Subject: [dane] DNS hosting

From: Jack Bates <[email-masked]>
Date: Fri, 02 Aug 2013 14:03:52 -0700

Hello, does someone on the list know about a DNS hosting provider with 
support for TLSA records? Or are folks who already published TLSA 
records mostly managing their own DNS servers?

Here are some of the hosting providers I checked, several now support 
DNSSEC, but unfortunately no support for TLSA records yet:

    o  DreamHost
    o  Namecheap
    o  GKG
    o  Go Daddy
    o  easyDNS

I guess Dyn might support TLSA records, but only as part of their 
premium service (I haven't confirmed yet) http://dyn.com/dns/dns-comparison/

Thanks!

---

From: Paul M <[email-masked]>
Date: Sat, 3 Aug 2013 12:08:43 +0300

Jack there are exceedingly rare implementors of DANE and the two I've come
across seem to manage their own DNS servers.

I came across Netfuture because of this tutorial they published it seems
they have their own TLSA records:
https://netfuture.ch/2013/06/how-to-create-dnssec-dane-tlsa-entries/ and
Nlnetlabs who've written  software that supports DANE:
http://www.nlnetlabs.nl/ <http://www.nlnetlabs.nl/projects/ldns/>

Currently, its a very tall order getting even one DNS hosting provider
implementing DANE. Maybe others in the DANE mailing list can give us a
hint.

On Sat, Aug 3, 2013 at 12:03 AM, Jack Bates <[email-masked]> wrote:

> support for TLSA records? Or are folks who already published TLSA records
> mostly managing their own DNS servers?
>
> I guess Dyn might support TLSA records, but only as part of their premium
> service (I haven't confirmed yet) http://dyn.com/dns/dns-**comparison/<http://dyn.com/dns/dns-comparison/>
>
> Thanks!
> ______________________________**_________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/dane<https://www.ietf.org/mailman/listinfo/dane>
>

-- 
:-) Paul M

---

From: Warren Kumari <[email-masked]>
Date: Sat, 3 Aug 2013 15:28:37 +0100

Apologies for terseness, about to board plane.

Registro.br has a hosted DNS solution where you register the domain, and if you host your DNS with them you simply click a lock icon -- they go fetch the cert (from www.example.com), validate it and then publish a TLSA record.

It is very slick -- Frederico  Neves has been promising to do a write up with screenshots and such, but keeps getting sidetracked...

W

Warren Kumari
------
Please excuse typing, etc -- This was sent from a device with a tiny keyboard.

On Aug 3, 2013, at 10:08 AM, Paul M <[email-masked]> wrote:

> Jack there are exceedingly rare implementors of DANE and the two I've come across seem to manage their own DNS servers.
>  
> I came across Netfuture because of this tutorial they published it seems they have their own TLSA records: https://netfuture.ch/2013/06/how-to-create-dnssec-dane-tlsa-entries/ and Nlnetlabs who've written  software that supports DANE: http://www.nlnetlabs.nl/  
> 
> Currently, its a very tall order getting even one DNS hosting provider implementing DANE. Maybe others in the DANE mailing list can give us a hint. 
> 
> 
>> Hello, does someone on the list know about a DNS hosting provider with support for TLSA records? Or are folks who already published TLSA records mostly managing their own DNS servers?
>> 
>> Here are some of the hosting providers I checked, several now support DNSSEC, but unfortunately no support for TLSA records yet:
>> 
>>    o  DreamHost
>>    o  Namecheap
>>    o  GKG
>>    o  Go Daddy
>>    o  easyDNS
>> 
>> I guess Dyn might support TLSA records, but only as part of their premium service (I haven't confirmed yet) http://dyn.com/dns/dns-comparison/
>> 
>> Thanks!
>> _______________________________________________
>> dane mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/dane
> 
> 
> 
> -- 
> :-) Paul M
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: James Cloos <[email-masked]>
Date: Sat, 03 Aug 2013 11:14:21 -0400

>>>>> "JB" == Jack Bates <[email-masked]> writes:

JB> Hello, does someone on the list know about a DNS hosting provider with
JB> support for TLSA records? Or are folks who already published TLSA
JB> records mostly managing their own DNS servers?

You can use a number of such providers for their secondary service, but
I do not know of any whose primary service includes support for web-based
editing of zone with TLSA records.

Virtual servers can be leased for as little as 12-60 USD per year with
enough ram and net, disk & memory bandwidth to run a DNS server.

There are some web front-ends available to help manage your own primary,
depending on which server you choose.

http://lowendbox.com is a good resource for finding affordable virtual servers.

http://puck.nether.net/dns and https://acc.rollernet.us/help/dns/secondary.php
are good no-cost, dnssec-capable secondary services.

(I cannot speak for them, but given that rollernet's primary service supports
dnssec and records like sshfp, they *might* be responsive to a request to add
support for tlsa, too.)

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 1024D/ED7DAEA6