About me

I am a professional software engineer and photographer from the Netherlands.
Things I get passionate about are Music, Internet Protocols, Photography, and Travel.

Contact me (matthijs@matthijsmekking.nl) or follow me on:

facebook icon instagram icon twitter icon linkedin icon


I take pictures, mostly but not limited to, of artists and cultural events. Down The Rabbit Hole, Fortarock, Zwarte Cross, and Valkhoffestival are some of the events that I have covered. My photos have been published on several sites, including 3voor12 VPRO, Doornroosje, and Popronde.

Take a look at my photo albums or dive into the archive.

Internet plumber

I design and write software that deal with networking, focusing on performance and security. I participate in the IETF, studying and improving Internet technologies and operations, editing and reviewing technical documents and Internet standards. My focus is on DNS and DNSSEC. I believe in open source and open standards.

  • Software engineer at Dyn
  • Participant at IETF
  • Software developer and researcher at NLnet Labs
  • Owner at BAMM
  • Software developer at Hexon

In practice

Aug 2014 - Present: Dyn

Dyn Inc. Internet company that provides traffic management, message management and performance assurance to commercial and private users worldwide with major customers.
  • Function: Senior software engineer.
  • Tasks: Software design and development.
  • Technology: c, Django, DRF, Git, Go, Python3, DNS, SDT, PostgreSQL, Vagrant.
  • Co-developing Dyn's new service platform, Hivecast.
  • Co-developing several DNS products, including Dynamic Steering, DynTLD, and Managed DNS for Hosting Companies.
  • Participant at the IETF, involved in the editing and reviewing several RFCs, most notably RFC7583, RFC8078 (DNSSEC) and RFC7719 (DNS Terminology).

Nov 2007 - Aug 2014: NLnet Labs

The NLnet Labs Foundation Internet technology research and development group, to enhance the open, secure, and innovative nature of the Internet for all.
  • Function: Software developer and researcher.
  • Tasks: Software design and development, protocol engineering.
  • Technology: c, Python, DNS, DNS64, DNSSEC, Shim6, Git, Subversion, M4.
  • Participant at the IETF, involved in the editing and reviewing several RFCs, most notably RFC5533-5535 (Shim6), RFC6147 (DNS64) and RFC6781,6840,7129,7344 (DNSSEC).
  • Main developer of the OpenDNSSEC signer engine, an open-source turn-key solution for DNSSEC.
  • Actively involved in the design of the OpenDNSSEC enforcer NG.
  • Developer and maintainer of NSD, an authoritative only, high performance, simple and open-source name server.
  • Main developer of Autotrust, a RFC 5011 compliant tool, now incorporated into Unbound.
  • Extensive research of the Shim6 protocol, by making a formal model, verification and an extension for Wireshark.
  • Supervisor of several student projects.
  • Maintaining the NLnet Labs website.

Oct 2006 - Oct 2010: BAMM

V.O.F. BAMM Consultance, design and development of CMS based websites for small businesses.
  • Function: Co-owner, director, software developer.
  • Tasks: Website design and development, CMS development (BAMMcms).
  • Technology: AJAX, CSS, HTML, Javascript, PHP.
  • Developer and maintainer of BAMMcms, the backend for our websites.
  • Developer and maintainer of several websites.

Feb 2003 - Jan 2005: Hexon

Hexon BV ICT services for the automotive industry.
  • Function: Software developer (part time).
  • Tasks: Website backend integration "doorlinken voorraad" and custom website design and development "maatwerk".
  • Technology: CSS, HTML, Javascript, PHP.


Nov 2008 - Jul 2014: OpenDNSSEC

OpenDNSSEC an open-source turn-key solution for DNSSEC.

Main developer of the OpenDNSSEC signer engine, and actively involved in the design of the OpenDNSSEC enforcer NG. Maintained versions 1.2.0 to 1.4.6.
Project website

Nov 2007 - Jul 2014: NSD

NSD is an authoritative only, high performance, simple and open-source name server. I maintained the software implementation from NLnet Labs from 3.0.6 to 3.2.18.
Project page (NLnet Labs)

Jun 2008 - Dec 2009: Autotrust

Autotrust is a RFC 5011 compliant tool that you can run next to your security-aware, validating DNS resolver. It eats trust anchor files or Bind9-like trusted-keys clauses and will automatically update the configured trust anchors, according to the RFC. In case of any changes, it will send a reload signal to the resolver. Since November 2009, the code has been integrated into Unbound.
RFC 5011
Project page (NLnet Labs)

Oct 2006 - May 2007: Shim6

My final project as a student is about formalization and verification of the IPv6 host-based multihoming protocol, Shim6. The work resulted in a formal model, a contribution to the RFC, a patch for Wireshark, a conformance test of a beta implementation and, of course, a thesis.
RFC 5533, RFC 5534, RFC 5535
Project page (NLnet Labs)

On the side

February 2017 - Present: ROAR E-Zine

ROAR E-Zine Dutch alternative pop music website.

Editor, photographer

September 2016 - Present: Doornroosje

Doornroosje Music venue in Nijmegen.

House photographer

May 2016 - Present: Ugenda

Ugenda Site about culture and party in Nijmegen.

Editor, photographer

Jan 2015 - Present: 3voor12 Gelderland

3voor12 Gelderland Local department of Dutch multimedia platform for alternative music.


2011: NLUUG

NLUUG Association of Open Systems and Open Standards users in the Netherlands.

Program committee

Aug 2000 - Jul 2006: Thalia

Thalia Association of the studies Computer Science and Information Science at the Radboud University Nijmegen.

Program committee (2005-2006), PR committee Olympus (2003-2004), President (2003-2004), Program committee FNWI (2002-2003), Canteen committee (2000-2002). My work for the study association Thalia is rewarded with an honorary membership.


RFC: RFC7583, DNSSEC Key Rollover Timing Considerations
Oct 2015, IETF

HOWTO: OpenDNSSEC Key Rollover Guide
Oct 2015, OpenDNSSEC

HOWTO: OpenDNSSEC Initial Deployment Guide
Nov 2014, OpenDNSSEC

RFC: RFC7129, Authenticated Denial of Existence in the DNS
Feb 2014, IETF

Document: DNSSEC Audit Framework
Dec 2013, NLnet Labs

RFC: RFC6781, DNSSEC Operational Practices, Version 2
Dec 2012, IETF

Paper: Flexible and Robust Key Rollover in DNSSEC
Mar 2012, SATIN

Paper: Authenticated Denial of Existence in the DNS
Jan 2012, SIDN

Thesis: Formalization and Verification of the Shim6 Protocol
May 2007, Radboud University

Paper: Capability of Kerberos
Jun 2006, Radboud University

Paper: Electronic Cash
Jun 2005, Radboud University

Article: Snelle computers rekenen slim (Dutch)
Apr 2002, B For You


Securing the last mile in DNS with CGA-TSIG
Marc Buijsman, University of Amsterdam, RP2
Jan 2014

Identifying Patterns in DNS Traffic
Pieter Lexis, University of Amsterdam, RP2
Jul 2013

Defending against DNS reflection amplification attacks
Javy de Koning, Thijs Rozekrans, University of Amsterdam, RP2
Jan 2013


Blog: What We Learned: DNSSEC KSK Rollovers in go6lab
Oct 2015, Internet Society

Blog: Case Study: The Experience of Signing Go6.SI with DNSSEC
Oct 2014, Internet Society

Rapport: Novay - Rapport TLD Verkenning (Dutch)
Mar 2013, Rijksoverheid

Blog: DNS amplificatie-aanvallen straks niet meer te stoppen zonder BCP 38 (Dutch)
Mar 2013, DNSSEC.NL

Blog: DANE maakt het PKI-systeem weer veilig en betaalbaar (Dutch)
Feb 2013, DNSSEC.NL

Blog: SIDN.nl faalt met IPv6 en DNSSEC - update 5 (Dutch)
Jul 2011, Webwereld

Bachelor thesis: Testing Key States of Automated Trust Anchor Updating (RFC 5011) in Autotrust
Jun 2010, Carsten Rütz, Bachelor thesis, Radboud University

Paper: Wat is Model Checking? (Dutch)
Mar 2008, Frits Vaandrager, Radboud University, Mar 2008



3voor12 Gelderland
Nijmeegse Kunstnacht | Popronde Nijmegen | Under The Milky Way | Huntenpop | Vierdaagsefeesten | Bevrijdingsfestival Nijmegen | Oranjepop | Jo Goes Hunting | The Unsinkable vs Ink Bomb | Grasnapolsky | SNFU

De Staat | Amazons | The Great Communicators | Yung Nnelg | Leafs | DVNE | Crackhouse | Kitty, Daisy & Lewis | Scarletinas | Roxeanne Hazes | LAKSHMI | DTRH presents: FĂȘTeReTet | DJ Shadow | Franklin Electric | Soultrash | FATA BOOM | Tusky | Deerhoof | Bonne Aparte | Joep Beving | Valerie June | Bevrijdingsfestival | George Clinton & Parliament Funkadelic | Nikki Hill | Sef | Paul Sinha | Jett Rebel | STAVAST | Okkultokrati | Henhouse Prowlers | 7 Layers Sessions | K's Choice | Jo Goes Hunting | Vitalic | Falco Benz | Fleshgod Apocalypse | Carach Angren | Nightland | Candy Dulfer

Popronde Nijmegen | Zomerparkfeest | Valkhoffestival

The Sound Of Revolution | Fleddy Melculy | Against The Current

Gogol Bordello | Down The Rabbit Hole 2 3 | Fortarock in the City | George Clinton & Parliament Funkadelic | Oranjepop | Caro Emerald | Fleddy Melculy | Fleshgod Apocalypse

Popronde | HAN-Talencentrum | Valkhoffestival 2 3 | Ribs & Blues | Oranjepop | Manuka Life | Ink Bomb


3voor12 VPRO
Down The Rabbit Hole | Grasnapolsky

3voor12 Gelderland
The Game | Ink Bomb | Popronde Nijmegen | Appelpop | Zwarte Cross | Vierdaagsefeesten | Syl Scheffel | Bad Religion | Fortarock | Kaf en Koren | Plakfestival | Oranjepop | 3voor12 Gelderland Awards winnaars | 3voor12 Gelderland Awards

Jonna Fraser | Avatar | The Last Band | Capleton | Autechre e.a. | Peaches | Black Cracker | Ed Struijlaart | Daniel Cane | Jungle By Night | Orlando Julius | Ronald Snijders | Oscar | 257ers | Le Butcherettes | The Picturebooks

Avatar | Popronde Nijmegen | MY BABY | Plakfestival

Comedy Complex #3 | Popronde Nijmegen | Valkhoffestival | Oranjepop


3voor12 Gelderland
Songs For The Darkest Night | Stevie Ann | Valkhoffestival | Fake ID | Fortarock | Nils Frahm | Bevrijdingsfestival Nijmegen | Oranjepop | Roosbeef | Route 024 | Stukafest

Stevie Ann, Thiemeloods | Valkhoffestival | Oranjepop