KINDNS#

Ulrich Wisser

• Why: DNS operational hygiene is a resilience topic that touches every operator the PM works with, and KINDNS is ICANN's attempt to make DNS best practices auditable and adoptable — with a v2 revision actively under discussion.
• What: An overview of KINDNS (Knowledge-sharing and Instantiating Norms for DNS and Naming Security), ICANN's voluntary framework that breaks DNS operators into categories (TLD/critical zone, SLD, closed/private resolver, public resolver) and gives each 6–8 concrete practices.
• How: Category-specific MUST/SHOULD practice sets: DNSSEC signing and key management, restricted zone transfers, zone-integrity control, authoritative/recursive separation, infrastructure diversity (network, geography, software), monitoring; for resolvers, DNSSEC validation, ACLs on recursion, QNAME minimization, and DoT/DoH; for public resolvers, data-retention limits. v2 discussion points: response-rate limiting on authoritative servers, split operational responsibility (e.g. root-zone operators), IPv6 reachability and RPKI ROAs for the DNS prefixes themselves, and community steering.
• Where applicable: Any DNS operator from small to large; it is a checklist/framework, not a technology — its value is as an audit baseline and procurement reference.