Making the internet safer

DNS-Labs' main focus is always DNS and how to promote the use of DNSSEC on the internet. This is what the team is currently working on.

Tre män har ett stående möte. En skriver på whiteboardtavlan.

Implementation of CDS/CDNSKEY

The implementation of CDS and CDNSKEY functionality for the .se and .nu zones is one of several initiatives from The Swedish Internet Foundation to make it easier to enable DNSSEC. This project is developed in close cooperation with our IT-Development team, which implements the function into our registry system.

This is DNSSEC

The security extensions make the internet safer by protecting information from manipulation when it passes through the domain name system.

This functionality allows a name server operator to enable DNSSEC for zones they handle without the need to contact the responsible registrar.

CDS/CDNSKEY is a recent functionality which is currently being implemented among registries. One organization that already has implemented this is .cz in the Czech Republic. By implementing the functionality for the .se and .nu zones, DNS-Labs and The Swedish Internet Foundation aim to make CDS/CDNSKEY a standard functionality among registries.

DNS-Lab will also implement scanning for CSYNC records (RFC7477). This will allow name server operators to update more technical domain information without relying on a registrar.

The .se domain is one of the leading country code top-level domains in the area of DNSSEC, and this project goes hand in hand with The Swedish Internet Foundation’s efforts through DNS-Labs to promote DNSSEC worldwide.

Närbild av en man som skriver på en whiteboardtavla.

Transition from NSEC3 to NSEC

After extensive testing by DNS-Labs during the fall of 2020, The Swedish Internet Foundation successfully migrated the .nu domain from NSEC3 to NSEC.

The purpose of both NSEC3 and NSEC is knowing when a name exists within a zone. This prevents malicious actors from sending fake negative responses to queries. When The Swedish Internet Foundation took over the operation of .nu in 2013 it came with NSEC3 enabled, while .se has been using NSEC.

The purpose of the migration was to increase homogeneity between the two zones, and reduce complexity for .nu. Since the zone files are published online there are no technical requirements to use NSEC3. Stability was also a concern since some European top-level domains have experienced operational issues with NSEC3. In late 2020, .nu became the first large TLD in the world to complete such a transition.

The operation fits perfectly within DNS-Labs' focus on research and development as well as sharing practical knowledge with others to contribute to a more robust and secure internet.