- dns-wg - mailman.ripe.net

New Document available: RIPE-359
by RIPE NCC Document Announcement Service 13 Oct '05

13 Oct '05

New RIPE Document Announcement -------------------------------------- A new document is available from the RIPE document store. Ref: ripe-359 Title: RIPE NCC DNSSEC Policy Author: RIPE NCC Date: October 2005 Format: PDF=58240 TXT=3043 Short content description ------------------------- The RIPE NCC is committed to supporting the deployment of DNS Security Extensions (DNSSEC) [1,2,3]. DNSSEC is a set of security extensions to the DNS that allows validating DNS resolvers to establish 'chains of trust' from known public keys to the data being validated. Accessing the RIPE document store --------------------------------- You can access the RIPE documents in HTML format via our website at the following URL: http://www.ripe.net/docs/ripe-359.html The RIPE Document Store is also available via anonymous FTP to ftp.ripe.net, in the directory ripe/docs. The URLs for the new documents on the FTP-server are: ftp://ftp.ripe.net/ripe/docs/ripe-359.pdf PDF version ftp://ftp.ripe.net/ripe/docs/ripe-359.txt plain text version

1 0

New RIPE Document available: RIPE-352
by RIPE NCC Document Announcement Service 10 Oct '05

10 Oct '05

New RIPE Document Announcement -------------------------------------- A new RIPE Document is available from the RIPE Document store. Ref: ripe-352 Title: Measuring the resource requirements of DNSSEC Author: Olaf Kolkman RIPE NCC / NLnet Labs Date: October 2005 Format: PDF=5367108 Obsoletes: Obsoleted by: Updates: Updated by: Short content description ------------------------- We measured the effects of deploying DNSSEC on CPU, memory and bandwidth consumption of authoritative name servers. We did this by replaying query traces captured from ns-pri.ripe.net and k.root-servers.net in a controlled lab environment. Accessing the RIPE document store --------------------------------- You can access the RIPE documents in HTML format via our website at the following URL:. http://www.ripe.net/ripe/docs/ripe-352.html The RIPE Document Store is also available via anonymous FTP to ftp.ripe.net, in the directory ripe/docs. The URLs for the new documents on the FTP-server are: ftp://ftp.ripe.net/ripe/docs/ripe-352.pdf PDF version Kind Regards, RIPE NCC Document Announcement Service

1 0

RIPE's MNAME recommendation
by Paul Herman 04 Oct '05

04 Oct '05

Hello dns-wg list! SUMMARY: In short, in a SOA RR of ours we have an MNAME that corresponds to a primary master server which has a private IP address. This is causing problems with many RIPE member registrars. PROBLEM: Using the language described in Section 2.1 of [RFC 1996], we have a primary master DNS server and two slave DNS servers. The primary master has a private [RFC 1918] IP address and the Slaves have public IP address, are named in the NS RRs for the zone and use zone transfer to recieve the zone from the primary master. Furthermore, in accordance with [RFC 1996], [RPC 1035] and [RIPE1] I have named the primary master as the original/primary source of the data for the zone. Here is an example zone file from what I'm talking about: example.com. 3600 SOA dns.private.example.com. hostmaster.example.com. ( 1999022301 ; serial YYYYMMDDnn 86400 ; refresh ( 24 hours) 7200 ; retry ( 2 hours) 3600000 ; expire (1000 hours) 172800 ) ; minimum ( 2 days) NS slave1.example.com. NS slave2.example.com. slave1 A {public-ip} slave2 A {public-ip} dns.private A 10.11.12.13 So far so good. Our zone appears to be fully RFC compliant. However, the problem arises when I try to transfer, say, the ownership of a ".de" zone using DENIC, because [RIPE1] additionally recommends that this be a valid address of the primary master, "valid" being the key word here. This is a problem, because many RIPE member registrars are indeed enforcing this policy. I gather, however, from more recent messages from Mr. Koch (who authored [RIPE1]), that the "MNAME field need not be part of the NS RRSet and need not be accessible." [ICANN-FORUM]. BTW, to my knowledge this is also neither enforced by IANA nor ICANN. Is it possible that RIPE could consider relaxing this "recommendation" that causes problems for RFC compliant zones? How do you, the DNS community, feel about this? Thank you for your attention in this matter. With kindest regards, Paul Herman Network Architect cleverbrige AG www.cleverbridge.com REFERENCES: ---------- [RFC 1035] Mockapetris,P., "Domain Names - Implementation and Specification", RFC 1035, STD 13, November 1987 [RFC 1918] Y. Rekhter, B. Moskowitz, D. Karrenberg, G. J. de Groot, E. Lear. "Address Allocation for Private Internets." February 1996 [RFC 1996] Vixie,P., "A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)", RFC 1996, August 1996 [ICANN-FORUM] http://forum.icann.org/lists/iana-del-data-comments/msg00004.html [RIPE1] Koch,P., "Recommendations for DNS SOA Values", ripe-203, http://www.ripe.net/ripe/docs/ripe-203.html , June 1999

11 18

RIPE NCC Service Interruption on 29 September
by Ruud de Kooter 04 Oct '05

04 Oct '05

Dear Colleagues, As we announced on 29 September, there was an unexpected disruption to our whois and web services between 05:10 and 06:00 UTC. Our investigations have shown that the problem was caused by an increasing traffic load and a growing number of peers on one of our routers. We made some configuration changes to improve load balancing between our border routers. This should prevent any similar problems from occurring in the future. We apologise for any disruption or delay this may have caused. If you have any further questions about this matter, please send an e-mail to <ops(a)ripe.net>. Regards Ruud de Kooter RIPE NCC

1 0

RIPE NCC Service Interruption
by RIPE NCC Operations 30 Sep '05

30 Sep '05

[apologies for duplicate mails] Dear Colleagues, >From 07:00 until 08:00 GMT, the RIPE NCC experienced an unexpected disruption to services. Although this may have caused delays to updates to the RIPE Whois Database, these updates have been processed normally. The disruption may have also affected some of these RIPE NCC services: - whois.ripe.net - www.ripe.net - lirportal.ripe.net - ns*.ripe.net - ftp.ripe.net - www.aso.icann.org - www.nro.net - k.root-servers.org (Global node at the AMS-IX) - AS112.ripe.net We apologise for any interruption or delay to services. If you have any questions or concerns regarding this issue, please contact <ops(a)ripe.net>. Regards, RIPE NCC Operations

4 4

Fwd: [dns-wg-chair] 2005-07 One Week to End of Discussion Period
by Jim Reid 29 Sep '05

29 Sep '05

Folks, just a reminder.... If you have any comments on this policy proposal, please submit them in the next couple of days. Begin forwarded message: > From: RIPE NCC Policy Coordinator <adrian(a)ripe.net> > Date: September 29, 2005 08:21:51 BDT > To: dns-wg-chair(a)ripe.net > Cc: Olaf Kolkman <olaf(a)ripe.net> > Subject: [dns-wg-chair] 2005-07 One Week to End of Discussion Period > Reply-To: webmaster(a)ripe.net > > > PDP Number: 2005-07 > Introducing DNSSEC Service to Reverse DNS Trees > > Dear Colleagues > > The "Last Call" period for the new RIPE Document described in proposal > 2005-07 is due to end in one week on 6 October 2005. > > You can find the full proposal at: > > http://www.ripe.net/ripe/policies/proposals/2005-7.html > > When the "Last Call" period ends, we will write to you to ask if > consensus has been reached. > > Regards > > Adrian Bedford > RIPE NCC > > >

1 0

DNS USer
by Chandrashekhar Kulkarni 28 Sep '05

28 Sep '05

Any one how know about dns with kerberose

2 1

upcoming meeting ripe 51
by Jaap Akkerhuis 27 Sep '05

27 Sep '05

The minutes of the ripe-51 DNS-WG can found at the usual place: http://ripe.net/ripe/wg/dns/r50-minutes.html The draft agenda follows below. I'll be off ine the week before the RIPE meeting, so please send remarks etc. directly to the list. jaap Agenda Item Time Speaker Title ------------------------------------------------------------------------------------- Wednesday 16:00 -- 17:00 ------------------------------------------------------------------------------------- A 2 min Agenda bashing & Scribe B 10 min Chair Minutes ripe-50; Action points Reports C.1 5 min Olaf Kolkman -- NLnet Labs IETF DNSEXT WG C.2 5 min Marcos Sanz -- DENIC IETF CRISP WG C.3 5 min Scott Hollenbeck -- Verisign EPP: The next steps Proxied by Jaap Talks D 20 min Lorenzo Colitti -- Ripe NCC Effect of anycast on K-root: early results E 10 min Carsten Strotmann -- Men & Mice DNS Guru contest ------------------------------------------------------------------------------------- Thursday 11:00 -- 12:30 ------------------------------------------------------------------------------------- F 10 min Brett Carr -- RIPE NCC DNS restructuring update at RIPE NCC G 15 min Andrei Robachevsky -- Ripe NCC Deprecation of ip6.int H 15 min Johan Ihren -- Autonomica Key rollover Paper & Tools I 15 min Lars-Johan Liman -- Autonomica Ripe NCC secondary service policy J 15 min Jakob Schlyter -- SUNIC DNSSEC in Sweden K 10 min Peter Koch -- Denic Update to RIPE 203 Recommenda- tions for SOA values L 10 min Peter Koch -- Denic ENUM DNS predelegation checks Z 3 min AOB -------------------------------------------------------------------------------------

1 0

DNSSEC Signed Zones at the RIPE NCC
by Brett Carr 26 Sep '05

26 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Colleagues, As part of the project to deploy DNSSEC in the RIPE NCC Service region, we have been signing a number of zones over recent weeks. The following zones are currently signed: ripe.net ripencc.com ripencc.net ripencc.org ripe-ncc.com ripe-ncc.net ripe-ncc.org If you want to configure your resolvers to verify these zones using DNSSEC, you can get the key signing keys for these zones from: https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys.txt. For information about how to use the keys, and further details about DNSSEC deployment at the RIPE NCC, see: http://www.ripe.net/projects/disi/keys/. Regards Brett Carr RIPE NCC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFDN/0pP/nJBHjtetsRAg+dAJ0fMl1aZPRr+r2P+SIZJQZVlQC7ogCfXpYK LsbPUyhiOoYPBthLRf7lDoc= =AQQB

1 0

NREN swapping secondary name-servers?
by João Pagaime 21 Sep '05

21 Sep '05

Hello all, My name is João Pagaime and I work for FCCN, the Portuguese NREN that also operates the ccTLD-PT We're about to move "edu.pt" to a standalone DNS zone, and I'm searching for a secondary name server outside AS1930 Is there any NREN interested in swapping seconday name service? We can provide for secondary name service along the lines layed out bellow Our general requirements guidelines for the edu.pt are the following: availability requirements------------------------ It would be nice to have no more than 12 hours down time every 3 months that's 99.4% of availability response time------------------------------------ Less that 140 ms "DNS round-trip-time", measured from the .PT primary name server "DNS round-trip-time" on this context is considered to be the time it takes to answer a DNS query. We use "dig" to get this value estimated zone size------------------------------ about 2MB (measured at the secondary server text file) estimated query load-------------------------------- 20 queries/sec update/transfer strategy----------------------------- AXFR with notifies (no need to actually respond to notify. SOA timers suffice) 3 updates every day zone access policy-------------------------------- restricted Thank you, João Pagaime

1 1