs have signed an agreement to make available a combined Advance Security Notification subscription on their software products.

Related links:

Press release

getdns 0.1.5 beta released

NLnet Labs — Fri, 31 Oct 2014 00:00:00 +0100

Bugfixes and Hop-by-hop features for stub resolution

Related links:

Net::DNS 0.81 released

NLnet Labs — Wed, 29 Oct 2014 00:00:00 +0100

Bug fixes

Related links:

Net::DNS::SEC 0.21 released

NLnet Labs — Fri, 24 Oct 2014 00:00:00 +0200

Single bugfix: canonicalize RRSIG's Signer Name

Related links:

Net::DNS 0.80 released

NLnet Labs — Mon, 22 Sep 2014 00:00:00 +0200

Single bugfix: Suppress "Too late to run INIT block ..." warnings

Related links:

NSD 4.1.0 released

NLnet Labs — Thu, 04 Sep 2014 00:00:00 +0200

features for less memory use, faster read/write, wildcard includes. Bugfixes, fixes slowdown after a long time.

Related links:

getdns 0.1.4 beta released

NLnet Labs — Wed, 03 Sep 2014 00:00:00 +0200

The fourth beta release of an open source implementation of the getdns API specification. This is an collaborative effort with Verisign and No Mountain Software.

Related links:

Wanted: software developer and senior developer/architect

NLnet Labs — Mon, 01 Sep 2014 00:00:00 +0200

We are looking for a software developer and a senior developer/architect to design and implement Open Source Software used in the heart of the Internet.

Related links:

Employment

Net::DNS 0.79 released

NLnet Labs — Fri, 22 Aug 2014 00:00:00 +0200

Bug fixes, Android OS support, OPENPGPKEY RR and a Net::DNS::Resolver::Recurse makeover

Related links:

Net::DNS::SEC 0.20 released

NLnet Labs — Fri, 15 Aug 2014 00:00:00 +0200

Single bugfix: parsing of zero NSEC3 salt

Related links:

BGP Evolution Analysis

NLnet Labs — Thu, 31 Jul 2014 00:00:00 +0200

The Internet has been growing rapidly for many years. A logical consequence of the growth trend is the increase in effort to discover reachability and routing information of all the networks. The project investigates the different components which together form the actual update message signal and tries to find a …

NSD 3.2.18 released

NLnet Labs — Mon, 28 Jul 2014 00:00:00 +0200

Bugfix release

Related links:

Net::DNS 0.78 released

NLnet Labs — Thu, 10 Jul 2014 00:00:00 +0200

Primarily bug fixes and multiline printing of TXT rdata

Related links:

Measuring the Deployment of DNSSEC over the Internet

NLnet Labs — Wed, 02 Jul 2014 00:00:00 +0200

The deployment of DNSSEC is measured with the RIPE Atlas infrastructure. The results provide new insight on the distribution of DNSSEC support among resolvers, and notably show that around 90% of resolvers are DNSSEC-aware, and about 30% validate answers.

Related links:

MSc. report (PDF)

Net::DNS 0.77 released

NLnet Labs — Fri, 13 Jun 2014 00:00:00 +0200

Fixing recent regressions, introducing an iterator interface to axfr() and more robust and secure resolver configuration processing

Related links:

NLnet Labs Annual Report 2013

NLnet Labs — Tue, 27 May 2014 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2013. In it we present an overview of Labs' various activities and describe their impact.

Related links:

Annual Report 2013 (PDF)

Net::DNS 0.76 released

NLnet Labs — Fri, 23 May 2014 00:00:00 +0200

OrderedDict([('tt', ['/etc/resolv.conf', 'nameserver']), ('#text', 'This is an emergency release fixing the parsing bug that evaluated only the last line.')])

Related links:

Dnssec-Trigger 0.12 released

NLnet Labs — Thu, 22 May 2014 00:00:00 +0200

experimental package that provides DNSSEC on personal computers. Bug fixes, ip address change in default config, software update.

Related links:

Net::DNS 0.75 released

NLnet Labs — Thu, 08 May 2014 00:00:00 +0200

Besides bugfixes zone transfers can now be TSIG verified

Related links:

Net::DNS::SEC 0.18 released

NLnet Labs — Thu, 08 May 2014 00:00:00 +0200

Bugfixes and exploit new Net::DNS architecture

Related links:

NSD 4.0.3 released

NLnet Labs — Fri, 14 Mar 2014 00:00:00 +0100

Fix start-stop problems.

Related links:

NSD 4.0.2 released

NLnet Labs — Wed, 12 Mar 2014 00:00:00 +0100

Fix memory leaks. Fix ipv6 by disable of recvmmsg. REFUSED for nonhosted zones.

Related links:

Unbound 1.4.22 released

NLnet Labs — Wed, 12 Mar 2014 00:00:00 +0100

no libldns dependency, fix trustanchor full filesystem, fix lenience on validation of nxdomain empty nonterminals

Related links:

getdns 0.1.0 beta released

NLnet Labs — Wed, 26 Feb 2014 00:00:00 +0100

The first beta release of an open source implementation of the getdns API specification. This is an collaborative effort with Verisign and No Mountain Software.

Related links:

Open Data Analysis to Retrieve Sensitive Information Regarding National-Centric Critical Infrastructures

NLnet Labs — Mon, 03 Feb 2014 00:00:00 +0100

Open Data repositories store a variety of information from country governments and private sectors. A concern is that with publishing data, sensitive information can be obtained by visual analytic techniques. The report shows that it is possible to retrieve precise locations where critical infrastructures overlap.

Related links:

MSc. report (PDF …

NSD 3.2.17 released

NLnet Labs — Mon, 27 Jan 2014 00:00:00 +0100

Bug fixes and CAA RRtype added.

Related links:

NSD 4.0.1 released

NLnet Labs — Mon, 27 Jan 2014 00:00:00 +0100

Fix segfaults for type WKS, for NSEC3-IXFRs in a co-hosted parent and child zone situation. CAA, EUI48, EUI64 support. smaller fixes.

Related links:

Net::DNS 0.74 released

NLnet Labs — Thu, 16 Jan 2014 00:00:00 +0100

Resolves a pressing bug with TSIG. Support for CAA, EUI48 and EUI64 RR types

Related links:

ldns 1.6.17 released

NLnet Labs — Fri, 10 Jan 2014 00:00:00 +0100

Many bugfixes, All current (draft) RR types implemented, Better ldns-verify-zone performance and Perl5 bindings with the DNS::LDNS module.

Related links:

Securing the last mile of DNS with CGA-TSIG

NLnet Labs — Wed, 08 Jan 2014 00:00:00 +0100

TSIG with shared keys is not scalable as a solution for the DNS last mile problem. CGA-TSIG extends TSIG with CGA so that shared secrets are no longer required. This research investigates the CGA-TSIG proposal by doing a security analysis and by making a PoC implementation in ldns.

Related links …

DNSSEC Audit Framework

NLnet Labs — Mon, 30 Dec 2013 00:00:00 +0100

In collaboration with SWITCH, the .CH and .LI registry, we have created a DNSSEC audit framework, that can be used to conduct a review of your or someone else's DNSSEC implementation.

Related links:

Net::DNS 0.73 released

NLnet Labs — Fri, 29 Nov 2013 00:00:00 +0100

Bugfixes, TSIG validation and TSIG support for HMAC-SHA1 .. HMAC-SHA512

Related links:

NSD 4.0.0 released

NLnet Labs — Tue, 29 Oct 2013 00:00:00 +0100

New major release with many features: dynamically reconfig to add and remove zones, more TCP support, many more zones loaded, faster speed.

Related links:

NLnet Labs Strategic Plan 2014

NLnet Labs — Wed, 09 Oct 2013 00:00:00 +0200

This is the first time we post this type of plan publicly. With this plan we intend to communicate who we are and where we are going, it serves the NLnet Labs Board and Staff but also the parties that support our mission and want to contribute financially.

Related links …

Unbound 1.4.21 released

NLnet Labs — Thu, 19 Sep 2013 00:00:00 +0200

bugfixes, y2038k, add_insecure, more includes, max-udp

Related links:

Experiences with MPTCP in an International OpenFlow Network

NLnet Labs — Tue, 03 Sep 2013 00:00:00 +0200

Keeping up with the network demand in order to transfer these data sets over the Internet is a challenge. Single links do not have enough capacity anymore. Therefore we need to install more interfaces in the servers and use all available paths in the network. In this paper we describe …

Discovery and Mapping of the Dutch National Critical IP Infrastructure

NLnet Labs — Mon, 12 Aug 2013 00:00:00 +0200

The research project entails the mapping and subsequent analysis of the AS-level interconnections between the organisations active as the Dutch critical infrastructure. One of the conclusions is that the Dutch critical infrastructure organisations are well interconnected but rely a lot on foreign entities for IP transit and even for carrying …

NSD 3.2.16 released

NLnet Labs — Mon, 22 Jul 2013 00:00:00 +0200

EUI48 and EUI64 RR types, improvements to RRL, new config options.

Related links:

Identifying Patterns in DNS Traffic

NLnet Labs — Tue, 09 Jul 2013 00:00:00 +0200

A visual analytics approach is used on a large set of DNS packet captures to gain insight into ways that authoritative name servers are abused for denial of service attacks. Several tools were developed to identify patterns in DNS queries and responses.

Related links:

MSc. report (PDF)

Wanted: Systems engineer

NLnet Labs — Mon, 17 Jun 2013 00:00:00 +0200

We are looking for a Junior Systems Engineer to provide support, maintain systems and design and implement Open Source Software used in the heart of the Internet.

Related links:

Employment

NLnet Labs Annual Report 2012

NLnet Labs — Mon, 27 May 2013 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2012. NLnet Labs is active in those areas where a long-breath can have a profound impact on the Internet societal value and 2012 was an interesting year in all areas on which NLnet Labs is active.

Related links:

Annual Report 2012 …

OpenDNSSEC 1.4.0 released

NLnet Labs — Mon, 22 Apr 2013 00:00:00 +0200

Version 1.4.0 of OpenDNSSEC has now been released. It includes support for AXFR and IXFR, both input and output; HSM login; and more. Also the Auditor is deprecated.

Related links:

More information

Unbound 1.4.20 released

NLnet Labs — Thu, 21 Mar 2013 00:00:00 +0100

bugfixes, TTL from libunbound

Related links:

Making do with what we've got: Using PMTUD for a higher DNS responsiveness

NLnet Labs — Thu, 28 Feb 2013 00:00:00 +0100

Exploration of improving DNS with IPv6 by responding to ICMPv6 PTB messages

Related links:

OpenDNSSEC 1.3.13 released

NLnet Labs — Wed, 20 Feb 2013 00:00:00 +0100

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Defending against DNS reflection amplification attacks

NLnet Labs — Mon, 18 Feb 2013 00:00:00 +0100

Measurements and analysis of defense mechanisms against DNS reflection and amplification attacks.

Related links:

NSD 3.2.15 released

NLnet Labs — Mon, 04 Feb 2013 00:00:00 +0100

RRL, ILNP RR types, improved TSIG initialization, bugfixes.

Related links:

Net::DNS 0.72 released

NLnet Labs — Fri, 28 Dec 2012 00:00:00 +0100

Minor bugfix release which resolves issues with TSIG introduced in 0.69.

Related links:

RFC6781: DNSSEC Operational Practices, Version 2

NLnet Labs — Mon, 24 Dec 2012 00:00:00 +0100

An updated set of practices for operating the DNS with security extensions (DNSSEC).

Related links:

RFC6781

Net::DNS 0.71 released

NLnet Labs — Sat, 15 Dec 2012 00:00:00 +0100

Critical bugfixes. A temporary workaround to make sa-update tick again.

Related links:

Unbound 1.4.19 released

NLnet Labs — Wed, 12 Dec 2012 00:00:00 +0100

bugfixes, RSAMD5 deprecated

Related links:

Net::DNS 0.70 released

NLnet Labs — Thu, 06 Dec 2012 00:00:00 +0100

OrderedDict([('br', None), ('#text', 'Internationalized Domain Names support in owner names and rdata fields.n Everything new in 0.69 + RFC6742 support')])

Related links:

OpenDNSSEC 1.3.12 released

NLnet Labs — Mon, 03 Dec 2012 00:00:00 +0100

Bugfix release. For downloads and more information about future releaseplans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Net::DNS::SEC 0.17 released

NLnet Labs — Thu, 29 Nov 2012 00:00:00 +0100

Bugfixes and validation of wildcard RR sets

Related links:

ldns 1.6.16 released

NLnet Labs — Tue, 13 Nov 2012 00:00:00 +0100

OrderedDict([('br', None), ('#text', 'ldns 1.6.14 and ldns 1.6.15 had a bug in creating empty bitmaps for NSEC3 on empty non-terminals; and were unable to build a loadable pyldns module.This release has those two bugs resolved.')])

Related links:

OpenDNSSEC 1.3.11 released

NLnet Labs — Tue, 13 Nov 2012 00:00:00 +0100

Bugfix release. For downloads and more information about future releaseplans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

NSD 3.2.14 released

NLnet Labs — Thu, 01 Nov 2012 00:00:00 +0100

Bugfix release and TCP writev support, to improve TCP performance. See link for more information.

Related links:

ldns 1.6.15 released

NLnet Labs — Thu, 25 Oct 2012 00:00:00 +0200

OrderedDict([('br', None), ('#text', 'Emergency release restoring binary compatibility with previous releases.ldns 1.6.14 had:n Many bugfixes thanks to code reviews, A big pyldns update and DANE support (RFC 6698), including a new example tool: ldns-dane for verifying and creating TLSA records.')])

Related links:

ldns project page …

ldns 1.6.14 released

NLnet Labs — Tue, 23 Oct 2012 00:00:00 +0200

Many bugfixes thanks to code reviews, A big pyldns update and DANE support (RFC 6698), including a new example tool: ldns-dane for verifying and creating TLSA records.

Related links:

OpenDNSSEC 1.3.10 released

NLnet Labs — Mon, 08 Oct 2012 00:00:00 +0200

Bugfix release. For downloads and more information about future releaseplans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

We have a Blog

NLnet Labs — Fri, 14 Sep 2012 00:00:00 +0200

NLnet Labs now maintains a blog. We use it to publish (technical) background informagion about design and the use of our software and other material relevant to the community.

Related links:

Blog Pages

Resilient OpenDNSSEC (MSc. thesis)

NLnet Labs — Mon, 20 Aug 2012 00:00:00 +0200

This thesis analyses error situations in securing DNS zones with OpenDNSSEC. Recommendations are presented to increase the resilience level that OpenDNSSEC can offer against such situations.

Related links:

Unbound 1.4.18 released

NLnet Labs — Thu, 02 Aug 2012 00:00:00 +0200

bugfixes: assertion failures, validator failure

Related links:

NSD 3.2.13 released

NLnet Labs — Fri, 27 Jul 2012 00:00:00 +0200

Emergency release fixing another denial of service vulnerability [ VU#517036 CVE-2012-2979 ], a bugfix and a typo.

Related links:

Discovering Path MTU black holes on the Internet using RIPE Atlas (MSc. thesis)

NLnet Labs — Mon, 23 Jul 2012 00:00:00 +0200

Measurement and analysis of Path MTU black holes due to ICMP and packet fragment filtering on the Internet.

Related links:

NSD 3.2.12 released

NLnet Labs — Thu, 19 Jul 2012 00:00:00 +0200

Emergency release fixing a denial of service vulnerability from non-standard DNS packet from any host on the internet. [ VU#624931 CVE-2012-2978 ]

Related links:

NSD 3.2.11 released

NLnet Labs — Mon, 09 Jul 2012 00:00:00 +0200

TLSA/DANE support, ECDSA, per zone statistics and a couple of bugfixes.

Related links:

Credns 0.2.10 released

NLnet Labs — Fri, 22 Jun 2012 00:00:00 +0200

Software program aimed at fortifying DNSSEC by performing validation in the DNS notify/transfer-chain.

Related links:

OpenDNSSEC 1.3.9 released

NLnet Labs — Mon, 18 Jun 2012 00:00:00 +0200

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

RFC 6605: ECDSA for DNSSEC

NLnet Labs — Mon, 18 Jun 2012 00:00:00 +0200

This document describes how to specify Elliptic Curve DigitalSignature Algorithm (DSA) keys and signatures in DNS Security(DNSSEC).

Related links:

RFC6605

RFC6635: RFC Editor Model (2)

NLnet Labs — Mon, 18 Jun 2012 00:00:00 +0200

This document describes the the RFC Series functions: the RFC Series Editor,the RFC Production Center, and the RFC Publisher.

Related links:

RFC6635

RFC6672: DNAME redirection in the DNS

NLnet Labs — Mon, 18 Jun 2012 00:00:00 +0200

The DNAME record provides redirection for a subtree of the domainname tree in the DNS.

Related links:

RFC6672

NLnet Labs Annual Report 2011

NLnet Labs — Fri, 08 Jun 2012 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2011. It is intended to present an overview of Labs' various activities to those who support NLnet Labs financially, through grants or support contracts, and for those who have shown a general interest in our activities.

Related links:

Annual Report 2011 …

Dnssec-Trigger 0.11 released

NLnet Labs — Thu, 07 Jun 2012 00:00:00 +0200

experimental package that provides DNSSEC on personal computers. Bug fixes, hotspot detection, software update.

Related links:

Roelof Meijer joins NLnet Labs' board

NLnet Labs — Mon, 04 Jun 2012 00:00:00 +0200

As of May 31 Roelof Meijer is a member of the NLnet Labs' Board. Roelof is the CEO of SIDN, the Dutch TLD-registry which is one of the major financial contributors of NLnet Labs.

Related links:

About NLnet Labs

Unbound 1.4.17 released

NLnet Labs — Thu, 24 May 2012 00:00:00 +0200

bugfixes, roundrobin, ECDSA

Related links:

ldns 1.6.13 released

NLnet Labs — Mon, 21 May 2012 00:00:00 +0200

Bugfixes, ECDSA support (RFC 6605) & new commandline options to ldns-verify-zone for specifying keys, whether or not to sigchase, and inception and expiration offsets.

Related links:

OpenDNSSEC 1.3.8 released

NLnet Labs — Mon, 14 May 2012 00:00:00 +0200

Minor features and two bugfixes. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Flexible and Robust Key Rollover in DNSSEC

NLnet Labs — Wed, 28 Mar 2012 00:00:00 +0200

Paper describing the OpenDNSSEC Enforcer NG design, presented at SATIN 2012.

Related links:

OpenDNSSEC 1.3.7 released

NLnet Labs — Tue, 13 Mar 2012 00:00:00 +0100

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Dnssec-Trigger 0.10 released

NLnet Labs — Fri, 17 Feb 2012 00:00:00 +0100

experimental package that provides DNSSEC on personal computers. Bug fixes, easier hotspot, no two popups, installer fixes.

Related links:

OpenDNSSEC 1.3.6 released

NLnet Labs — Fri, 17 Feb 2012 00:00:00 +0100

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Unbound/DnssecTrigger workshop at Augsburger Linutage

NLnet Labs — Fri, 17 Feb 2012 00:00:00 +0100

Free Unbound/DNSSEC Trigger workshop at Augsburger Linux Infotage by Carsten Strotmann, 24 March.

Related links:

Programm

NSD 3.2.10 released

NLnet Labs — Wed, 15 Feb 2012 00:00:00 +0100

Bugfix release.

Related links:

Unbound 1.4.16 released

NLnet Labs — Thu, 02 Feb 2012 00:00:00 +0100

Fixes bug in bugfix from 1.4.15, and other bugfixes.

Related links:

Net::DNS 0.68 released

NLnet Labs — Mon, 30 Jan 2012 00:00:00 +0100

Bugfixes and Internationalized Domain Names support in queries

Related links:

Unbound 1.4.15 released

NLnet Labs — Thu, 26 Jan 2012 00:00:00 +0100

Bugfixes: fix memory leak, hash randomized.

Related links:

Collaboration between SIDN and NLnet Labs

NLnet Labs — Mon, 23 Jan 2012 00:00:00 +0100

SIDN, the company behind .nl, today signed a five-year contract with NLnet Labs. NLnet Labs - the Dutch internet technology expertise centre - has a worldwide reputation for its work in the field of DNS and DNSSEC. Through its financial backing for NLnet Labs, SIDN aims to support not only the continued …

Authenticated Denial of Existence in the DNS (part 2)

NLnet Labs — Mon, 16 Jan 2012 00:00:00 +0100

A new version of the paper on denial of existence in the DNS and how the protocol evolved. Version 2.

Related links:

ldns 1.6.12 released

NLnet Labs — Wed, 11 Jan 2012 00:00:00 +0100

Bugfixes (including the date transposition flaw) and minor new features such as: user definable current time, SOA serial update functions and improvements of the build system.

Related links:

Dnssec-Trigger 0.9 released

NLnet Labs — Mon, 19 Dec 2011 00:00:00 +0100

experimental package that provides DNSSEC on personal computers. unbound 1.4.14 in binary packages. minor fixes.

Related links:

Unbound 1.4.14 released

NLnet Labs — Mon, 19 Dec 2011 00:00:00 +0100

Fix [VU#209659 CVE-2011-4528]. Bugfixes, small features.

Related links:

Unbound advisory (CVE-2011-4528)

NLnet Labs — Mon, 19 Dec 2011 00:00:00 +0100

Denial-of-Service vulnerabilities

Related links:

Dnssec-Trigger 0.8 released

NLnet Labs — Tue, 13 Dec 2011 00:00:00 +0100

experimental package that provides DNSSEC on personal computers. important bugfixes, SSL fallback.

Related links:

NSD 3.2.9 released

NLnet Labs — Wed, 23 Nov 2011 00:00:00 +0100

Two new features: minimize responses to reduce the setting of the TC bit and less NSEC3 prehashing to speed up a reload after a zone transfer. Also, a fair list of bugfixes. See the Release Notes for more information.

Related links:

OpenDNSSEC 1.3.3 released

NLnet Labs — Thu, 17 Nov 2011 00:00:00 +0100

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Authenticated Denial of Existence in the DNS

NLnet Labs — Wed, 09 Nov 2011 00:00:00 +0100

Paper on denial of existence in the DNS and how the protocol evolved. It answers two simple questions: Why do you need at most two NSEC records in negative responses? And why does NSEC3 requires an extra record?

Related links:

Net::DNS 0.67 released

NLnet Labs — Mon, 07 Nov 2011 00:00:00 +0100

Many bug fixes, a modular serial number system, experimetal work on IDN, rework of the build system.

Related links:

Dnssec-Trigger 0.7 released

NLnet Labs — Fri, 28 Oct 2011 00:00:00 +0200

experimental new package that provides DNSSEC on personal computers. Mac install dmg, fixes.

Related links:

Dnssec-Trigger 0.6 released

NLnet Labs — Fri, 21 Oct 2011 00:00:00 +0200

experimental test of new package that provides DNSSEC on personal computers. Fixes, XFCE and Unity support.

Related links:

Dnssec-Trigger 0.5 released

NLnet Labs — Thu, 29 Sep 2011 00:00:00 +0200

experimental test of new package. Together with unbound provides DNSSEC on 127.0.0.1 on personal computers.

Related links:

ldns 1.6.11 released

NLnet Labs — Thu, 29 Sep 2011 00:00:00 +0200

Bug fixes, small new features (such as more control over formatting to text) and a new contributed python module: LDNSX.

Related links:

Unbound 1.4.13 released

NLnet Labs — Thu, 15 Sep 2011 00:00:00 +0200

bug fixes.

Related links:

OpenDNSSEC 1.3.2 released

NLnet Labs — Tue, 13 Sep 2011 00:00:00 +0200

Two bugfixes regarding reading the backup files. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

OpenDNSSEC 1.3.1 released

NLnet Labs — Tue, 06 Sep 2011 00:00:00 +0200

Threading bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Multi-Path Inter-Domain Routing: The Impact on BGP's Scalability, Stability, and Resilience to Link Failures

NLnet Labs — Wed, 31 Aug 2011 00:00:00 +0200

Multi-path routing protocols are proposed to solve transient disconnectivity during convergence time. As their name implies, these protocols are designed to explore more paths than BGP in the attempt to keep the ASes connected in case of link failures. The impact of the multi-path routing protocols on scalability, stability, and …

OpenDNSSEC 1.2.2 released

NLnet Labs — Thu, 11 Aug 2011 00:00:00 +0200

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Unbound 1.4.12 released

NLnet Labs — Thu, 14 Jul 2011 00:00:00 +0200

two serious bug fixes.

Related links:

OpenDNSSEC 1.3.0 released

NLnet Labs — Tue, 12 Jul 2011 00:00:00 +0200

Increased signing performance.

Related links:

OpenDNSSEC website

Unbound 1.4.11 released

NLnet Labs — Thu, 30 Jun 2011 00:00:00 +0200

bug fixes, minor usability features.

Related links:

ldns 1.6.10 released

NLnet Labs — Tue, 31 May 2011 00:00:00 +0200

Bug fixes

Related links:

NLnet Labs Annual Report 2010

NLnet Labs — Mon, 30 May 2011 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2010. It is intended to present an overview of Labs' various activities to those who support NLnet Labs financially, through grants or support contracts, and for those who have shown a general interest in our activities.

Related links:

Annual Report 2010 …

Unbound 1.4.10 released

NLnet Labs — Wed, 25 May 2011 00:00:00 +0200

Fixes denial-of-service assertion failure, CVE-2011-1922 VU#531342

Related links:

Unbound advisory (CVE-2011-1922)

NLnet Labs — Wed, 25 May 2011 00:00:00 +0200

Denial-of-service assertion failure

Related links:

World IPv6 Day event

NLnet Labs — Thu, 12 May 2011 00:00:00 +0200

On Wednesday 8 June 2011, the Dutch World IPv6 Day event will be organised at the Science Park, Amsterdam.

Related links:

Outage due to rehousing

NLnet Labs — Wed, 27 Apr 2011 00:00:00 +0200

On Thursday 28 April 2011, NLnet Labs will move office and servers to a new location. Thereby all our services will be offline from 09:00am CET till +-12:00am. Our new location is:

Science Park 400
1098XH Amsterdam

HowTo setup DNSSEC validation

NLnet Labs — Thu, 07 Apr 2011 00:00:00 +0200

describes use of unbound with root trust anchor.

Related links:

HowTo

Unbound 1.4.9 released

NLnet Labs — Thu, 24 Mar 2011 00:00:00 +0100

bug fixes, not entire packet dropped if private-address is blocked.

Related links:

NSD 3.2.8 released

NLnet Labs — Tue, 22 Mar 2011 00:00:00 +0100

bugfix release, including #216 fixing memory leak relating zone transfers.

Related links:

ldns 1.6.9 released

NLnet Labs — Fri, 18 Mar 2011 00:00:00 +0100

bug fixes

Related links:

OpenDNSSEC 1.2.1 released

NLnet Labs — Fri, 18 Mar 2011 00:00:00 +0100

Bugfix release. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

Multithreaded signing support for OpenDNSSEC

NLnet Labs — Mon, 14 Mar 2011 00:00:00 +0100

We have changed the design so that RRsets are added to a signing queue, where a pool of signer threads (called drudgers) grab a signing task and perform it. With the SCA6000 HSM we now reach maximum performance, meaning OpenDNSSEC can do a 13.000+ signatures per second. The .se …

ldns 1.6.8 released

NLnet Labs — Mon, 24 Jan 2011 00:00:00 +0100

bug fixes

Related links:

NSD 3.2.7 released

NLnet Labs — Mon, 24 Jan 2011 00:00:00 +0100

small bugfix release, #347 being the most important fix (NSEC3 related)

Related links:

Unbound 1.4.8 released

NLnet Labs — Mon, 24 Jan 2011 00:00:00 +0100

bug fixes, so-sndbuf, more lenient algorithm rollover supported.

Related links:

OpenDNSSEC 1.2.0 out now

NLnet Labs — Fri, 14 Jan 2011 00:00:00 +0100

OpenDNSSEC 1.2.0 is released today. Python dependencies are dropped: the whole signer engine is now written in c. Improvements on the enforcer. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

AFNIC offered a yearly Subsidy

NLnet Labs — Mon, 22 Nov 2010 00:00:00 +0100

AFNIC has generously offered a yearly subsidy that aids the NLnet Labs Foundation to accomplish its chartered goals. AFNIC's Head of R&D, Mohsen Souissi: "We want to express support for the open source and open standards work that NLnet Labs is pursuing. By producing stable and high quality DNSSEC-enabled …

ldns 1.6.7 released

NLnet Labs — Mon, 08 Nov 2010 00:00:00 +0100

bug fixes, experimental ecdsa support

Related links:

Unbound 1.4.7 released

NLnet Labs — Mon, 08 Nov 2010 00:00:00 +0100

Bug fixes, unbound-anchor for automated DNSSEC root key tracking, that works if you have been offline.

Related links:

Unbound timeout article

NLnet Labs — Mon, 08 Nov 2010 00:00:00 +0100

There is an article that describes how unbound manages timeouts from remote servers.

Related links:

Unbound documentation

Unbound requestlist article

NLnet Labs — Thu, 21 Oct 2010 00:00:00 +0200

Men&Mice has a nice article describing how the unbound requestlist works.

Related links:

Article

Secure Routing: State-of-the-Art Deployment and Impact on Network Resilience

NLnet Labs — Tue, 28 Sep 2010 00:00:00 +0200

This ENISA publication reports on a study by NLnet Labs and GNKS Consult, surveying current state-of-the-art secure routing technologies. Network operators, engineers, and researchers are interviewed on the deployment of secure routing technology, its performance expectations and operating experiences, and future perspectives.

Related links:

ENISA Secure Routing Report (PDF)

Impact of Topology on BGP Convergence

NLnet Labs — Mon, 23 Aug 2010 00:00:00 +0200

This MSc. thesis in collaboration with VU University Amsterdam, reports on the study to understand how the underlying topology of the Internet influences BGP performance. A highly scalable simulator is used to simulate full-scale AS-level Internet. We found that BGP is sensitive to certain topological characteristics of the Internet, while …

ldns 1.6.6 released

NLnet Labs — Mon, 09 Aug 2010 00:00:00 +0200

bug fixes release

Related links:

Unbound 1.4.6 released

NLnet Labs — Tue, 03 Aug 2010 00:00:00 +0200

Bug fixes, GOST support.

Related links:

NSD 3.2.6 released

NLnet Labs — Mon, 02 Aug 2010 00:00:00 +0200

small bugfix release, but also has a new feature and some operational changes

Related links:

Flavors of Unbound

NLnet Labs — Wed, 28 Jul 2010 00:00:00 +0200

Men & Mice have published an article on how to select between different flavors of Unbound compilation. This article explains the technical differences of the possible flavors of Unbound and gives proposals under which type of DNS workload a specific flavor will perform best. The article will be kept updated when …

DNSSEC Root Key declaration

NLnet Labs — Wed, 14 Jul 2010 00:00:00 +0200

On 16 June 2010 around 21:20 UTC Olaf Kolkman witnessed a key generation procedure by which a DNSSEC Key Signing Key for signing the DNS root has been created. The key is known with key-ID 19036.

Related links:

PGP Signed Declaration containing the DS hash

Testing Key States of RFC 5011 in Autotrust

NLnet Labs — Mon, 12 Jul 2010 00:00:00 +0200

Carsten Rutz of Radboud University investigated the usability of time model-based testing in a case study: Conformance of the implementation Autotrust with RFC 5011. The results are presented in a bachelor thesis.

Related links:

HTML
PDF

ldns 1.6.5 released

NLnet Labs — Tue, 15 Jun 2010 00:00:00 +0200

bug fixes, TALINK, GOST (disabled by default).

Related links:

Unbound 1.4.5 released

NLnet Labs — Tue, 15 Jun 2010 00:00:00 +0200

bug fixes.

Related links:

NLnet Labs Annual Report 2009

NLnet Labs — Wed, 02 Jun 2010 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2009. It is intended to present an overview of Labs' various activities to those who support NLnet Labs financially, through grants or support contracts, and for those who have shown a general interest in our activities.

Related links:

Annual Report 2009 …

Unbound 1.4.4 released

NLnet Labs — Thu, 22 Apr 2010 00:00:00 +0200

bug fixes.

Related links:

NSD 3.2.5 released

NLnet Labs — Wed, 14 Apr 2010 00:00:00 +0200

Optimized, NSID friendly NSD release

Related links:

NSEC3 Hash Performance

NLnet Labs — Thu, 18 Mar 2010 00:00:00 +0100

We have measured the effect ofthe number of hash iterations in NSEC3 in terms of maximum query load usingNSD and Unbound. This document presents the results of these measurementsand compares the cost for validating and authoritative name servers and allowsfor an educated choice for these parameters.

Related links:

Unbound 1.4.3 released

NLnet Labs — Thu, 11 Mar 2010 00:00:00 +0100

crash fix for 64bit platforms.

Related links:

Unbound 1.4.2 released

NLnet Labs — Tue, 09 Mar 2010 00:00:00 +0100

bugfix.

Related links:

Stale keys and unbound behaviour

NLnet Labs — Fri, 12 Feb 2010 00:00:00 +0100

Statement regarding concerns about stale keys and Unbound behavior

Related links:

mail

OpenDNSSEC 1.0.0 out now

NLnet Labs — Tue, 09 Feb 2010 00:00:00 +0100

The first official OpenDNSSEC release is available right now. For downloads and more information about future release plans, visit the OpenDNSSEC website.

Related links:

OpenDNSSEC website

ldns 1.6.4 released

NLnet Labs — Wed, 20 Jan 2010 00:00:00 +0100

This new release has the pyldns contribution by Zdenek Vasicek and Karel Slany imported. Plus bug fixes.

Related links:

NSD 3.2.4 released

NLnet Labs — Wed, 06 Jan 2010 00:00:00 +0100

This new NSD release comes with some new configure options, DLV record support and some bugfixes.

Related links:

Unbound 1.4.1 released

NLnet Labs — Thu, 17 Dec 2009 00:00:00 +0100

bugfix.

Related links:

ldns 1.6.3 released

NLnet Labs — Fri, 04 Dec 2009 00:00:00 +0100

Small bugfix release.

Related links:

Unbound 1.4.0 released

NLnet Labs — Thu, 26 Nov 2009 00:00:00 +0100

RFC5011, RFC5702 features and bugfixes.

Related links:

ldns 1.6.2 released

NLnet Labs — Thu, 12 Nov 2009 00:00:00 +0100

Enables SHA2 by default. Fixes lots of bugs for OpenDNSSEC and other. ldns-sign-zone will minimally sign the DNSKEY rrset.

Related links:

Securing DNS: Extending DNS Servers with a DNSSEC Validator

NLnet Labs — Tue, 27 Oct 2009 00:00:00 +0100

DNS Security Extensions (DNSSEC) is a proposed standard for securely authenticating information in the Domain Name System. DNSSEC validators check the digital signatures on DNS data. However, designing a validator worth the operational costs is a challenge. _i(Published in IEEE Security & Privacy), _i(Sept/Oct. 2009.)

Related links:

Securing …

Unbound 1.3.4 released

NLnet Labs — Wed, 07 Oct 2009 00:00:00 +0200

DNSSEC downgrade bug fixed.

Related links:

autotrust 0.3.1 released

NLnet Labs — Tue, 08 Sep 2009 00:00:00 +0200

This new autotrust release offers some new features like syslog and resolver reloading, as well as some bug fixes. Also, the configuration file format has changed, to be more in line with Unbound.

Related links:

SURFnet deploys DNSSEC and uses Unbound

NLnet Labs — Tue, 08 Sep 2009 00:00:00 +0200

SURFnet announces that all SURFnet DNS (Domain Name System) resolvers now support DNSSEC. SURFnet uses Unbound as its resolver of choice. SURFnet is one of the first networks in the Netherlands to support DNSSEC.

Related links:

More information

Innovation vouchers

NLnet Labs — Fri, 28 Aug 2009 00:00:00 +0200

For Dutch companies there is, under a program to promote innovation, the possibility to receive a 2.500 Euro subsidy. The NLnet foundation, our mother, has a program that allows furthering of open source software by any Dutch company that is registered with the Chamber of Commerce. It takes 10 …

NSD 3.2.3 released

NLnet Labs — Mon, 17 Aug 2009 00:00:00 +0200

Bugfixes

Related links:

ldns 1.6.1 released

NLnet Labs — Fri, 14 Aug 2009 00:00:00 +0200

Bugfixes, minor features.

Related links:

Unbound 1.3.3 released

NLnet Labs — Tue, 04 Aug 2009 00:00:00 +0200

Bugfixes, minor features.

Related links:

OpenDNSSEC technology preview

NLnet Labs — Thu, 30 Jul 2009 00:00:00 +0200

The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. Visit the OpenDNSSEC website for more information and to download the technology …

NLnet Labs is hiring

NLnet Labs — Sat, 25 Jul 2009 00:00:00 +0200

We are looking for enthusiastic programmer/developers to complete our 6 persons team. Somebody who will be developing and maintaining open source software and open standards.

Related links:

More information

Unbound 1.3.2 released

NLnet Labs — Mon, 13 Jul 2009 00:00:00 +0200

Windows port fixed.

Related links:

ldns 1.6.0 released

NLnet Labs — Thu, 09 Jul 2009 00:00:00 +0200

Bugfixes, minor features.

Related links:

Unbound 1.3.1 released

NLnet Labs — Thu, 09 Jul 2009 00:00:00 +0200

Bugfixes.

Related links:

BSD Podcast

NLnet Labs — Wed, 08 Jul 2009 00:00:00 +0200

The bsdtalk podcast by Will Backman interviews WouterWijngaards about the Unbound resolver.

Related links:

bsdtalk 176

DNSSEC HOWTO updated

NLnet Labs — Sat, 04 Jul 2009 00:00:00 +0200

The DNSSEC HOWTO received its first public update after 2007. Examples have been updated to use recent versions of the software, Unbound configuration has been added, and some new material has been added.

Related links:

Unbound 1.3.0 released

NLnet Labs — Thu, 11 Jun 2009 00:00:00 +0200

Windows port. Python contribution. Bugfixes.

Related links:

NLnet Labs Annual Report 2008

NLnet Labs — Mon, 08 Jun 2009 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2008. It is intended to present an overview of Labs' various activities to those who support NLnet Labs financially, through grants or support contracts, and for those who have shown a general interest in our activities.

Related links:

Annual Report 2008 …

NSD 3.2.2 release [critical]

NLnet Labs — Mon, 18 May 2009 00:00:00 +0200

Critical bugfix release for NSD.

Related links:

NSD Vulnerability Announcement

NLnet Labs — Mon, 18 May 2009 00:00:00 +0200

A one-byte buffer overflow has been detected in the NSD software. A fix is ready for download.

Related links:

RFI for Unbound Tech Support

NLnet Labs — Tue, 21 Apr 2009 00:00:00 +0200

NLnet Labs is seeking information about organizations that would be willing and able to provide first and second line support for Unbound and would like to know more about their ideas on organization and cooperation.

Related links:

RFI-support

Implementing OpenLISP with LISP+ALT

NLnet Labs — Tue, 14 Apr 2009 00:00:00 +0200

The LISP protocol has been developed to address the growth of the BGP routing table in the DFZ. OpenLISP is an implementation of this protocol, but does not include a location mapping service. This reports describes how a mapping locations service should interact with OpenLISP, GRE and Quagga to use …

ldns 1.5.1 released

NLnet Labs — Tue, 10 Feb 2009 00:00:00 +0100

Bugfix release for the zone signer in ldns 1.5

Related links:

Unbound 1.2.1 released

NLnet Labs — Tue, 10 Feb 2009 00:00:00 +0100

Bugfix release, features for smoother operations.

Related links:

ldns 1.5.0 released

NLnet Labs — Mon, 09 Feb 2009 00:00:00 +0100

New version of ldns

Related links:

NSD 3.2.1. out now

NLnet Labs — Mon, 19 Jan 2009 00:00:00 +0100

Mainly a bugfix release, but also some new features. Fixes AXFR fallback discussion.

Related links:

Unbound 1.2.0 released

NLnet Labs — Wed, 14 Jan 2009 00:00:00 +0100

Minor features and important, security related, bugfixes.

Related links:

ldns 1.4.1 released

NLnet Labs — Fri, 19 Dec 2008 00:00:00 +0100

New version of ldns; A couple of NSEC3 related bugs have fixed, as well some gripes in the build scripts.

Related links:

NLnet Labs joins DNSSEC industry coalition to Increase Adoption of Domain Name Security Extensions (DNSSEC).

NLnet Labs — Thu, 11 Dec 2008 00:00:00 +0100

The DNSSEC Industry Coalition is a global group of registries and industry experts whose mission is to work collaboratively to facilitate adoption of Domain Name Security Extensions (DNSSEC) and streamline the implementations across Domain Name Registries. Members work together to establish a consistent set of tools and applications, shared best …

Unbound operation explained in book

NLnet Labs — Mon, 08 Dec 2008 00:00:00 +0100

Book "Alternative DNS Servers", also describes Unbound and NSD operation.

Related links:

Unbound 1.1.1 released

NLnet Labs — Mon, 24 Nov 2008 00:00:00 +0100

bugfixes.

Related links:

Unbound 1.1.0 released

NLnet Labs — Tue, 18 Nov 2008 00:00:00 +0100

DLV support, statistics and lots of other features that have been requested. Also bugfixes.

Related links:

NSD 3.2.0 released

NLnet Labs — Mon, 10 Nov 2008 00:00:00 +0100

A "feature rich" release. Contains longstanding requests such as SHA support for TSIG and configuration options for setting the outgoing interface. Also AXFR fallback, and IXFR on TCP by default. VERY IMPORTANT: The format of ixfr.db has changed, so be sure to process the old one before updating to …

ldns 1.4.0 released

NLnet Labs — Fri, 07 Nov 2008 00:00:00 +0100

New version of ldns; some small new and fixed features, and a number of bugs fixed

Related links:

DNSSEC Key Maintenance Analysis

NLnet Labs — Thu, 23 Oct 2008 00:00:00 +0200

This document provides recommendations for the generation, storage and use of keys in the context of DNSSEC. It is a followup of NLnet Labs document 2006-SE-01: DNS Threat Analysis, written for .SE.

Related links:

Enforcing Integrity of Agent Migration Paths by Distribution of Trust

NLnet Labs — Thu, 25 Sep 2008 00:00:00 +0200

Agent mobility is the ability of an agent to migrate from one location to another across a network. Though conceptually relatively straightforward, in practice security of mobile agents is a challenge. This paper discusses the security issues involved and proposes protocols for secure agent migration. AgentScape, an agent platform for …

Master Thesis BGP Modeling and Simulation

NLnet Labs — Mon, 08 Sep 2008 00:00:00 +0200

In this thesis we present a new approach to BGP simulation. Instead of focussing on intra-domain communication, network and protocol are highly abstracted in order to allow for large-scale simulation. We describe our model of the BGP protocol along with its implementation. Many tracks of future researc are shown as …

Japan Unbound User Group

NLnet Labs — Thu, 04 Sep 2008 00:00:00 +0200

The Japan Unbound Users Group has opened its website today, with unbound documentation, support and forum in Japanese.

Related links:

http://unbound.jp/

Annual Report 2007 released

NLnet Labs — Fri, 22 Aug 2008 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2007. It is intended to present an overview of Labs' various activities to those who support NLnet Labs financially, through grants or support contracts, and for those who have shown a general interest in our activities.

Related links:

Annual Report 2007 …

Unbound 1.0.2 released

NLnet Labs — Thu, 07 Aug 2008 00:00:00 +0200

This release contains filtering fixes to prevent certaintypes of exploits. Also bugfixes.

Related links:

NSD 3.1.1 released

NLnet Labs — Mon, 21 Jul 2008 00:00:00 +0200

This release contains mainly bugfixes. It also allows you to configure the maximum number of allowed interfaces. If you use it, it can have consequences for your memory usage.

Related links:

DNS Cache Poisoning Vulnerability

NLnet Labs — Sat, 19 Jul 2008 00:00:00 +0200

Statement about US-CERT Vulnerability Note VU#800113 and Unbound

Related links:

NSD 3.1.0 released

NLnet Labs — Mon, 23 Jun 2008 00:00:00 +0200

New version of NSD. It supports NSEC3 by default, has a "hide-version" configuration setting, to stop NSD answering from CHAOS class version requests, has bind2nsd 0.5.0, has some bugfixes resolved and reports source and zone for denied AXFR attempts. Some operational notes: the default locations of nsd.db …

ldns 1.3.0 released

NLnet Labs — Mon, 02 Jun 2008 00:00:00 +0200

New version of ldns; If Unbound is to be linked against a separate copy of ldns, this version should be used. There are also some notable features, such as HSM support for DNSSEC signing, and nicer output for signature chasing.

Related links:

Unbound 1.0.0 released

NLnet Labs — Tue, 20 May 2008 00:00:00 +0200

The public release of Unbound, a fast recursive validating caching DNS server.

Related links:

HSM Tutorial

NLnet Labs — Tue, 13 May 2008 00:00:00 +0200

An introduction to the use of HSM.

Related links:

NSD 3.0.8 Release

NLnet Labs — Fri, 18 Apr 2008 00:00:00 +0200

Better logging for nsd-notify, Add chkconfig configuration, nsdc bugfixes, strptime fix, more (bugzilla) fixes and logging features.

Related links:

ldns 1.2.2 Release

NLnet Labs — Wed, 28 Nov 2007 00:00:00 +0100

We released a new version of ldns. There are some bugfixes, an added example tool, and hmac-md5 support for keys.

Related links:

NSD 3.0.7 Release

NLnet Labs — Tue, 13 Nov 2007 00:00:00 +0100

Fixup of error handling for bad data in IXFRs. Manual page syntax improvements.

Related links:

NSD project page

Design of a Secure and Decentralized Location Service for Agent Platforms

NLnet Labs — Wed, 19 Sep 2007 00:00:00 +0200

Publication on designing of a secure and decentralized location service for agent platforms.

Related links:

Download

Formalization and Verification of the Shim6 Protocol

NLnet Labs — Mon, 16 Jul 2007 00:00:00 +0200

Publication on formalization and verification of the shim6 protocol.

Related links:

Annual Report 2006

NLnet Labs — Mon, 21 May 2007 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2006. In it we present an overview of Labs' various activities and describe their impact.

Related links:

Download

DNS Threat Analysis

NLnet Labs — Thu, 03 May 2007 00:00:00 +0200

Publication on DNS Threat Analysis.

Related links:

Download

NSD 2.3.7 Release

NLnet Labs — Mon, 16 Apr 2007 00:00:00 +0200

This is a bug-fix release on our older maintenance branch of NSD. It includes a fixup of type WKS printing from nsd-xfer, a fixup in a call to getservbyport. There are changes in the getaddrinfo error message and a change to make it fall back to IPv4 if it fails …

NSD Memory Usage Estimate

NLnet Labs — Fri, 13 Apr 2007 00:00:00 +0200

Small web tool added to make a memory size indication given zone specification.

Related links:

ldns 1.2.0 Release

NLnet Labs — Wed, 11 Apr 2007 00:00:00 +0200

We released a new version of ldns. There are a lot of bugfixes, some more examples, and drill has had significant updates.

Related links:

NSD Powers Secure64 DNS Solution

NLnet Labs — Sat, 31 Mar 2007 00:00:00 +0200

Secure64 is a company specialized in secure and high-performance applications. They have developed SourceT, a micro operating system geared towards secure network systems on Itanium processors. NSD has been ported to SourceT, and is used as the name server software of their Secure64 DNS product, providing RFC-compliant, DNSSEC-enabled, fast DNS …

Annual Report 2005

NLnet Labs — Sun, 18 Jun 2006 00:00:00 +0200

We are happy to present NLnet Labs Annual report 2005. In it we present an overview of Labs' various activities and describe their impact.

Related links:

Download