The DOs and don’ts of post-quantum DNSSEC
Post-quantum signatures could dramatically enlarge DNSSEC responses, shifting many queries from UDP to TCP. Should resolvers limit unnecessary DNSSEC data, or is greater TCP use inevitable?
Tag: DNS
Restating the case for DNSSEC
Does TLS make DNSSEC unnecessary? An examination of common DNSSEC assumptions challenges that argument and considers DNSSEC’s role in establishing trust, the risks of partial deployment, and the evidence from real-world outages.
Same place, different view: How VPNs shape what we learn about the Internet
Guest Post: A study found that changing VPN providers can change where web traffic appears to be served, affecting conclusions about domestic infrastructure, cross-border traffic, and data localization.
[Podcast] Quad9 — Measurement in the privacy-preserving public DNS service
Darren Kara discusses how the Quad9 Public DNS server balances privacy, measurement, and global threat intelligence to help protect users from malicious destinations.
Rolling the root key: What happened?
The DNS root key was rolled on 11 October 2026. Was the key roll a success?
Rolling the root key
The root key of the DNS is scheduled to roll on 11 October. How many DNSSEC-validating recursive resolvers have learned of KSK-2024 and incorporated it into their TA sets?
[Podcast] ‘Just say no’ isn’t as simple as you think
A continuation of the discussion on surplus DNS queries seen at APNIC Labs, the implications of how you say ‘no’, and the transport used for the DNS.
One or two nameservers?
Do multiple dual-stack nameservers increase or decrease repeat DNS queries? The results of this experiment were a complete surprise.
Building resilient self hosted services is not always easy
Resiliency through more redundancy is important no matter the scenario.
What part of ‘No!’ is so hard for the DNS to understand?
At APNIC Labs we’ve been experimenting with understanding how the DNS handles requests to resolve nonexistent names to make the DNS more resilient to random name attacks.