DNSSEC Deployment Activity in Japan- Introduction of DNSSEC Japan Yoshiki Ishida, Yoshiro Yoneya,
Tsuyoshi Toyono, Miki Takata
DNSSEC Japan

Agenda• Background• Introduction of DNSSEC Japan• Accomplishments from the activity• Future plan

Agenda• Background• Introduction of DNSSEC Japan• Accomplishments from the activity• Future plan

Background(1)• DNSOPS.jp– DNS Operators Group in Japan– Voluntary DNS operators community in Japan– Established on June 2006, forked from JANOG• JANOG(Japan Network Operators’ Group)• http://www.janog.gr.jp/– The Purpose of DNSOPS.jp is to share know-how andto discuss about daily DNS operations– Activities:• Semiannual BoFs (about 100 participants)• ML (about 1400 subscribers)• http://dnsops.jp/ (Japanese only)Background(2)• DNSSEC deployment is now ongoing– Almost DNS operators are not ready for DNSSEC.
– It is difficult to adopt DNSSEC for average DNS
operators, who have no documents in Japanese, noexperience, no know-how, and no L10N activity– Signing schedules are coming up not only “.JP” butalso other TLDs
– DNS operators entreat DNSSEC deployment activity
both in Japan and in Japanese– A collaboration group is needed especially at its
introduction phase

Playersaround
DNSSEC
Contents Servers(Web/Mail Servers)root, gTLDs, ccTLDs…
Domain Name Registries

Domain Name Registrars
The Internet
Authoritative DNS servers
Domain Name Resellers
Recursive DNS servers

Security ApplianceHome Routers/Adapters
Registrants

Internet Service Provider

Customer Support

End Users

Environment around DNS operators
There is a request for
adopting DNSSEC from acustomer.
Do We need replacement ofDNS Servers?

How much does it cost?
Do we make it money?

How do we transfer adomain?

We cannot operate entire
systems smoothly

I cannot access the Internet.
DNS operators must decide: adopting DNSSEC or not, when and how, toll or free.

7Knowledge and Expertise about DNSSEC are not widespread!

Agenda• Background• Introduction of DNSSEC Japan• Accomplishments from the activity• Future planDNSSEC Japan• The Charter of DNSSEC Japan (DNSSEC.jp)– Name of the Organization
The official name of this organization is “DNSSECJapan” and abbreviated as “DNSSEC.jp”.
– The Charter“DNSSEC Japan (DNSSEC.jp)” is established as a forum
for domain name registries, registrars, registrants andrelevant parties such as DNS and network operatorswith the aim of introducing and deploying DNSSEC
that enhances security of the DNS.
DNSSEC.jp makes it a principle to carry out activities
based on the mutual cooperation by participants.

DNSSEC Japan• Objectives and Activities of DNSSEC.jp
1) Objectives
DNSSEC.jp intends to sort out and discuss issues in relation todeployment and operation of DNSSEC to enhance technical capabilityof participants and sharing of technical expertise. It also conducts
outreach activities such as providing relevant tools and giving technicalcommentaries.
2) Activities
Activities of DNSSEC.jp are:
• To sort out and share issues regarding introduction and operation of DNSSEC;• To conduct technical verifications and accumulate expertise for introduction
and operation of DNSSEC;• To develop BCP relating to introduction and operation of DNSSEC; and• To deploy DNSSEC through propagating results of its activities.

• Established on 24 November 2009

DNSSEC Japan• Membership (35 organizations as of January)– Registry/Registrar– Carrier/IXP– ISP– Hosting Provider– Contents Provider– Vendor/System Integrator– Internet-Related Organizations

Member List

Augment Inc.
Boot Communication Co., LTD.
Broadband Tower, Inc.
Digital-Effect Network Co., Ltd.
DNS Operators Group, Japan
Future Spirits Co., Ltd.
GMO Hosting & Security Inc.
Infoblox Inc.
Internet Multifeed Co.
Internet Initiative Japan Inc.
Internet Research Institute, Inc.
Japan Computer Emergency Response Team
Coordination Center
Japan Internet Exchange Co., Ltd.
Japan Network Information Center
Japan Registry Services Co., Ltd.
Livedoor Co., Ltd.
Mirai Communication Network Inc.

• Member List

NEC BIGLOBE Ltd.

NetAgent Co., Ltd.
NeuStar Inc.
NRI Secure Technologies, Inc.
NTT Communications Corporation
NTTPC Communications, Inc.
Rakuten, Inc.
Sakura Internet Inc.
SANYO Information Technology Solutions Inc.
Sarion Systems Research
SOFTBANK BB Corp.
SOFTBANK TELECOM Corp.
So-net Entertainment Corporation
STNet Inc.
Telecom-ISAC Japan
Thales Japan, Inc.
Tokyo Electron Device Limited
YOYO Planning

DNSSEC Japan• Structure– Officers• Chairman: Yoshiki Ishida• Co-Chairman: Tsuyoshi Toyono , Yoshiro Yoneya– Plenary Meeting(bi-monthly)• Technology Verification WG(Tech-WG) chaired by Tsuyoshi Toyono• Public Relations WG(Pub-WG) chaired by Miki Takata• Public Relations(in Japanese)– Web• http://dnssec.jp/– twitter• @dnssec_jp, #dnssec_jp

DNSSEC JapanDNSSEC Japan• Activities– Technology Verification and Research Activities• Summary on international trends• Survey on the interface between registrars andregistries• Operational tools• Verification of network equipments• Registrar transfer / BCP method verification• Simulation scenarios• Proper method of introducing the trust anchor intorecursive DNS servers

DNSSEC Japan• Events– March - September, 2010: Study group on DNSSEC protocols andits operational technology with hands-on– July 21, 2010: DNSSEC 2010 Summer Forum– November 15, 2010: DNSSEC Service Model Workshop– November 25, 2010: DNS DAY (within Internet Week 2010)– April, 2011: DNSSEC 2011 Spring Forum (coming)• Public Relations– Presentations at some related conferences in Japan– Disclosure of all accomplishments on the Web
This is keyhole• Miscellaneous– Logo contest (July , 2010)– Novelties sponsored by JPRSDNSSEC Japan• DNSSEC 2010 Summer Forum– Date: 21 July, 2010
– Agenda• What is DNSSEC• Introduction of DNSSEC Japan• DNSSEC Japan's Working Group• The status of root zone signing• The status of ccTLD, gTLD zone signing• The schedule of “.JP” zone signing• DNSSEC Key Management• Clothing– Participants: 120• ISP, DNS Provider, Hosting , SIer, DNS operators at enterprise andacademic organizations, etc.

DNSSEC Japan• DNSSEC Service Model Workshop– Date: 15 November, 2010
– Closed Meeting– Participants: 12• Carrier, ISP, Hosting Provider, Registrar, Registry– Discussion about DNSSEC Service Model• Service Styles– Authoritative DNS servers– Recursive DNS servers• Charge– Some Practices derived from the discussion werepresented at “DNS Day” on 25 November, 2010

Agenda• Background• Introduction of DNSSEC Japan• Accomplishments from the activity• Future planPurpose of Tech-WG
1. To investigate what kind of effect will occur
on WG members’ service and products, andto verify them in a lab environment.
2. To check the DNSSEC status of WG members’
services and products, and to share andaccumulate operational know-how.
3. To publish guidelines and BCPs fromaccumulated expertise.
20

Publication List from Tech-WG•DNSSEC mechanisms and the present status–•

Issues on adopting DNSSEC–•Best current practice on configuring trust anchor to recursive DNS server (orresolver) in secure way.

Report on the DS registration interface for the variousregistries–•

Summarized issues which each player should consider in case of adoptingDNSSEC.

How to set up DNSSEC trust anchors for the resolver–•Brief summary of DNSSEC and the present state of it.

Tech-WG carried out in the summary of research on the interface for theregistry key.

Registrar Transfer Guideline–Guideline of Practical methods for Registrar transferScenario Simulation -Registrar
Parent Zone
（gTLDs，ccTLDs）

User Query

Domain Name Registration

User I/F for Registrants(eg. Web)Internet

Load Balancers

Registration

NATglobal

Customer DB
RR Management DB

Authoritative DNS servers

22

Scenario Simulation -Registrar
Parent Zone
（gTLDs，ccTLDs）

User Query

Domain Registration

Generation of a key
Update (transfer)

Internet
Performance of LBs
DNSSEC Key
Registration
Registration
I/F

ユーザ登録UI
User I/F for Registrant（Webなど）(via Web)
Deletion of the key

Load Balancers
NATglobal

Performance of Servers
Authoritative DNS servers

Customer DB
RR Management
DB
Key Management
DB

Key GenerationZone Signing
23

Scenario Simulation -Registrar
Parent Zone
（gTLDs，ccTLDs）

User Query

Domain Registration

Rate Limit

U I/FRestriction
User I/F for Registrant(via Web)Internet

Key management
DB

Load Balancers

Registration

Registration
System global

NAT

Key generation

Customer DB
Server
RR Management
DB

Authoritative DNS servers

Zone copy
reloadSigning. Key generation, Key rollover
Zone data submission, order to reload
24

Results from Scenario Simulation• There are many point of changing specification– Key generation, Key management, zone signing, update
DNS servers– Key registration systems must be changed according toregistry systems• User Interface for registrants is very important– DNSSEC signing, unsigning– Delete, re-regsitration• Registrar must review all configurations– Load Balancers– Rate Limit against amplifier attack or DDoS attack– TCP port53 Filtering25

Results from Service Model Workshop• Adopting DNSSEC into the Service– There is no “Active” Motivation.
• Cost: very expensive• Additional Income: very small (or none)• “Passive” Motivations– Risk is very high when security incidents or accidents occur.
– Business Chances may be lost without DNSSEC skills.

• Suggestions:– Adopting DNSSEC has little advantages but not adopting
has many disadvantages– Service Providers should decide when and how they adopt
DNSSEC in a short time

Registrars and DNS Service Providers• Authoritative DNS servers side
– TLD Registries adopt or will adopt DNSSEC– Registrars should consider whether they adopt ornot– DNS Service Providers are same as above• Recursive DNS servers side
– Internet Service Providers should considerwhether they adopt or not, and when and how ifthey adopt

Unofficial status among members

Registrar
Name
Service StyleA
DS Record Handling

Owner of keys
Registrant

FeeWhen?
Free TBD

BRegistrant

Toll

DS Record Handling

Mar, 2011

Authoritative DNS Provider
NameC

Service Style
Optional Service

Owner of keys
ProviderFeeWhen?
Toll Mar, 2011

D

Optional Service

ProviderFree TBD

E

Default Service

ProviderFree TBD

F

Default for New Customers

ProviderFree Mar, 2011

G

System Integration & Outsourcee Individual Support Toll

Jan, 2011

HOEM Service for Small ISPs

Mar, 2011

ProviderTollUnofficial Status among members
ISP(Recursive DNS Server Provider)
NameI

Owner of keys
Dual Types of Service/Opt-in

FeeWhen?
Free Jan, 2011

J

Validation Enabled for certain services

FreeTBD

K

TBD

Free

TBD

L

Validation Enabled

FreeTBD• SANYO Information Technology Solutions(SANNET) has enabled
DNSSEC validation on 21 Jul 2010.

Resources for
Recursive DNS servers

Investment for Recursive DNS Servers

ISP X

Validation
EnableGap ofResources forEnabling
ISP Y
DNSSEC
Validation at
No Validation this timetimeNow

Agenda• Background• Introduction of DNSSEC Japan• Accomplishments from Activities• Future Plan

Future Plan of DNSSEC.jp• Collections of failure knowledge on DNSSEC
operation and sharing them among operators• Measurement of DNSSEC deployment in Japan incooperation with JPRS
• “DNSSEC enabled” logo for service providers• Translation of our documents into English orother languages(Call for Volunteers)• Transferring all knowledge and materials to DNS
operators as regular basis after introduction
phase is finished