Petr Špaček

We will show how to use open-source DNS server "Knot DNS" to automatically sign and maintain DNS zones, and how to automate DNSSEC maintenance.

Today DNSSEC technology is mature and automation tools are available for all tasks.

In this talk we will show how to use open-source DNS server "Knot DNS" to sign your DNS zone and publish keys with little effort, and how to automate DNSSEC key management using CDS/CDNSKEY technology (RFC 8078).

Why is using a single DNS implementation not enough? Discussion about complexities of multi-vendor deployment, and why you should use multi-vendor setup anyway.

In theory all the DNS server implementations do basically the same thing, so why bother with deploying and maintaining software from more than vendor?

In this talk we will look at consequences of having single DNS implementation, and give basic recommendations on DNS diversity.

After an introductory presentation we will together discuss complexities of multi-vendor deployments, and try to gather ideas for common configuration interface which could help people to deploy software from multiple vendors.

"Security slows down everything." Or not? This talk will explain how aggressive use of DNSSEC-validated cache (aka RFC 8198) boosts DNS performance, and why signing your own domain can provide higher security and performance at the same time.

How to find out who, where, and how broke your DNS resolution? What support line to call?

These are hard questions because today's DNS is very complex and even simplest query for an IP address might involve dozen different parties. In this tutorial we will walk though typical scenarios and use common tools to find out why things do not work as we expect and who to contact.

Format of the talk is presentation with screencast from live debugging sessions. Attendees are encouraged to bring own laptops with working network, pre-installed command-line tools dig, delv, drill, ping, and a web browser. This might be handy if you want to play with the tools during the talk.