Roller NetworkWe’ve made a few changes to the DNSSEC Supported Algorithms.
RFC6986 deprecates the use of GOST R 34.11-2012, and the Algorithm Implementation Requirements and Usage Guidance for DNSSEC intends to move DNSSEC ECC-GOST support in signers to the ‘MUST NOT’ category. Existing GOST keys should be rolled to another key type.
We are working on feature realignment for Secondary DNS. Since it’s recently been migrated to paid-only, some options may still refer to requiring a paid account. Some of the paid vs. free features are are in the process of reevaluating are: TSIG support, master server settings, and zone file commands.
UPDATE:
These features previously required a paid account of Personal or higher and were not available on free accounts. Since all Secondary DNS use now requires a paid account, these features have been realigned to an account level of Basic or higher.
We’ve recently migrated all of our sites to HTTPS. The account control center and webmail will continue to use Extended Validation certificates like they always have, while everything else will now be using certificates from Let’s Encrypt.
Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. This helps create a more secure and privacy-respecting web.
Why HTTPS Everywhere?
Recently there’s a lot of buzz about moving to an HTTPS-only web. Previously, the cost of obtaining lots of HTTPS certs, having to manually install them, renew them, and pay fees for them discouraged using HTTPS unless needed. Let’s Encrypt solves many of those problems. Deploying HTTPS does take a little more effort, but there’s another reason why you should do it even if you think your site isn’t really that important to go encrypted: to help protect your visitors from their ISP.
We’ve personally experienced content hijacking with Charter, the local cable provider in Reno, NV (that now likes to be called Spectrum but we’re still going to call them Charter). Charter, for example, will hijack HTTP requests on residential and business coax service to provide content other than what you’ve requested. This is not the same as DNS redirection. HTTPS not only protects your privacy, but encryption ensures that the content you’ve requested passes between you and the site in its original, unaltered form without being rewritten or hijacked by your ISP, in addition to preventing eavesdropping. This is also known as a “man in the middle” attack. References: here, here, here, and here (plus we’ve seen it ourselves on home cable).
It is our opinion that an ISP altering content is entirely unacceptable for any reason. The only way we can truly protect ourselves is with encryption, not laws or depending on ISPs to “do the right thing”. Read more at EFF: Encrypting the Web.
We’re discontinuing the reseller accounts feature of the account control center. This decision comes after observing that it hasn’t been used in a long time, and with updates working on for the account control center we can save a lot of time if we don’t have to maintain the code for reseller accounts.
Because the feature is not being used, this change should not affect any account holders.
Support for the TLSA record has been added to the Primary DNS service.
We’ve also streamlined up the display for SSHFP records in this update.