DNSSEC & KSK Rollover Patrick Jones Middle East DNS Forum & APTLD 75 21 February 2019

What is DNSSEC? DNSSEC = “DNS Security Extensions” DNSSEC is a protocol that is currently being deployed to secure the Domain Name System (DNS) DNSSEC adds security to the DNS by incorporating public key cryptography into the DNS hierarchy, resulting in a single, open, global Public Key Infrastructure (PKI) for domain names Result of over a decade of community based, open standards development Implemented in the root zone in 2010

State of DNSSEC Deployment at MEDNSF 2019 Over 90% of top-level domains are signed with DNSSEC 1532 TLDs in the root, 1398 are signed (reduction of 11 since MEDNSF 2018) 1386 TLDs have trust anchors published About 50% of ccTLDs are signed Recent adoption in Mauritania’s IDN ccTLD on 30 Jan 2019 & .DZ on 5 Feb 2019

State of DNSSEC Deployment as of 20 Feb 2019

State of DNSSEC Deployment (source: ISOC Deploy360)

State of DNSSEC Deployment (source: ISOC Deploy360)

KSK Rollover

KSK Rollover Project Goal: Replace the key (KSK) used to sign the DNS root zone's DNSSEC key set since 2010 without disruption Passed many milestones, a few more to go Next up: removing the revocation record for the out-going KSK on 22 March 2019

Plans Made; Key Created Where It Is 2015 2016 2017 2018 2019 Design Team Plans Made; Key Created Publicize; The "Pause" Publicize; Change Key Revoke; Clean Up A key rollover can be done more quickly, but "going fast" has never been the goal

Audience Actions Have you done nothing so far and have seen no problems? Continue what you are doing! Have you been relying on Automated Updates (RFC 5011)? Are you manually managing the configuration of DNSSEC trust anchors? Remove the old key (2010) from trust anchors.

For More Information 1 2 3 4 Visit https://icann.org/kskroll Join the conversation online Use the hashtag #KeyRoll Sign up to the mailing list https://mm.icann.org/listinfo/ksk-rollover Ask a question to globalsupport@icann.org Subject line: “KSK Rollover” Attend an event Visit https://features.icann.org/calendar to find upcoming KSK rollover presentations in your region 2 3 4

Engage with ICANN – Thank You and Questions