The NLnet Labs Blog

Sign in Subscribe

The Fall 2025 newsletter

The Fall 2025 newsletter

In this Fall edition of “Of Trees and Tries” we’re excited to share what we have been up to since the summer. If you were at IETF in Montreal earlier this month hopefully you got a chance to say hi to Benno (busy times as Nomcom chair), Luuk &

Hope Is Not a Strategy

Hope Is Not a Strategy

Open source software is often the unglamorous workhorse in your server rack, the silent operator in your stack, and the punk soul in your operations pipeline. It's thoroughly tested and trusted for all the right reasons. But when your business depends on it, you still need a lifeline.

DNSSEC Operations in 2026 – What Keeps 16 TLDs Up at Night

DNSSEC Operations in 2026 – What Keeps 16 TLDs Up at Night

Before building a successor to OpenDNSSEC, we asked 16 TLD operators what they needed. We expected tool talk—instead, we ended up discussing trust, continuity, and compliance.

Enabling more default features in NSD 4.13.0

Enabling more default features in NSD 4.13.0

By Jannik Peters NSD 4.13.0 now comes with the features --enable-bind8-stats, --enable-zone-stats, --enable-ratelimit, --enable-dnstap enabled by default, reducing confusion when using the same version of NSD packaged by different distributions with different configure options. Additionally, NSD 4.13.0 contains experimental support for AF_XDP sockets as described

Introducing dnst — a DNS Toolbox for network operators

Introducing dnst — a DNS Toolbox for network operators

By Alex Band More than two decades ago, NLnet Labs started the ldns library, with the goal of letting developers easily create RFC compliant DNS software in the C programming language. The library included a number of example programs, many of which have found their way into operator workflows. With

Experimental support for AF_XDP sockets in NSD

Experimental support for AF_XDP sockets in NSD

By Jannik Peters We have been developing support for AF_XDP sockets in NSD. They allow handling a higher rate of network packets than through the Linux network stack on supported hardware[1]—For a list of supported drivers (and by extension hardware) and their minimum Linux kernel version please

Overhauling Domain

Overhauling Domain

By Arya K. Previously, we discussed the massive development our domain library underwent over 2024. However, the project has been around much, much longer than that – the very first commit was made all the way back in 2015! It started out as Martin's side project and grew over

Introducing Roto: A Compiled Scripting Language for Rust

Introducing Roto: A Compiled Scripting Language for Rust

By Terts Diepraam We are working on an embedded scripting language for Rust. This language, called Roto, aims to be a simple yet fast and reliable scripting language for Rust applications. The need for Roto comes from Rotonda, our BGP engine written in Rust. Mature BGP applications usually feature some

Prometheus Metrics in NSD 4.12.0

Prometheus Metrics in NSD 4.12.0

By Jannik Peters We finally implemented a Prometheus metrics endpoint, providing the statistics you know from nsd-control stats/stats_noreset in Prometheus format via HTTP. To enable the Prometheus metrics endpoint, specify the option metrics-enable: yes in the config's server section. You can then point your Prometheus exporter

Domain Foundations – The first of our five year vision

Domain Foundations – The first of our five year vision

By Arya K., Martin Hoffmann and Alex Band About a year ago, we unveiled our vision for the next five years of DNS at NLnet Labs. In this series of articles, we’d like to provide you with an update on our accomplishments last year and our plans for 2025

DNS-over-QUIC in Unbound

DNS-over-QUIC in Unbound

By Wouter Wijngaards, with contributions from Yorgos Thessalonikefs DNS-over-QUIC (DoQ) uses the QUIC transport mechanism to encrypt queries and responses. The DoQ transport for DNS is defined in RFC 9250. With the recent release, Unbound can be configured to support DoQ clients downstream. This feature is not a standard component

Supply chain security obligations for NIS2 regulated entities vs. developers of open source software

Supply chain security obligations for NIS2 regulated entities vs. developers of open source software

How do supply chain security obligations under the European NIS2 legislation affect those that develop the Free and Open Source Software used by "essential providers" of digital infrastructure? An overview of the response to the public comment period to the NIS2 draft implementing act.

Tracking CRA implementation for Free and Open Source Software and its Stewards

Tracking CRA implementation for Free and Open Source Software and its Stewards

Active engagement on the Cyber Resilience Act helped to change the outcome of the negotiations for FOSS. With final text expected this fall, our focus is shifting towards CRA implementation. This includes collaborating on the "open-source software steward" role in a working group at Eclipse.

NLnet Labs 💞 Packagers

NLnet Labs 💞 Packagers

We are at our best when we can focus on Internet protocols and building elegant implementations in software. That is why we love it when others help out with packaging and distributing our software. And, on February 14th, it feels appropriate to express some love and appreciation for the many

What I learned in Brussels: the Cyber Resilience Act

What I learned in Brussels: the Cyber Resilience Act

Last weekend I co-organised an EU policy devroom at FOSDEM, marking the end of a wild ride in EU policy land working on the Cyber Resilience Act. In this post I want to contribute to a shared understanding of how the CRA will most likely affect developers of open source

The Sovereign Tech Fund Bolsters Our Sustainable Open-Source Efforts

The Sovereign Tech Fund Bolsters Our Sustainable Open-Source Efforts

This year, NLnet Labs will celebrate its 25th anniversary. For two and a half decades, we have stayed true to our founding principle to offer free, open-source, liberally licensed software to support core Internet infrastructure. Throughout 2024, the Sovereign Tech Fund will support the development of one of our projects,

Domain – DNS Building Blocks for Application Developers

Domain – DNS Building Blocks for Application Developers

In the previous article of this series, we presented our vision for DNS for the coming five years. In this post, we'll outline this year's milestones for expanding the domain crate, our Rust library serving as a collection of building blocks to include components of the

The Next Five Years of DNS at NLnet Labs

The Next Five Years of DNS at NLnet Labs

2024 marks 25 years of NLnet Labs. We have delivered on our mission to make the domain name system (DNS) more dependable and trustworthy, and we are full of ambitions for the future. DNS standards and operations have evolved significantly in the last decades as technology advances and increasingly sophisticated

Running Krill Under RIPE NCC

Running Krill Under RIPE NCC

When using RPKI in the RIPE NCC service region you have the choice between using the Hosted RPKI service in the LIR Portal, or running Delegated RPKI. While using the RIPE NCC's web interface to manage Route Origin Authorisations (ROAs) works great, running Delegated RPKI with free, open-source

Open-source software vs. the proposed Cyber Resilience Act

Open-source software vs. the proposed Cyber Resilience Act

By Maarten Aertsen NLnet Labs is closely following a legislative proposal by the European Commission affecting almost all hardware and software on the European market. The Cyber Resilience Act (CRA) intends to ensure cybersecurity of products with digital elements by laying down requirements and obligations for manufacturers. 🥳update, december 2023: