From d5b0a63332eaa74bf21822f38dfde7ec9898d3f4 Mon Sep 17 00:00:00 2001 From: Josh Aas Date: Tue, 17 Dec 2024 21:46:39 -0500 Subject: [PATCH] Update Hickory DNS page. --- content/en/initiative/dns.html | 20 ++++++++++++---- content/en/initiative/dns/dns-work-plan.md | 28 ---------------------- 2 files changed, 16 insertions(+), 32 deletions(-) delete mode 100644 content/en/initiative/dns/dns-work-plan.md diff --git a/content/en/initiative/dns.html b/content/en/initiative/dns.html index 68813c3..b0c103b 100644 --- a/content/en/initiative/dns.html +++ b/content/en/initiative/dns.html @@ -16,18 +16,30 @@

The Story

While there are many DNS implementations out there, including some memory safe ones, there are no open source, high performance, memory safe, fully recursive DNS resolvers. Until that exists, many DNS operators will continue to deploy DNS software written in languages that are not memory safe, putting critical Internet infrastructure at risk.

-ISRG's Let's Encrypt certificate authority would be amongst the first to deploy it. Making many recursive requests per second, Let’s Encrypt can help prove Hickory’s performance at scale. Meanwhile, Hickory will harden a critical part of the Let’s Encrypt infrastructure stack thanks to its use of a memory safe language. +We are investing in a DNS implementation called Hickory DNS, started in 2015 by Benjamin Fry. Our goal is to make Hickory the most secure high performance resolver out there. +

+ +

What We've Done

+ +* During 2023 Prossimo provided support for rebranding to Hickory DNS. +* During 2024 ISRG staff member David Cook made numerous improvements, particularly targeting the needs of ISRG's Let's Encrypt certificate authority. +* In November of 2024 a third party security audit was completed and issues found were remediated. +* In December of 2024 Ferrous Systems completed a contract in which they made huge improvements to DNSSEC and NSEC3 support for the recursive resolver. + +

+We'd also like to note that while we have been making our investments, the broader Hickory DNS community has grown rapidly. We're excited to see all of the new contributors and the great work they are doing!

What's Next

-Hickory is one of the most promising memory safe DNS resolvers out there. It’s an open-source project started in 2015 by Benjamin Fry as an exploration of a memory safe DNS implementation in the Rust programming language. Hickory is now ready for use in production, though we will be making additional investments in features, security, and performance. Our goal is for Hickory to be one of the most attractive resolvers for many use cases. +Our current goal is to get Hickory ready for deployment at Let's Encrypt. Making many thousands of recursive requests per second, Let’s Encrypt can help prove Hickory’s performance at scale. Meanwhile, Hickory will harden a critical part of the Let’s Encrypt infrastructure stack thanks to its use of a memory safe language. We are hard at work on the relevant issues.

Links

diff --git a/content/en/initiative/dns/dns-work-plan.md b/content/en/initiative/dns/dns-work-plan.md deleted file mode 100644 index eb36280..0000000 --- a/content/en/initiative/dns/dns-work-plan.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: Hickory DNS -slug: dns-work-plan -background: dce0e9 -image: /images/blog/Hickory-DNS.png ---- - -

Work Plan

- -**1. Prepare for Let's Encrypt deployment** - -Complete improvements needed in order to deploy to Let’s Encrypt. This is important because it makes DNS safer for Let’s Encrypt but also because it will demonstrate to other potential users that the resolver can function well in a demanding environment. - -* Add support for DNSSEC validation for recursive queries -* Add support for NSEC(3) -* Add support for IP allow lists for inbound connections -* Add support for a denylist for outbound ports -* Add support for a “do-not-query” list -* Add support for cache policies by record type -* Add support for NS round-robin to reduce triggering rate-limiting - -**2. Security audit** - -A third party security audit will be performed and findings will be addressed. - -**3. Performance improvements** - -Improve performance (queries/second, CPU and memory usage) such that the resolver can be used in the most critical and demanding environments.