Yeti-DNS is an international research project with the purpose of testing new technologies and procedures in running the Internet root zone. The project runs tests on DNSSEC key rollovers in the root, as well as experimenting with new ways to manage the DNSSEC keys (multiple zone signing keys). An interview with Shane Kerr, a coordinator for the Yeti-DNS project, forms part of this webinar. The interview sheds light on the technical and political aspects of the project and introduces the latest results from experiments. The webinar also includes a tutorial on how to use the Yeti-DNS root name servers to configure a BIND 9 DNS resolver in order to take part in the project.

1. Yeti-DNS
Experimenting at the root
1

2. © Men & Mice http://menandmice.com
Yeti-DNS
Interview with Yeti-DNS coordinator Shane Kerr
Tutorials
- BIND 9 Resolver using Yeti-DNS
- Unbound Resolver using Yeti-DNS
2

3. © Men & Mice http://menandmice.com
Interview with Shane Kerr
3

4. © Men & Mice http://menandmice.com
Using Yeti-DNS root
The Yeti-DNS project relies on interested networks to run
DNS-resolver towards the Yeti-DNS root
• to generate "real-world" query traffic
• Yeti-DNS is IPv6-only
•you need IPv6 connectivity to participate (native IPv6 is best, but a tunnel is fine)
• Setup is not hard
• but keep in mind that Yeti-DNS is an experimental project, there might be
glitches and downtime
• do not run a mission critical network via Yeti-DNS
• research or internal IT staff networks, Guest-WLAN etc might be fine
4

5. © Men & Mice http://menandmice.com
BIND 9 with Yeti-DNS root
Example for Ubuntu 16.04:
# apt install bind9
# wget -O /etc/bind/yeti-root.hints
https://raw.githubusercontent.com/BII-Lab/Yeti-Project/master/domain/named.cache
# vi /etc/bind/named.conf.local
——
zone "." {
type hint;
file "/etc/bind/yeti-root.hints";
};
managed-keys {
"." initial-key 257 3 8 "AwEAAaP3gGQ4db0tAiDEky0dcUNGeI1aTDYP5NFxzhbdpD60ZhKLVV4K
yxPmoSNUpq5Fv5M0iBwK1Tyswsyq/9sMSoZ8zx8aT3ho1YnPsSqQeJfj
TT1WsX6YZ5Kw6B2QkjRNa6OMGZ96Kn8AI/slqsw+z8hY49Sn3baeo9iJ
xHPzloNc2dQkW4aLqzNEYxnuoJsthCfGrPSAXlUjY9m3YKIaEWR5WFYQ
k770fT+gGWLk/54Vp0sG+Lw75JZnwhDhixPFaToTDNqbHQmkEylq1XJL
O15uZ/+RZNRfTXZKO4fVR0tMEbMAITqRmyP8xLXY4RXbS4J32gnenQbz
ABX8sQmwO7s=";
};
5
Fetching the Yeti-DNS
Root-Hints
Configure the Yeti-Root-
Hints
The Yeti-DNS Root KSK for
DNSSEC validation

6. © Men & Mice http://menandmice.com
BIND 9 with Yeti-DNS root
Example for Ubuntu 16.04:
# vi /etc/bind/named.conf.default-zones
-----
// prime the server with knowledge of the root servers
#zone "." {
# type hint;
# file "/etc/bind/db.root";
#};
------
# named-checkconf
# systemctl restart bind9
# systemctl status bind9
6
uncommenting the
"official" IANA Root-Hints
check the configuration
and restart BIND 9

7. © Men & Mice http://menandmice.com
BIND 9 with Yeti-DNS root
Example for Ubuntu 16.04:
# dig @localhost ns .
; <<>> DiG 9.10.3-P4-Ubuntu <<>> @localhost ns .
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52931
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 25, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;. IN NS
;; ANSWER SECTION:
. 86367 IN NS yeti1.ipv6.ernet.in.
. 86367 IN NS yeti-ns2.dns-lab.net.
. 86367 IN NS yeti-ns.as59715.net.
. 86367 IN NS yeti.ipv6.ernet.in.
. 86367 IN NS dahu2.yeti.eu.org.
[…]
. 86367 IN NS bii.dns-lab.net.
. 86367 IN NS yeti-ns.lab.nic.cl.
. 86367 IN NS yeti-ns.tisf.net.
. 86367 IN NS 18ac3e7343f016890c510e93f93526.yeti-dns.net.
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jun 09 13:06:49 CEST 2016
;; MSG SIZE rcvd: 823
7
Query for the Nameserver NS-
RRSET of the root zone
(must be DNSSEC validated
AD-Flag!)
the list of Yeti-DNS root
server

8. © Men & Mice http://menandmice.com
Unbound with Yeti-DNS root
Example for Ubuntu 16.04:
# apt install unbound
# wget wget -O /etc/unbound/yeti-root.hints
https://raw.githubusercontent.com/BII-Lab/Yeti-Project/master/domain/named.cache
# vi /etc/unbound/unbound.conf.d/yeti-root.conf
——
server:
root-hints: "yeti-root.hints"
——
8
fetching the Yeti-DNS
root-hints

9. © Men & Mice http://menandmice.com
Unbound with Yeti-DNS root
Example for Ubuntu 16.04:
!
!
# wget -O /var/lib/unbound/root.key
https://raw.githubusercontent.com/BII-Lab/Yeti-Project/master/domain/KSK.pub
# echo 'ROOT_TRUST_ANCHOR_UPDATE="false"' >> /etc/default/unbound
9
fetching the Yeti-DNS
root-KSK for DNSSEC
validation
disabling the update of
the DNSSEC root KSK via
unbound-anchor

10. © Men & Mice http://menandmice.com
Unbound with Yeti-DNS root
Example for Ubuntu 16.04:
!
!
# unbound-checkconf
unbound-checkconf: no errors in /etc/unbound/unbound.conf
# systemctl restart unbound
# systemctl status unbound
!
10
check the Unbound
configuration for errors

11. © Men & Mice http://menandmice.com
Unbound with Yeti-DNS root
Example for Ubuntu 16.04:
# dig @localhost ns .
; <<>> DiG 9.10.3-P4-Ubuntu <<>> @localhost ns .
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29228
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 25, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;. IN NS
;; ANSWER SECTION:
. 86369 IN NS 3f79bb7b435b05321651daefd374cd.yeti-dns.net.
. […]
. 86369 IN NS yeti-ns.tisf.net.
. 86369 IN NS yeti-ns1.dns-lab.net.
. 86369 IN NS 2e7d2c03a9507ae265ecf5b5356885.yeti-dns.net.
. 86369 IN NS yeti.ipv6.ernet.in.
. 86369 IN NS dahu1.yeti.eu.org.
. 86369 IN NS yeti-ns.wide.ad.jp.
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jun 09 13:44:23 CEST 2016
;; MSG SIZE rcvd: 823
11
Query for the Nameserver NS-
RRSET of the root zone
(must be DNSSEC validated
AD-Flag!)
the list of Yeti-DNS root
server

12. © Men & Mice http://menandmice.com
Yeti-DNS resources
Website:
http://yeti-dns.org/
Mailinglist:
http://lists.yeti-dns.org/mailman/listinfo/discuss
Statistics:
http://yeti-dns.org/statistics.html
Yeti-Root-Server Monitoring: (via RIPE Atlas)
http://yeti-dns.org/monitor.html
12

13. © Men & Mice http://menandmice.com
Upcoming training classes
Special
4 day IPv6 Intro & Advanced Topics Workshop
August 1 – 4, 2016
Livermore, CA (USA)
13
https://www.menandmice.com/support-training/training/ipv6/

14. © Men & Mice http://menandmice.com
Upcoming training classes
KEA-DHCP
August 8 – 9, 2016 - Amsterdam, The Netherlands
October 13 – 14, 2016 - West Coast, USA
October 17 – 18, 2016 - East Coast, USA
November 21 – 22, 2016 - Amsterdam, The Netherlands
Two days - Hands-On training
US$ 1795
14
https://www.menandmice.com/support-training/training/kea-dhcp-training/

15. © Men & Mice http://menandmice.com
more training
•August 22 – 24, 2016 Introduction to DNS & BIND Hands-On class
Amsterdam, The Netherlands
• August 22 – 26, 2016 Introduction & Advanced DNS and BIND Topics
Hands-on class Amsterdam, The Netherlands
•August 24 – 26, 2016 DNSSEC Technical Workshop – Implementation and
Deployment Amsterdam, The Netherlands
•October 3 – 5, 2016 Introduction to DNS & BIND Hands-On class Arlington
(VA), USA
•October 3 – 7, 2016 Introduction & Advanced DNS and BIND Topics Hands-
on class Arlington (VA), USA
•October 5 – 7, 2016 DNSSEC Technical Workshop – Implementation and
Deployment Arlington (VA), USA
15
https://www.menandmice.com/support-training/training/

16. © Men & Mice http://menandmice.com
ISC Webinars
Webinar: Extending Kea with Hooks
29 June 2016 - 10:00 AM PST / 5:00 PM UCT
https://goo.gl/ZP3NIc
16

17. © Men & Mice http://menandmice.com
Thank you!
!
Questions? Comments?
17