- dns-wg - mailman.ripe.net

Signed .cz zone
by Ondřej Surý 02 Sep '08

02 Sep '08

Hello all, we have signed .cz on Sep 1st 2008. Key can be found at https://www.nic.cz/dnssec/ (bottom of the page). EPP interface for registering DS RRsets will be launched on Sep 30 2008. Please report any errors (hope there are none) or sugestions to my address. Regards, -- Ondřej Surý technický ředitel/Chief Technical Officer ----------------------------------------- CZ.NIC, z.s.p.o. -- .cz domain registry Americká 23,120 00 Praha 2,Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ sip:ondrej.sury@nic.cz tel:+420.222745110 mob:+420.739013699 fax:+420.222745112 -----------------------------------------

1 0

Planned maintenance on ns.ripe.net, 2 Sept.
by Sjoerd Oostdijck 01 Sep '08

01 Sep '08

[Apologies for duplicate e-mails.] Dear Colleagues, On Tuesday, 2 September 2008, the RIPE NCC will perform maintenance on the ns.ripe.net server between 10:00 and 12:00 (UTC). During this period, it may not be able to answer DNS queries. The aim of this maintenance is to introduce a second server to improve performance of the system. If ns.ripe.net provides secondary DNS name service for your zone, no changes on your side will be required. During the maintenance, other servers in your NS set will take over and no downtime will be visible to the Internet. We apologise for any inconvenience this maintenance may cause. If you have any questions or concerns about this, please email dns-help(a)ripe.net Regards, Sjoerd Oostdijck DNS Services The RIPE NCC

1 0

Subdomain Add Question
by Bill Honneus (honneus) 09 Aug '08

09 Aug '08

Hi, I have a domain hosted at a third party site called my.domain.com. In my company's zone file, we have NS records that refer to this third party hosting site, and we have an 'A' record set up that associates the my.domain.com domain to the IP address of a load balancer that balances traffic coming into the site between two web servers, all in a DMZ. We also have an MX record that refers the my.domain.com to a mail server host, also in the DMZ. Finally, we have PTR records that refer back to the load balancer and mail server hosts. All this is set up correctly, everything works, and all DNS checks pass. I need to add a subdomain, call it sub.my.domain.com, and I would like to associate the subdomain to the same load balancer if possible. What is the best way to do this without disrupting the incoming traffic to the primary domain or the flow of incoming SMTP traffic to the mail server? Is it best in this situation to use a CNAME to map the subdomain, or to use a whole new 'A' record? If I create a new 'A' record, I would not want to add a new PTR record for the sub.my.domain.com as the IP address would be the same as the PTR that refers back to my.domain.com. This I believe, would cause DNS checks on my mail server to fail, since there would be two hostnames associated with the same IP address. Your help is appreciated! Bill

2 1

DNS Lameness statistics and notifications
by Sjoerd Oostdijck 01 Aug '08

01 Aug '08

Dear Colleagues, In January 2007, RIPE Document ripe-400 was created to address lameness in the reverse DNS tree. This RIPE Document can be found online at: http://www.ripe.net/ripe/docs/ripe-400.html We have been monitoring name servers for some time now and statistics from the data gathered have been published online each month at: http://www.ripe.net/info/stats/dns-lameness/ We are now ready to start sending out notifications to the maintainers of these zones, alerting them to a problem. The e-mail messages will point to the DNS Lameness FAQs, which explain the possible problems and give some pointers to help solve them. The FAQs can be found online at: http://www.ripe.net/info/stats/dns-lameness/faq.html Initially, we will send less then 100 e-mails to various contacts. This number will increase over the following months until all maintainers with lame servers are contacted. Kind regards, Sjoerd Oostdijk DNS Services Group The RIPE NCC

5 4

.ORG DNSSEC Survey
by Jakob Schlyter 30 Jun '08

30 Jun '08

Dear RIPE Working Group Member, You are invited to complete the following DNSSEC Survey conducted by .ORG, The Public Interest Registry. The purpose of this survey is to evaluate DNSSEC preparedness and to gain more information on current and future plans to implement DNSSEC. We would greatly appreciate your response, so we hope you are able to take a few minutes to complete this survey. Your responses will remain anonymous as no identity information will be recorded. To participate in the survey, please visit http://guest.cvent.com/v.aspx?1A,Q3,95818ada-0ceb-4ea2-bce2-c2d94d68da13 We look forward to your response, Sincerely, Jakob Schlyter, Kirei AB for .ORG, The Public Interest Registry

12 25

Updated DNS migration document
by Jim Reid 09 Jun '08

09 Jun '08

Here is the latest version of the DNS migration document. I've included the comments made by Joao and Jarle. Does anyone have anything else to add?

5 5

ANNOUNCEMENT: RIPE NCC Training Courses
by Training 26 May '08

26 May '08

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC invites you to register for one of our upcoming training courses: - The LIR Training Course This course teaches LIRs how to request Internet number resources and interact with the RIPE NCC. A course outline is available at: http://www.ripe.net/training/lir/outline.html - The Routing Registry Training Course This course teaches LIRs how to use the RIPE Database for routing. A course outline is available at: http://www.ripe.net/training/rr/outline.html - The DNS for LIRs Training Course This course teaches LIRs about the RIPE NCC's DNS-related services. A course outline is available at: http://www.ripe.net/training/dns/outline.html To see the location of upcoming courses and to register, please use the LIR Portal or complete the registration form on our website at: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

outcome from DNSSEC TAR Task Force
by Jim Reid 30 Apr '08

30 Apr '08

Colleagues, the work of the task force has to some extent been overtaken by events. IANA's plans for a trust anchor repository (TAR) are progressing and the consensus of the task force is that the RIPE community should support that effort. The task force has produced a set of requirements for a TAR. It feels there is no need to do anything more at this stage: moves towards an alternate TAR may not help the IANA initiative. So on behalf of the task force, I'd like to ask the WG to consider these requirements and endorse them as a statement from the RIPE community which could be sent to ICANN. [A bit like our "sign the root" statement last year.] The proposed text is below. If the WG is happy with this letter, I suggest the task force declares victory (for some definition of victory) and either goes into hibernation or shuts down. Your comments about this letter and the suggested future for the task force would be appreciated. Is the upcoming RIPE meeting a reasonable deadline for comments? Dear Barbara, Thank you for your note about the proposed DNSSEC key repository for TLDs. The RIPE DNS working group (DNS WG) welcomes this development. We would like to see IANA establish this DNSSEC Trust Anchor Repository (TAR) as soon as possible. We have developed a set of requirements for such a repository. As these may be useful for you when implementing the service, we offer them here: [1] The TAR should be technology neutral. It should not exclude or prevent different flavours of trust anchors from being published, provided those trust anchors conform to the relevant standards. [2] The TAR should be OS/DNS implementation neutral. Tools and documentation should be provided for use of the repository with common DNS resolver and name server platforms. Comment: IANA should publish such documentation and tools, or pointers to them. Once we know details of repository, we can help putting together this documentation. [3] The TAR should verify that the keying material it receives comes from an authorised source, verify it is correctly formatted and verify it is consistent with what is published in the TLD zone before publishing it. There should also be a secure channel for authenticating the repository and any data it is publishing. Comment: Using the same channels IANA uses to process update requests to the root zone from TLDs should be fine. We do not mean special new channels. https delivery and possibly checksums are sufficient for publication. [4] A process is needed to revoke a trust anchor and notify those who may be using the now withdrawn or invalid trust anchor. Comment: An opt-in mailing list for operational news should be sufficient to satisfy this. [5] The TAR should be clear what support, if any, is available. [6] The TAR must have a published exit strategy. Comment: The proposal includes that. [7] The TAR should only publish keying material with the consent of the respective key manager. Please let us know any the details of the repository as well as the time-line for implementation as soon as they become available. Please feel free to make our support for this repository known publicly or within ICANN. Kind Regards RIPE DNS WG Jim Reid Chair

2 1

DNS WG Agenda for RIPE 56
by Peter Koch 28 Apr '08

28 Apr '08

Dear WG, here is the most recent agenda for our two DNS WG sessions in Berlin. Thanks to all the volunteer contributors. Presenters, please calculate ~5 minutes for discussions (during or after your presentation). To avoid interruptions due to hardware switch procedures and to assist remote participants, please make your slideware available to the wg co-chairs in advance. The material will be posted on ROSIE during the meeting. See you in Berlin! -Peter ============================================================================= AGENDA for the DNS WG at RIPE56 ============================================================================= $Id: agenda.txt,v 1.6 2008/04/28 12:24:44 pk Exp $ ============================================================================= 2008-05-07 (WED) 1400-1530 // IPv6 ============================================================================= 0) Agenda Bashing and Administrivia [ 5 min] 1) Action Item Walk through [18 min] <http://www.ripe.net/ripe/wg/dns/dns-actions.html> 48.1 [Wishlist for "lost" delegations] Peter 49.2 [DNS migration document] Jim 51.4 [RIPE203bis] Peter 2) Reports 2.1) Results of the Trust Anchor TF [ 7 min] Jim Reid/Daniel Karrenberg 2.2) IETF report [10 min] Antoin Verschuren IETF report for IETF70/71 (Vancouver and Philadelphia) 2.3) ICANN/IANA report [15 min] N.N., ICANN/IANA IDN fast track, DNSSEC, bogus PTR queries 2.4) ICANN SSAC [10 min] Patrik Fältström Recent publications, current topics 3) IDN.IDN with DNAME in JP [15 min] Yoneda Yoshiro 4) PIR DNSSEC Survey [10 min] Jakob Schlyter ============================================================================= 2008-05-08 (THU) 1100-1230 // EIX ============================================================================= 5) Update from the RIPE NCC [20 min] N.N., RIPE NCC 6) Unbound: A DNSSEC Validating Resolver [25 min] Wouter Wijngaards 7) Progress on DNSSEC for .CZ and 0.2.4.e164.arpa [10 min] Ondrej Sury 8) DNS issues in new MS operating systems [15 min] Carsten Strotmann 9) tcpdump filter rules for capturing DNS traffic [10 min] Shane Kerr 10) Experiences from changing a TLD's auth [10 min] name server's address Peter Koch 99) A.O.B. =============================================================================

1 0

RIPE 56: Call for Agenda Items
by Peter Koch 01 Apr '08

01 Apr '08

Dear DNS WG, it's only five weeks left until we meet in Berlin and even though some presentations have already been proposed, here's the official "call for agenda items" for the RIPE 56 DNS WG meeting. We'll have two slots again this time, Wed 1400-1530 and Thu 1100-1230. If you'd like to talk about a particular issue or know someone else who has an interesting topic, please let Jaap, Jim and myself know at <dns-wg-chair(a)ripe.net>. We'll also have the usual reports (volunteers still welcome) and some open action items to discuss. -Peter

1 0