Documents

IETF Documents

Published:

• RFC 8020 - NXDOMAIN: There Really Is Nothing Underneath; November 2016
• RFC 8901 - Multi-Signer DNSSEC Models; September 2020
• RFC 9102 - TLS DNSSEC Chain Extension; August 2021

Drafts/Works in Progress

• Empty Non-Terminal Sentinel for Black Lies
• Delegation Revalidation in DNS Resolvers
• Glue In DNS Referral Responses Is Not Optional
• Client Certificates in DANE TLSA Records
• TLS Extension for DANE Client Identity
• NSEC5: DNSSEC Authenticated Denial of Existence
• Algorithm Negotation in DNSSEC

---

Misc Documents, Talks, Articles ..

• Evolving Landscape of the DNS , January 20th 2023
  University of Virginia, ECE Distinguished Seminar Series
• Black Lies Empty Non-Terminal Sentinel, July 29th 2021
  IETF 111 DNS Operations Working Group Meeting
  Video recording
  (Local copy)
• Domain Verification Techniques, July 26th 2021
  IETF 111 DNS Operations Working Group Meeting
  (Local copy)
• (DNS) Glue is not Optional, July 26th 2021
  IETF 111 DNS Operations Working Group Meeting
  Video recording
  (Local copy)
• Delegation Validation by DNS Resolvers, April 23rd 2020
  (with Paul Vixie and Ralph Dolmans)
  IETF DNS Operations Working Group Interim Meeting 02
  Virtual
  Video recording
  (Local copy)
• Improving DNSSEC Provisioning with 3rd Party DNS Providers, February 8th 2020
  (with Steve Crocker)
  32nd DNS-OARC Workshop, San Francisco, CA, USA.
  Link to Video of talk (45m15s into this video)
• Evolution of the DNS Landscape, January 10th 2020
  Keynote Speech, BDnog 11 Conference, Cox's Bazar, Bangladesh.
• Multi-Signer DNSSEC Models, November 26th 2019
  Nordic Domain Days conference, Stockholm, Sweden.
• Whither Dane? [Guest article at APNIC's Blog], July 5th 2019
• Whither DANE?, May 13th 2019
  DNS-OARC Workshop (OARC 30), Bangkok, Thailand.
  Link to Video of talk (27m1s into this video)
• Multi-Signer DNSSEC Models, May 12th 2019
  DNS-OARC Workshop (OARC 30), Bangkok, Thailand.
  Link to Video of talk (2m45s into this video)
• Multi Provider DNSSEC, March 22nd 2018
  DNSOP Working Group, IETF 101 Meeting, London, U.K.
  Link to Video of talk (33m16s into this video)
• TLS DNSSEC chain extension: remaining issues, March 21st 2018
  TLS Working Group, IETF 101 Meeting, London, U.K.
• DNSSEC for a Large Enterprise, March 8th 2018
  DNS-OARC Workshop (OARC 28), San Juan, Puerto Rico.
• DNSSEC Algorithm Negotiation proposal, July 20th 2017
  IETF 99 Meeting, Prague, Czech Republic.
• NSEC5: Updated Specification and Implementation Results, May 15th 2017
  Video recording
  DNS-OARC Workshop (OARC 26), Madrid, Spain.
• Can NSEC5 be practical for DNSSEC deployments?, February 2017
  Cryptology eprint archive.
• RFC 8020: NXDOMAIN: There Really Is Nothing Underneath, November 2016
  Internet Engineering Task Force.
• DNSSEC validation chain TLS extension, November 17th 2016
  IETF 97 Meeting, Seoul, South Korea.
• NXDOMAIN cut, next steps, April 6th 2016
  IETF 95 Meeting, Buenos Aires, Argentina.
• DANE and DNSSEC Authentication Chain Extension for TLS, July 20th 2015
  IETF 93 Meeting, Prague, Czech Republic.
• Client Certificates in DANE TLSA Records, July 20th 2015
  IETF 93 Meeting, Prague, Czech Republic.
• Query-name minimization and Authoritative Server Behavior, May 9th 2015
  DNS-OARC Spring 2015 Workshop, Amsterdam, The Netherlands.
• DANE and application uses of DNSSEC, February 11th 2015
  ICANN 52 Meeting, Singapore
• RSSAC 002: Advisory on Measurements of the Root Server System, November 20th 2014
  (authored by the RSSAC Caucus, of which I'm a member)
• Using the getdns API: a new application friendly interface to the DNS, November 3rd 2014
  RIPE 69 Meeting, London, UK
• DANE and application uses of DNSSEC, October 29th 2014
  Internet2 Technology Exchange, Indianapolis, IN
• DNSSEC Tutorial, November 3rd, 2013
  DNSSEC Training session/Tutorial (1/2 day course) at USENIX LISA 2013 Conference
  Washington, DC
  Pre-conference interview about the tutorial (by Matt Simmons).
• Using and Migrating to IPv6, November 4th, 2013
  IPv6 Training session/Tutorial (full day course) at USENIX LISA 2013 Conference
  Washington, DC
  Pre-conference interview about the tutorial (by Matt Simmons).
• DNSSEC Tutorial, May 4th, 2013
  DNSSEC Training session/Tutorial (1/2 day course) at LOPSA East 2013 Conference
  New Brunswick, NJ
  
• Using and Migrating to IPv6, May 4th, 2013
  IPv6 Training session/Tutorial (1/2 day course) at LOPSA East 2013 Conference
  New Brunswick, NJ
  
• Advancing the Network: Where We’ve Been, Where We’re Headed, December 11th 2012
  Internet Society, ION Panel (served as panel moderator)
  (with Ron Broersma, Paul Ebersman, Paul Mockapetris, John Spence)
  San Diego, CA
  
• DNS and DNSSEC, December 11th 2012
  DNS/DNSSEC Training session/Tutorial (1/2 day course) at USENIX LISA 2012 Conference
  San Diego, California
  
• Using and Migrating to IPv6, December 10th 2012
  IPv6 Training session/Tutorial (full day course) at USENIX LISA 2012 Conference
  San Diego, California
  
• Are You Part Of The 1%? (Information Week), August 6th 2012
• A Survey of DNSSEC Deployment in the US R&E Community, July 16th 2012
  Summer 2012 Internet2 Joint Techs Conference, Stanford University, Palo Alto, CA
  Slides and Video at conference website
• World IPv6 Launch and Penn, June 6th 2012
  Megaconference V6, an IPv6 enabled global H.323 video conference
  Video recording of the talk
  
• DNS and DNSSEC, May 12th 2012
  DNS/DNSSEC Training session/Tutorial (1/2 day course) at PICC 12 Conference
  New Brunswick, New Jersey
  
• Using and Migrating to IPv6, May 12th 2012
  IPv6 Training session/Tutorial (1/2 day course) at PICC 12 Conference
  New Brunswick, New Jersey
  
• Using and Migrating to IPv6, December 6th 2011
  IPv6 Training session/Tutorial (1/2 day course) at USENIX LISA 11 Conference
  Boston, Massachusetts
  
• Kerberos at Penn, October 26th 2011
  2011 Kerberos Conference, MIT, Cambridge, Massachusetts
  
• Campus IPv6 Deployments Panel, July 12th 2011
  Summer 2011 Internet2 Joint Techs Conference, Fairbanks, Alaska
  
• Migrating to IPv6, April 30th 2011
  1/2 day Tutorial Session (slides coming soon)
  Professional IT Community Conference 2011, New Brunswick, New Jersey
  
• IPv6 Security Planning panel, April 18th 2011
  Spring 2011 Internet2 Member Meeting, Arlington, Virginia
  
• Open Source VoIP at Penn, January 31st 2011
  Winter 2011 Internet2 Joint Techs Conference, Clemson, South Carolina
  Slides and video at conference website
  
• Kerberos at Penn, October 27th 2010
  Kerberos in the Knowledge Enterprise (panel moderator)
  2010 Kerberos Conference, Massachusetts Institute of Technology, Cambridge, MA.
  
• Monitoring IPv6 Content Reachability and Accessibility, July 13th 2010
  Summer 2010 Internet2 Joint Techs Conference, Columbus, Ohio.
  
• EDU DNSSEC Testbed, February 2nd 2010
  Winter 2010 Internet2 Joint Techs Conference, Salt Lake City, Utah.
  Slides and video at conference website
  
• IPv6 Campus Deployment Updates Panel, February 1st 2010
  Winter 2010 Internet2 Joint Techs Conference, Salt Lake City, Utah.
  Slides and video at conference website
  
• DNSSEC at Penn, July 20th 2009
  Summer 2009 Internet2 Joint Techs Conference, Indianapolis, Indiana.
  Slides and video at conference website
  (Note: about 40 seconds of audio from the 1st minute of the talk is missing because of technical issues. The talk is about 22 minutes long).
• PennNet and MAGPI, April 1st 2009
  An overview of the architecture of the campus network for Roch Guerin's TCOM 502 (Advanced Networking) class
• IPv6 Deployment at the University of Pennsylvania, January 8th 2009
  Educause Mid-Atlantic Regional Conference 09
• Internet2 DNSSEC Pilot and Deployment Obstacles, February 14th 2007
  ESCC/Internet2 Joint Techs Workshop, Minneapolis, Minnesota.
  [archived video]
• Internet2 DNSSEC Pilot and ARIN, October 10th 2006
  North American Network Operators Group ( NANOG 38)
• Internet2 DNSSEC Pilot Update, July 19th 2006
  ESCC/Internet2 Joint Techs Workshop, Madison, Wisconsin.
• Advanced Services at MAGPI: Multicast, IPv6, DNSSEC etc,
  April 19th 2006, MAGPI Technical Forum
• Single Sign-On, Two Factor and more: Authentication and Authorization at the University of Pennsylvania,
  September 21st 2005; Fall 2005 Internet2 Member Meeting, Philadelphia, PA. [pdf]
• Designing High Availability Networks, Systems, and Software for the University Environment, [ppt]
  January 14th 2004, (with Deke Kassabian);
  EDUCAUSE Mid-Atlantic Conference, Baltimore, Maryland
• An Introduction to Kerberos, March 19th 2003
  Univ of Penn, Information Technology Orientation series.
• Quality of Service (QoS) Deployment Issues, April 15th 2002
  Panelist talk at the NSF/ITR Workshop on Scalable QoS Solutions, Annapolis, Maryland
• Networked Application Performance, February 25th 2002
  (with Deke Kassabian), Super Users Group , University of Pennsylvania

---

Older Stuff

• IPv6 Deployment at Penn, March 2009
• Penn DNSSEC Press Release, November 2009
• PennNet-21 Central Authentication Infrastructure [official copy], March 2004
• PennNet High-Availability and Rapid-Recovery Services, August 2003
• MAGPI GigaPoP Network Services
• Campus Core Router Test Plan, November 2004