- The document discusses the past, current, and future status of DNSSEC implementation in the .si top-level domain. It notes that .si was signed in late 2011 but that full deployment is still far off due to low DNSSEC awareness and concerns about additional administration needs. Future plans include improving registry support, educating resolver operators and internet users, and incentivizing the signing of .si domains.

1. DNSSEC
in
.si
Where
we
are
Benjamin Zwittnig
Arnes, Register.si
Benjamin.zwittnig@register.si

2. Agenda
• Past actions
• Current status
• Future plans
• Conclusion

3. Past actions
• Recursive DNS servers
- Turned on validation in 2010
- Monitoring traffic, anomalies, increase of
TCP...
• Authoritative zone(s)
• Prepare for signing .si
- A lot of testing
- HSM modules
- Different rollover scenarios
- Traffic
- A lot of documentation

4. Current status
• At the end of 2011
- .si was signed
- DS records were published in root zone
• No problems with signing procedures
• DNSSEC provisioning in the registry sistem is not
ready yet
• DS records for .si domains
- cca 20 .si domains have DS records in .si
- No real interest

5. Current status
• Resolver operators
- On 7th place acording to a RIPE report
• Government shows some interest in
DNSSEC
- Validation on their recursive resolvers
- Signing of their domains later

6. Current status
• Knowledge about DNSSEC is quite low
• Afraid of technology
• No more zero time administration
- Regular key rollovers
- Difficult debugging
- No immediate benefit from DNSSEC
• Chicken and egg problem

7. Future plans
• Adapt our registry software to support DNSSEC
• Offer an optional DNSSEC signing service for our
customers (as NREN)
• Convince resolver operators to turn on validation
• DNSSEC workshops for all interested parties
• Marketing of DNSSEC
• Discounts for DNSSEC signed domains ?

8. Conclusion
• Although we have signed .si, we are still far from a
full deployment
• Some new problems
- Transfer of DNSSEC signed domains
- DDoS amplification attacks
• For a real spin off we need
- Good DNSSEC awareness among internet users
- Critical mass
- A good application/service which uses benefits of
DNSSEC (maybe DANE)