October 2025 - db-wg - mailman.ripe.net

Recent changes to the Database Terms and Conditions
by Karolina Bochenek 12 Nov '25

12 Nov '25

Dear all, At its 188th RIPE NCC meeting on 4-5 September 2025, the RIPE NCC Executive Board approved amendments to the RIPE Database Terms and Conditions. These changes are in response to the EU regulation Digital Operational Resilience Act (DORA) which came into effect in January 2025. While the requirements apply to financial institutions, the RIPE NCC aims to facilitate the implementation of this regulation for those entities that are RIPE NCC members to a reasonable extent. The following changes include: Adding details of how we manage planned maintenance and how incidents can be reported. We also added information about security measures and audits (articles 5.5-5.9) Adding subcontractor, service level and data protection information (articles 8.4-8.6) The updated RIPE Database Terms and Conditions are available at: https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms You can find more information about DORA and other relevant regulations in the RIPE NCC Trust Portal: https://trust.ripe.net/legal-compliance/ The RIPE NCC Executive Board Meeting minutes are available at: https://www.ripe.net/about-us/executive-board/minutes/2025/188th-executive-… The amendment will come into effect on 13/11/2025. Kind regards, Karolina Bochenek RIPE NCC

3 2

Proposal to Allow UTF-8 in “descr:” and “remarks” Attributes
by Edward Shryane 06 Nov '25

06 Nov '25

Dear colleagues, As I presented at RIPE 89 and RIPE 90, I'd like to propose to allow UTF-8 encoded characters in "descr:" and "remarks:" attributes. Is there support for adding UTF-8 in the RIPE database? Please let me know your feedback. Regards Ed Shryane RIPE NCC Problem Definition ------------------ It is currently only possible to store Latin-1 encoded data in the RIPE database. This is an issue for the majority of the RIPE region whose native language is not supported by Latin-1. We should allow regional operators to add notices to their RIPE database objects in their native language, using UTF-8 encoded data, so long as this does not affect interoperability. Solution Definition ------------------- In order to allow operators across the RIPE region to add notices in their own local language, we will allow UTF-8 characters in the “descr:” and “remarks:” attributes only. This change reduces the risk of impact to operators, users and the RIPE NCC, and does not affect existing RIPE policy. We can extend support for UTF-8 in additional existing or new attributes in the future, once we have more operational experience with it, but for now, only “descr:” and “remarks:” will be supported. Background ---------- Some work has already been done towards internationalization of the RIPE database. For example, in April 2015, Piotr Strzyzewski suggested to the DB-WG to support UTF-8 in free-text attributes. "Proposal to allow UTF8 (April 2015)" https://mailman.ripe.net/archives/list/db-wg@ripe.net/thread/QEYKOWZBCVA6HN… In May 2022, I published a RIPE Labs article on the impact analysis of supporting UTF-8 in the RIPE database. https://labs.ripe.net/author/ed_shryane/impact-analysis-for-utf-8-in-the-ri… At RIPE 89 and RIPE 90 I proposed to support UTF-8 in the RIPE database and asked for feedback. https://ripe89.ripe.net/wp-content/uploads/presentations/105-RIPE89-DB-WG-U… https://ripe90.ripe.net/wp-content/uploads/presentations/120-RIPE90-DB-WG-O… Impact Analysis --------------- Backwards Compatibility UTF-8 is backwards compatible with ASCII, in the same way as Latin-1. Any RPSL objects solely using ASCII will be compatible with UTF-8 encoding. Approximately 99% of all objects in the RIPE database only contain ASCII characters. Personal Data Users must not add personal data in “remarks:” or “descr:” attributes, as these attributes are not included in the daily limit accounting, are not validated as they contain free text, and are not filtered by default. This is already the case in the RIPE database and the introduction of UTF-8 encoding does not change this. Personal data with UTF-8 encoding is out of scope. Interoperability If interoperability is a concern (i.e. a notice must be readable by a wider community) then it is recommended that only ASCII values are used. Valid Codepoints Validate UTF-8 input with the IDNA 2008 standard to decide whether a Unicode codepoint is allowed (i.e. only allow protocol valid code points). This standard is used in the implementation of Internationalised Domain Names (IDNs). This allows for consistency (code points will be mapped to a specific set of characters) and improved security (using an inclusion model to only allow certain characters). Guidelines for the Implementation of Internationalized Domain Names https://www.icann.org/resources/pages/idn-guidelines-2011-09-02-en Transliteration Transliteration to Latin-1 is only done when necessary to match the default response encoding. Otherwise transliteration is not done (i.e. UTF-8 characters will be returned as-is). Impact on RIPE Database Services -------------------------------- Whois (Port 43) Query * The “descr:” and “remarks:” attributes are returned by default on port 43 query responses. * Port 43 will continue to use Latin-1 by default. If so, any UTF-8 characters outside the ASCII character set will be transliterated to Latin-1 or will be substituted with a “?” character. * The client can specify the “-Z utf-8” flag to change the response encoding to UTF-8, then no transliteration will be done. NRTMv3 (Port 4444) * The encoding used by NRTMv3 will continue to be Latin-1. As for port 43, any non Latin-1 characters will be substituted with a “?” character. NRTMv4 * No impact. RPSL objects will continue to be returned in UTF-8 encoding in snapshot and delta files. Whois REST API * No impact. The Whois REST API already supports UTF-8. RDAP * No impact. The RDAP protocol already supports UTF-8. Web Application * UTF-8 encoding is already supported on the query page. * The create and update page validation will be changed to allow UTF-8 characters in “descr:” and “remarks:” attributes. Mailupdates * No impact. UTF-8 encoding is supported. Syncupdates * No impact. UTF-8 encoding is supported. Daily Database Dump and Split Files * The encoding of the database dump and split files remains Latin-1. The “descr:” and “remarks:” attributes are included unfiltered. Any non-Latin-1 UTF-8 characters will be substituted with a “?” character. * We will provide a separate UTF-8 encoded database dump and split files, which will include “descr:” and “remarks:” attributes without substitutions. New LIR Application * No impact. Registry Team * No comments or conerns as changes are limited to descr and remarks attributes.

15 19

New draft NWI process
by David Tatlisu 03 Nov '25

03 Nov '25

Hello Everybody, You are welcome to look over a draft of a new definition of the Numbered Work Item process. This new version keeps the existing process largely the same with some procedural tweaks here and there and also improves the readability of the text. Let us know what you think about this proposed change, good or bad. We'd like to make it official in about three weeks. NEW DRAFT Text: ––––– RIPE Database Working Group Numbered Work Items In order to facilitate discussion about issues and solutions, as well as report on the progress made with solution implementation, the RIPE Database Working Group employs a process using Numbered Work Items (NWIs). Please note that this does not replace the Policy Development Process. Instead it is used for smaller work items and helps to facilitate the communication between the DB WG and the RIPE NCC. Kickstart: Anyone can contact the RIPE DB WG co-chairs and present a proposal or a problem statement. Alternatively this can also be sent to the WG mailing list directly. If there is interest in this work item, the Database WG co-chairs will ask the RIPE NCC to assign a number to this work item and include it on the list of numbered work items (NWIs). Problem definition: After an NWI is created, the proposal or problem statement will be discussed in the WG. This can mean further specifying the problem statement and including example cases of the problem to clarify the scope. After two to three weeks the WG co-chairs will determine of there is a consensus and will either post a clearly defined problem statement to the list, or if there is no agreement on a problem statement, the NWI will be closed. Solution definition: Anyone, including RIPE NCC staff, can propose solutions to a work item's problem statement. The RIPE NCC will also provide an implementation analysis that can include feasibility, expected workload, proposed solutions, impact on other work items etc. In this phase, the RIPE NCC together with the RIPE DB WG co-chairs will also determine if the NWI might have an impact on an existing policy or if the NWI might in fact lead to a change in policy or a new policy. In this case, the WG co-chairs are advised to use the more formal Policy Development Process (PDP) instead of the NWI process. Implementation: Once the WG agrees on the proposed solution, the RIPE NCC can start implementing it, keeping the WG up to date about the timeframe, milestones, documentation etc. The RIPE NCC will also update the entry of the NWI on the table of NWIs accordingly. Finished: The project ends when the change has been deployed in the production environment. Cancelled: The project can also end when the working group decides to cancel it. The RIPE NCC will update the list of NWIs on a regular basis to reflect the status of each NWI. ––––– EXISTING Text for your convenience ––––– In order to facilitate an ordered discussion about issues and solutions, as well as report on the progress made with solution implementation, the RIPE Database Working Group employs the following process using Numbered Work Items (NWIs): Kickstart: To kickstart the process, any db-wg participant can email the chairs with a snippet of text (a rough problem statement) and formally ask the chairs to make it a work item. The chairs can then say “yes”, and assign it a number, or “no”. If a number is assigned, the work item will be routed through the following three phases: Phase 1: Problem Definition In this phase we will work as a group on formulating an exact problem definition: text goes back and forth in the working group, example cases of the problem are provided. In a timeframe of two to three weeks the chairs declare consensus on the problem statement of the NWI. Phase 1 output: A clearly defined problem statement, or a conclusion if we cannot agree upon a problem statement definition. If the latter is true, the NWI cannot proceed to Phase 2. Phase 2: Solution Definition Solution finding: People can propose solutions to a work item's problem statement. Solutions can come from RIPE NCC staff or from any working group member. The RIPE NCC may offer an implementation analysis on proposed solutions or aspects of solutions. For the NWI to move to Phase 3, the RIPE NCC has to provide the working group with a summary of their understanding of the solution, and the chairs declare consensus on the group's acceptance of this summary. Phase 3: Development and Deployment Phase The RIPE NCC writes the code, sets timelines and milestones and documents the transitions/migration plan if applicable. Finish: The project ends when the change has been deployed in the production environment. Cancelled: The project can also end when the working group decides to cancel it. Every month the RIPE NCC will update this page with an overview of all open NWIs, a brief summary of each, who is taking action and what that action is. ––––– I express my gratitude to all those who worked on this draft, and everybody who took the time to offer their feedback. Kind regards, Peter and David

2 2

Archiving the "Action List"
by Peter Hessler 21 Oct '25

21 Oct '25

As seen on the website, the Database Working Group has an Action List, instead of an Action Movie. https://www.ripe.net/community/wg/active-wg/db/action-list/ From a basic perusal of them, this seems to be a basic tracking system of TODOs and Proposals. Notice it says "last updated 7 May 2009". I propose we simply archive this list. If anything is still relevant, please bring it up as if it were new. Peter Hessler, On behalf of the DB WG Co-Chairs

4 5

RIPE90 Database Working Group Minutes
by David Tatlisu 15 Oct '25

15 Oct '25

Hi Everyone, The draft minutes from our session at RIPE90 have been published on the RIPE website, available at https://www.ripe.net/community/wg/active-wg/db/minutes/ripe-database-workin… We'd like to thank Hans from the RIPE NCC for preparing the draft. Please review the minutes, and send any necessary corrections to the working group mailing list. David Tatlisu, On behalf of the DB WG Co-Chairs

2 1

RIPE90 proposal to deprecate the RIPE NONAUTH Database
by Edward Shryane 10 Oct '25

10 Oct '25

Dear colleagues, At RIPE90 I presented a proposal to deprecate the RIPE-NONAUTH database: https://ripe90.ripe.net/wp-content/uploads/presentations/120-RIPE90-DB-WG-O… (slide 20) The objects in the RIPE-NONAUTH database are not authoritative, and were created anonymously with a well-known password as out-of-region data in the RIPE IRR database. We don’t know who created this data or whether it is still valid. There are very few (< 100) updates per year, which suggests the data is not being maintained. The RIPE-NONAUTH database has only reduced in size by about 10% since it was created in 2018. The existing cleanup jobs and maintainers are not deleting much data. Ruediger Volk pointed out that ARIN had only very recently introduced their NONAUTH database, so it was a very short-term temporary source, and that does not predict anything about the longstanding data that has been split out into RIPE-NONAUTH. He suggested that the RIPE NCC analyse whether something that’s supposed to go away is still being used, or else there is a pretty big danger that someone is actually depending on it. I now present some analysis of the RIPE-NONAUTH database for review. Perhaps we should not retire the RIPE-NONAUTH database completely as we don't know how it is being used, but we could take action to further reduce its size. Your feedback is appreciated. Should RIPE-NONAUTH Objects Be Returned By Default? --------------------------------------------------- The RIPE-NONAUTH database is included by default in Whois queries. This means that any matching object in the RIPE-NONAUTH database is automatically returned in the Whois query response. That includes as-set, aut-num, route and route6 object types. For example, when querying for "AS2561", the matching aut-num object in the RIPE-NONAUTH database is returned. Additionally, *related* matching objects in the RIPE-NONAUTH database will also be returned by default. For example, when querying for the IPv4 prefix "200.30.0.0/18", the related route object "200.30.0.0/18AS5511" in the RIPE-NONAUTH database is returned. We found that RIPE-NONAUTH objects are returned only in a small number of cases (about 0.006% of all queries), but there is a risk that clients will inadvertently trust non-authoritative data if the "source:" attribute is not checked. As a workaround, clients can use the "-s RIPE" flag to only query the RIPE database. Should objects in the RIPE-NONAUTH database continue to be returned by default? Near Realtime Mirroring (NRTM) ------------------------------ Approximately 20% of NRTM requests query for updates to the NONAUTH database. Should we continue to support mirroring the NONAUTH database, considering the non-authoritative nature of the data and low rate of updates? Should RIPE-NONAUTH objects with an exact match in another RIR database be deleted? ----------------------------------------------------------------------------------- Approximately 31,930 out of 45,754 route(6) objects in the RIPE-NONAUTH database have a matching route(6) object (i.e. matching origin ASN and exactly matching or less-specific prefix) in another RIR’s IRR database. Approximately 13 out of 67 as-set objects in the RIPE-NONAUTH database have an exactly matching as-set in another RIR’s database. Approximately 1,840 out of 2,073 aut-num objects in the RIPE-NONAUTH database have an exactly matching aut-num object in another RIR’s database. Should we delete RIPE-NONAUTH objects which duplicate identically named objects in an authoritative RIR’s database? Should unrouted RIPE-NONAUTH route(6) objects be deleted? --------------------------------------------------------- Approximately 33,912 out of 44,647 RIPE-NONAUTH route(6) objects appear in the global routing table (as of 12th July). Should we remove any NONAUTH route(6) objects which are not announced? Do they serve any useful purpose? Regards Ed Shryane RIPE NCC

8 22

Fwd: Re: [ripe-list] Re: beIN && RIPE NCC && Notorious Markets
by Nick Hilliard 09 Oct '25

09 Oct '25

Maybe add some comments in whois output to highlight which fields in which objects are authoritative? Or if there were a page put up on https://trust.ripe.net/ which explains this in more detail? There's a lot of head-boggle going on here, even for people who are familiar with whois output. Nick -------- Forwarded Message -------- Subject: Re: [ripe-list] Re: beIN && RIPE NCC && Notorious Markets Date: Thu, 9 Oct 2025 08:11:57 +0200 From: Daniel Karrenberg <dfk(a)karrenberg.net> To: Nick Hilliard <nick(a)foobar.org> CC: Andrew Campling <andrew.campling(a)419.consulting>, ripe-list(a)ripe.net Maybe it is finally time to make it *really obvious* even to the most ignorant which RIPE DB objects are authoritative info and which are not? --- Sent from a handheld device. > On 8. Oct 2025, at 19:49, Nick Hilliard <nick(a)foobar.org> wrote: > > Andrew Campling wrote on 06/10/2025 15:27: >> Irrespective of any view regarding rights holders, the lack of effective KYC procedures is also a problem in combating both malicious and illegal content. For example, you may be surprised that the Internet Watch Foundation finds a large percentage of illegal CSAM images hosted within Europe (here <https://www.iwf.org.uk/annual-data-insights-report-2024/data-and-insights/g…>) – for transparency, I’m an IWF trustee. I am not a lawyer but I understand that KYC is a requirement under the EU’s NIS2 Directive. >> In my view, extending effective KYC processes across the ecosystem will add friction, making the life of malicious actors more difficult. > > the ripe ncc already implements kyc for its members and direct assignment resource holders. You can't get a PI assignment without validating your identity, and there are comparable processes for businesses who wish to become LIRs. These are hard-enforced. If you don't comply, your application will be rejected. > > In addition to this, all LIRs are subject to a periodic Assisted Registry Check. > > The BEIN letter seems to confuse data about RIPE members / direct assignees with general end users of ISPs. > > The confusion may be happening because the RIPE database is a mixture of several different categories of data. Some of the data is authoritative (i.e. RIPE LIR and Direct Assignments) and some is non-authoritative (i.e. LIR assignments). A good deal of the non authoritative data is of very poor quality, but the authoritative data is all subject to RIPE KYC processes and regularly audited. Mixing these two data sets up does not benefit anyone. > > It's the job of the ISP to ensure that they have KYC processes with their end users. > > Nick > ----- > To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ > As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/

2 2

Clarification of Database documentation
by denis walker 06 Oct '25

06 Oct '25

Colleagues Some documentation issues were raised during a discussion of contact methods. They have nothing really to do with the issue of contacts so I have started a new thread on the documentation. It is not the most urgent issue regarding the RIPE Database so you may not care about any of this. But documentation should be correct or it is a waste of time having it. If no one comments, maybe the chairs can pass judgement. Three issues are raised here: -Attribute properties -Description of AGGREGATED-BY-LIR -Missing attribute Attribute properties For years we only described attributes as mandatory, optional or generated. But there are some attributes that do not exactly fit any of these categories. Mandatory means that every instance of this object type must have this attribute present. Optional means it is entirely your choice if you include it or not. Some attributes sit in between these two options. They don't need to be in every instance of the objects, but sometimes it is not your choice to leave it out. There are business rules built into the software that determine when certain attributes must be present or if you can ignore it. Examples include abuse-c and org. In most instances of an INETNUM object the org attribute is optional. But if it is an allocation, then it must be included. So it is not truly mandatory or optional. When I re-wrote the database documentation in 2014 I tried to cover this middle ground giving these attributes the property of being 'required' [1]. But as Ed just pointed out, the word 'required' suggests it is 'mandatory'. Certainly for a non native English speaker it is easy to confuse these meanings. So it is not the best word to use. The only word I can think of that might reflect the true meaning of these attributes is 'variable'. Sometimes it must be there, sometimes you can choose. There will be another document or policy that explains the business rules that determine how it is used. So unless someone has a better suggestion for naming this attribute property, I recommend that we adopt 'variable' in the documentation and in the templates returned by a whois query with -t and -v. Description of AGGREGATED-BY-LIR This is described in both the database documentation [2] and in the address policy [3]. Neither is an accurate and clear description and they are both different. In the address policy it says "The purpose and the contact details must be consistent throughout the whole assignment.". This confuses the terms 'aggregation' and 'assignments'. An aggregation is a collection of 'multiple' assignments. So you must either refer to the aggregation or the collection of assignments.You cannot refer to a single assignment. This is not just splitting hairs. For a non native English speaker new to the database, they are reading this to try to work out what this means. The current wording suggests the aggregation represents a single block of assigned address space, rather than a collection of multiple address blocks, possibly of different sizes. The purpose of an assignment is not publicly defined or documented anywhere. What is the purpose of a block of assigned address space? Can it be 'used by an End User's public network' or 'used by the LIR for their own infrastructure'? But then these are two different purposes. So by definition you should not be able to aggregate a mix of End User's address space with an LIR's own infrastructure. Is that the case? How does anyone outside of the LIR know? Should the purpose be documented in a remarks attribute? Should an aggregation have a "purpose:" attribute? It seems like there was such a rush to make individual assignments optional, the actual details of the aggregation were not very well thought through. What does "the contact details must be consistent" mean? All the assignments have a tech-c? All the tech-c references are to a ROLE object or a PERSON object? They all include an email address? They all refer to the same ROLE object? All the different ROLE objects reference the same email address? It is not good enough to say "but we all know what it means". A new LIR, new to the policy documents, new to the database may not know what this means. That is why they are reading it. There is no explicit mention that the multiple assignments can all be of different sizes. Unless the "assignment-size:" attribute is included. Is it sufficient for all these details to be explained in the RIPE Database documentation, that is only advisory? Possibly leaving the policy statement so vague that it is easy to misunderstand or misinterpret. Either way, all of these points need to be explained, somewhere. I haven't even touched on rules that should have so obviously been documented somewhere. For example, if aggregations are created retrospectively, the boundary between aggregations within a single allocation must match the boundaries of the encompassed assignments. If the assignments are deleted before creating the aggregations then the software cannot enforce this and there is no way for anyone to verify this was done. The whole concept of aggregation was badly specified. But that is another story... Missing attribute There is no mention in the documentation of the INETNUM or INET6NUM attribute 'prefixlen'. References [1] https://docs.db.ripe.net/RIPE-Database-Structure/Attribute-Properties [2] https://docs.db.ripe.net/RPSL-Object-Types/Descriptions-of-Primary-Objects#… [3[ https://www.ripe.net/publications/docs/ripe-826/#70-types-of-address-space cheers denis

4 6

RIPE Database Release 1.119
by Edward Shryane 01 Oct '25

01 Oct '25

Dear colleagues, RIPE Database release 1.119 has been deployed to the Release Candidate environment for testing. We plan to deploy to production on Wednesday 1st October. This release contains the following main changes : * Support multiple maintainers in scope (#1866) * Fix indentation when Serialising JSON to Avoid Indentation Bug (#1855) * Always add Warning When using Password Authentication (#1859) * Return Not implemented in case of e164 ENUM domain (#1846) * Allow empty From: address in SMTP request (#1841) * title should be type in RDAP relations (#1842) * Retry on Failure during GRS (mirror) import download (#1837) The full list of changes is visible in the source repository: https://github.com/RIPE-NCC/whois/compare/505c5f7...1c439eb The release notes are on the website: https://docs.db.ripe.net/Release-Notes#ripe-database-release-1-119 More information on the Release Candidate environment can be found on our website: https://docs.db.ripe.net/Release-Notes/ The data in the Release Candidate environment is a dummified copy of production from 15th September. Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

2 1