- dns-wg - mailman.ripe.net

Fwd: FYI: ARPA DS record in the root
by Andrei Robachevsky 07 Dec '10

07 Dec '10

-------- Original Message -------- Subject: FYI: ARPA DS record in the root Date: Tue, 7 Dec 2010 09:26:57 +0100 From: IAB Chair <iab-chair(a)iab.org> To: IETF Announcement list <ietf-announce(a)ietf.org> Dear Colleagues, The ARPA DS RRset has been published in the root zone as of serial number 2010120601. This allows signed reverse address RRsets to be validated by DNSSEC aware recursive name servers that have the root configured as their trust-anchor. --Olaf Kolkman IAB Chair ----------------------------------- The Internet Architecture Board www.iab.org iab-chair(a)iab.org _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce

5 4

Replacing reverse zone delegations by DNAMEs
by Chris Thompson 02 Dec '10

02 Dec '10

I don't know whether this is the most appropriate forum to raise this issue --- but if RIRs can be persuaded to support the alternate form of reverse zone delegation suggested here, perhaps other authorities would do the same. Fragmentation of IPv4 space leads to organisations having lots of little reverse zones, each of which requires: managing the contents, maintaining the registration, organising official slaves, DNSSEC signing ... There is much uneconomic effort involved. Locally we have been using a scheme to map such reverse lookups into a single common zone, described at http://people.pwf.cam.ac.uk/cet1/prune-reverse-zones To take full advantage of this, however, requires promoting DNAMEs into the parent reverse zone. Logically, administrators of such zones ought to be delighted to replace delegations (multiple NS records, maybe DS records as well) with a single DNAME. But of course it has not been standard practice to support that. As DNAMEs do not redirect the name itself, there would be a problem for reverse zones containing significant records at the apex, e.g. PTR records pointing to a gateway host. (I think that practice, recommended in RFC 1033, has pretty much fallen into disuse.) If the IETF DNSEXT WG ever get their act together on "XNAME"/"CNAME+DNAME", that would cover that particular point, but meanwhile no-one would be obliged to use DNAMEs if they didn't want to. Anyway, I would welcome opinions on this idea. -- Chris Thompson University of Cambridge Computing Service, Email: cet1(a)ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom.

9 13

New DNSMON beta user interface
by Mirjam Kuehne 15 Nov '10

15 Nov '10

[apologies for duplicates] Dear colleagues, A new DNSMON beta user interface has been published. Please find a description of the enhancements on RIPE Labs: https://labs.ripe.net/Members/markd/dnsmon-new-user-interface-update Kind Regards, Mirjam Kuehne RIPE NCC

1 0

Final(?) agenda for RIPE61
by Jim Reid 15 Nov '10

15 Nov '10

Here is what should be the final agenda for the WG sessions this week. There's one minor tweak from the draft agenda. Jelte Jansen and Dave Knight have swapped slots.

1 0

Draft agenda for RIPE
by Jim Reid 03 Nov '10

03 Nov '10

Colleagues, here is an almost final agenda for the WG at RIPE61. I don't expect there will be significant changes: perhaps minor tweaks to the running order. There are one or two loose ends that need to be clarified. However these are unlikely to make much impact on the overall agenda. Please note that the WG slots are not back-to-back for the first time in ages. The first one is on the Tuesday afternoon and is 2 hours long instead of 90 minutes. Your co-chairs have done some trading of slots with the other WGs to minimise the clashes with other WGs that would have been unpopular. That's why we gave up one of the usual Thursday slots this time. As always, comments and questions on the agenda are welcome. See most of you in Rome.

1 0

DNSSEC KSK Roll-over Event for RIPE NCC Zones
by Anand Buddhdev 25 Oct '10

25 Oct '10

[Apologies for duplicates] Dear Colleagues, On 21 September, we performed a roll-over of Key Signing Keys (KSKs) of all our signed zones. However, we encountered some issues with the signing infrastructure, and we had to perform a roll-back and delay the key roll-over event. We have resolved the issues with the signing infrastructure, and we will perform a roll-over of KSKs on Wednesday 27 October, and publish new trust anchor files on the RIPE NCC website: More information on DNSSEC keys is available at: https://www.ripe.net/dnssec-keys/index.html Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

request about RIPE vs. ISP and RFC 1921, 2.1
by thoma spolnik 15 Oct '10

15 Oct '10

Hello, if RIPE assigns an large ip net to an ISP - Does RIPE accept, that this ISP ignores RFC 1921, 2.1 [1] (for commercial interests)? Are commercial interests a valid reason [2] for RIPE, that an ISP does not set (generic) PTR records for an used IP? Does or does not RIPE claim the compliance with (basic) RFCs (like RFC 1921, 2.1 - I think it is a basic, that every IP must have a correct PTR record.) for assigned IP nets? I hope, I found the correct mailing list for my question. If this the wrong list, which should I use for my question? Best regards, thomas polnik. [1] 2.1 Inconsistent, Missing, or Bad Data Every Internet-reachable host should have a name. The consequences of this are becoming more and more obvious. Many services available on the Internet will not talk to you if you aren't correctly registered in the DNS. Make sure your PTR and A records match. For every IP address, there should be a matching PTR record in the in-addr.arpa domain. [...] [2] RFC 2119 [...] 3. SHOULD This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course. [...]

4 5

another concern over naming
by Jim Reid 06 Oct '10

06 Oct '10

Colleagues, I wonder if we've overlooked this rather important concern about the use of hyphens in domain name labels? http://forum.icann.org/lists/name-numbers-and-hyphens-domains/msg00000.html

2 1

Decommissioning of the RIPE NCC Reply-size Tester
by Anand Buddhdev 05 Oct '10

05 Oct '10

[Apologies for duplicates] Dear Colleagues, In December 2009, the RIPE NCC made a reply-size tester available to the community. The purpose of this was to allow users to test their networks for path MTU related issues and to help them prepare for the roll-out of a signed root zone. We installed the reply-size server component on a temporary basis at the global instances of K-root to allow testing against an actual root server instance. We collected some statistics and published some interesting research on the RIPE Labs website: http://labs.ripe.net/Members/dfk/content-measuring-dns-transfer-sizes-first… A signed root zone has been published since 15 July 2010, and we feel that the reply-size tester has served its function. We are therefore going to decommission it on Monday, 11 October 2010. If you wish to continue testing networks for path MTU issues, we recommend that you use the reply-size tester of DNS OARC: https://www.dns-oarc.net/oarc/services/replysizetest Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

OpenDNSSEC training
by Rickard Bellgrim 04 Oct '10

04 Oct '10

Hi OpenDNSSEC have now been deployed at six TLD:s (.dk, .fi, .fr, .nl, .se, and .uk) and ICANN. We are therefore continuing our effort on giving two-day training courses. You can select from two dates 1-2 November and 29-30 November. Please read the attached PDF and get back to me if you are interested. // Rickard Bellgrim

1 1