SIDN Blog

DANE is a great idea in theory, botched by a bad practical implementation and low deployment (how much of that is related to the influence of the CA mafia is left as an exercise to the reader). There is some hope for the future: https://www.sidn.nl/en/news-and-blogs/new-opportunity-for-dane-for-web

I have also been self-hosting email for 15 years and only had couple of problems at the beginning, mainly until my IP got enough reputation. I have been hosting it on a bare metal Supermicro server in a proper datacenter, though. It has reverse-DNS, SPF, DKIM, TLS, MTA-STS and even DANE with DNSSEC (on a self-hosted BIND but that's another story). It is implemented using Exim, Dovecot, SpamAssasin, DNSBL and Roundcube with OpenLDAP auth. I can recommend this awesome hand-on guide provided by Netherlands Domain Registration Foundation as a basis of a nice configuration https://www.sidn.nl/en/news-and-blogs/hands-on-implementing-dane-in-ex… I had some troubles with IMAP search. I set up CLucene, it was easy and enough for me (no need for Java Lucene). It just took me a long time to figure out why it wouldn't search a domain part of email addresses. It just required to set up the tokenizations in such a way to split words also on @ character, i.e. don't consider a full email address as a word. :P I also had some troubles with OpenLDAP until I finally decided to read the docs and examples there properly. Since then I have been using this setup happily and it appears I will continue to do so! I also share the LDAP with NextCloud btw.

This was first done by SIDN I believe, the company that orchestrates the .nl domains. They however, do not implement most of the spec. When searching their online whois[1], they'll tell you if a domain is for sale and link to the for sale page. They don't use any of the info you put in the DNS though. The URL comes from their internal system. You need to register it separately. They also don't use the price, txt or anything else you put in the DNS. All they use is the "fcod", to look up the url in their own system. They had a different syntax for this before, but this functionality has existed for some years. [1] https://www.sidn.nl/whois

It should be automateable, yes. Different RIRs (regional internet registries), which all operate their own WHOIS databases, might handle this differently but generally you should be able to get an abuse contact in an automated fashion for exactly this reason > most of the scanner firms seem to be creating their own maps of as much of the internet as they can get their grubby hands on, and then sell API access to their database Yeah, sure, a lot of scanners are run by black or gray hats. Just saying that all options are on the table and blocking (or even reporting) e.g. the non-profit .nl operator organization for scanning tcp:443 on all the A/AAAA records of .nl domains is going to do much good (Example of what they're doing: https://www.sidn.nl/en/news-and-blogs/new-system-for-logo-based-detect…

That's the approach that DANE takes https://www.sidn.nl/en/modern-internet-standards/e-mail-security-stand…

I'm really not interested in whatever technicality you're trying to argue here. I'm talking about whatever words you want to use for this phenomenon: https://www.sidn.nl/en/modern-internet-standards/dnssec Meanwhile: the graphs I posted in the preceding comment are pretty striking. If you haven't clicked through yet, you should. I've pointed out previous, minor drops in DNSSEC deployment in the US. The current one is not minor.

The market price for IPv4 addresses has peaked: https://www.sidn.nl/en/news-and-blogs/are-we-past-peak-ipv4 Amazon’s move seems to be motivated by pure greed and quasi-monopoly complacency.

I like how the .nl tld in the Netherlands is managed by the non-profit SIDN [0]. They are dedicated to an open internet, and they make sure that I can very easily move my domain between (hosting) providers for example (and indeed it was easy to transfer from transip to vimexx for me). They are truly independent. It's how it should be if you ask me. When I read about the .org issues and now .io, I'm happy with my .nl domain, for personal use. [0]: https://www.sidn.nl/en/about-sidn/what-we-stand-for

IPv4 can be addressed from an IPv6 only device when an ISP configures their network with the feature, many mobile phone providers already have fully IPv6 networks: https://www.sidn.nl/en/news-and-blogs/australias-telstra-switches-mobi…

Having cryptographically signed DNS records that can’t be forged and can be validated is good thing, which is what DNSSEC provides. Right now, DANE is the only way to mitigate downgrade attacks with SMTP and TLS connections. Apparently use of DANE for email is growing [1]. DANE hasn’t taken off with browser vendors because of their concern about additional DNS lookups when making TLS connections. [1]: “Number of DANE-enabled mail domains growing exponentially”—https://www.sidn.nl/en/news-and-blogs/number-of-dane-enabled-mail-doma…

For .nl, the whois information for individuals is hidden except for a) interested parties (manually approved) b) investigative/enforcement authorities c) CAs (need to validate ownership). It's all explained in English at https://www.sidn.nl/a/nl-domain-name/sidn-and-privacy?language_id=2 The organization handling .nl, SIDN, has worked like this for a pretty long time. It's pretty much a solved problem. The data is available, just not to a lot of people.

I've heard this claim too: apparently Facebook tested a lot of routers, and they consistently routed v6 ~500us faster than v4. v6 has no checksum, so routers don't need to recalculate it when they decrement the TTL header, and it does make sense that removing a step would help. Unfortunately my source for this is "I heard it from someone that works at Facebook". In practice this is only a small part of final performance, so you need to do end-to-end measurements to get a proper idea of what people will experience. Both Facebook[1] and Apple[2] have done that, showing 10% faster page loads and 40% faster connection establishment respectively on v6. Even if that was solely down to routing policies, it's still a measurable difference. [1] https://engineering.fb.com/2015/09/14/networking-traffic/ipv6-it-s-tim… [2] https://www.sidn.nl/en/news-and-blogs/apple-connections-established-40…