- dns-wg - mailman.ripe.net

Change of K-Root Instance in Frankfurt to a Global Node
by Wolfgang Nagele 19 Jun '09

19 Jun '09

Dear Colleagues, The RIPE NCC (AS25152) upgraded the k.root-servers.net instance in Frankfurt, Germany to a global node on 18 June 2009. This means that we are now announcing the prefix without the BGP no- export attribute. If you have been operating a peering session with us at DE-CIX, you will now see the prefix 193.0.14.0/23 instead of 193.0.14.0/24. Please adjust your filters if necessary. Anybody interested in peering with us can either use the DE-CIX route servers or contact <k-peerings(a)ripe.net> to set up a separate peering session. We also invite anybody who is willing to provide us with transit for this instance to contact us at <k-peerings(a)ripe.net>. Regards, Wolfgang Nagele DNS System Engineer, RIPE NCC

3 2

.ORG is signed
by Dave Knight 02 Jun '09

02 Jun '09

Colleagues, On behalf of PIR Technical Support I would like to announce that as of today, 2009-06-02, at 16:00 UTC .ORG is DNSSEC signed. Press release at http://www.afilias.info/afilias+signs+org+zone The following KSK is now valid for .ORG org. IN DNSKEY 257 3 7 ( AwEAAYpYfj3aaRzzkxWQqMdl7YExY81NdYSv+qayuZDo dnZ9IMh0bwMcYaVUdzNAbVeJ8gd6jq1sR3VvP/SR36mm GssbV4Udl5ORDtqiZP2TDNDHxEnKKTX+jWfytZeT7d3A bSzBKC0v7uZrM6M2eoJnl6id66rEUmQC2p9DrrDg9F6t XC9CD/zC7/y+BNNpiOdnM5DXk7HhZm7ra9E7ltL13h2m x7kEgU8e6npJlCoXjraIBgUDthYs48W/sdTDLu7N59rj CG+bpil+c8oZ9f7NR3qmSTpTP1m86RqUQnVErifrH8Kj DqL+3wzUdF5ACkYwt1XhPVPU+wSIlzbaAQN49PU= ) ; key id = 21366 Please note that due to the use of NSEC3 this key should not be used with BIND versions less than 9.6.0. Please refer to http://pir.org/dnssec for more information. As always, please report operational concerns with any Afilias-hosted zone to <noc(a)afilias-nst.info> dave -- Dave Knight Director, Resolution Services Afilias PIR Technical Support URL: http://www.pir.org E-mail: techsupport(a)pir.org Phone: +1.416.646.3308 Fax: +1.416.646.3305

1 0

.ORG is signed
by Dave Knight 02 Jun '09

02 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Colleagues, On behalf of PIR Technical Support I would like to announce that as of today, 2009-06-02, at 16:00 UTC .ORG is DNSSEC signed. The following KSK is now valid for .ORG org. IN DNSKEY 257 3 7 ( AwEAAYpYfj3aaRzzkxWQqMdl7YExY81NdYSv+qayuZDo dnZ9IMh0bwMcYaVUdzNAbVeJ8gd6jq1sR3VvP/SR36mm GssbV4Udl5ORDtqiZP2TDNDHxEnKKTX+jWfytZeT7d3A bSzBKC0v7uZrM6M2eoJnl6id66rEUmQC2p9DrrDg9F6t XC9CD/zC7/y+BNNpiOdnM5DXk7HhZm7ra9E7ltL13h2m x7kEgU8e6npJlCoXjraIBgUDthYs48W/sdTDLu7N59rj CG+bpil+c8oZ9f7NR3qmSTpTP1m86RqUQnVErifrH8Kj DqL+3wzUdF5ACkYwt1XhPVPU+wSIlzbaAQN49PU= ) ; key id = 21366 Please note that due to the use of NSEC3 this key should not be used with BIND versions less than 9.6.0. Please refer to http://www.pir.org/dnssec/ for more information. As always, please report operational concerns with any Afilias-hosted zone to <noc(a)afilias-nst.info> dave - -- Dave Knight Director, Resolution Services Afilias PIR Technical Support URL: http://www.pir.org E-mail: techsupport(a)pir.org Phone: +1.416.646.3308 Fax: +1.416.646.3305 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkoliqgACgkQVFeEx/p946bjvACg38xkLPx/oYTQ9NOzb6Oy3dwR 4/kAoNdmG3I/wgaGiMb9n2F94NbLEARZ =M7y/ -----END PGP SIGNATURE-----

1 0

.my DNSSEC testing included in IANA DNSSEC testbed
by Richard Lamb 23 May '09

23 May '09

In cooperation with and at the request of the .my domain registry, the .my DNSSEC testbed has been incorporated into the IANA signed root testbed https://ns.iana.org/dnssec/status.html to facilitate testing. For those using the IANA testbed: "dig +dnssec -t soa my" should return a validated result. For those that are not: "dig +dnssec -t soa my @66.165.162.24" should return a validated result. I understand the test .my DNSSEC zone is not fully populated. If you have any problems or questions, please let me know. Rick Lamb DNSSEC Program Manager IANA PS: Thanks to Ondrej Sury/.CZ for the "dnssec indicator"! https://ns.iana.org/dnssec/diagram.html

1 0

Announcement: DNSSEC e-learning module 1 available now
by Rumy Kanis 18 May '09

18 May '09

[apologies for duplicates] Dear Colleagues, The RIPE NCC is pleased to announce the launch of the first module of our DNSSEC e-learning course, entitled "DNS Basics". This introductory module explains how DNS works by following a simple query, and can be viewed at: https://e-learning.ripe.net/training/e-learning/ In the coming months we will be releasing several more modules. Next up are: Module 2: DNS Vulnerabilities Module 3: DNSSEC The RIPE NCC E-Learning Centre is a free-of-charge service available to everyone. If you have any questions, please feel free to contact us at <e-learning(a)ripe.net>. Happy Learning, Rumy Kanis Training Services Manager RIPE NCC

1 0

Invitation to Stockholm for OpenDNSSEC and DNSSEC training 29th May 2009
by Patrik Wallstrom 08 May '09

08 May '09

Hi! There were some interest in learning more about OpenDNSSEC among the participants in the working group. So I would like to invite you to a day of education to learn more about the project, how we work with it and about the components and architecture. We are going to be in our offices in Stockholm on the 29th May 2009. If you are interested you can subscribe to the training here: http://dnsseceducation.axaco.se/ See you in Stockholm! -- Patrik Wallström Project Manager, R&D .SE (Stiftelsen för Internetinfrastruktur) E-mail: patrik.wallstrom(a)iis.se Web: http://www.iis.se/

1 0

DNS SSR Symposium Report
by John L. Crain 06 May '09

06 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, Here is a link to the outcomes report that will be mentioned in my brief talk at the WG session. Sorry for lateness/lack of preparation http://www.gtisc.gatech.edu/pdf/DNS_SSR_Symposium_Summary_Report.pdf John -----BEGIN PGP SIGNATURE----- Version: 9.10.0.500 wj8DBQFKAYJY0bGnldSKWJIRAhiOAJ9yfG8y+tvZCj1etXBjN5ygMsNeZwCgp/Ud PYnat7MBUIpIdP3NNy3T8dU= =zHnL -----END PGP SIGNATURE-----

1 0

Final RIPE DNS WG Agenda for Wed/Thu
by Peter Koch 06 May '09

06 May '09

Dear WG, please find below the final agenda for today's and tomorrow's sessions. There are few last minute changes affecting time slices and presenters only. Remote participants will find contact information at <http://www.ripe.net/ripe/meetings/ripe-58/index.php?home=remote> We're in the process of making the presentation material available. Regards, Peter

1 0

Updated Draft DNS WG Agenda for RIPE 58
by Peter Koch 01 May '09

01 May '09

Dear WG, please find below an updated draft agenda for the DNS WG sessions at the upcoming RIPE meeting. As you can see, both session are pretty packed. Alas, there's no more space available, but individual slot assignments might be shifted around. All presenters are encouraged to submit their slideware to the on-site meeting repository (ROSIE) prior to the meeting. See you in Amsterdam! -Peter

4 4

Updates to DNS WG action item list
by Peter Koch 29 Apr '09

29 Apr '09

Dear DNS WG, here are some updates to our action item list maintained at <http://www.ripe.net/ripe/wg/dns/dns-actions.html> ----------------------------------------------------------------------------- 48.1 Collect experiences with lameness problems due to vanished customers or AXFR sources See slide 7 of <http://www.ripe.net/ripe/meetings/ripe-48/presentations/ripe48-dns-mci.pdf> The discussion during RIPE 57 revealed: The survey amongst CENTR members (mostly European ccTLDs) showed that they had not seen a noticable number of requests to alter or remove DNS delegations by third parties (i.e., other than the registrar or registrant) and in general their policies would not allow them to follow such request. Very few would be able to act upon lame delegations, independent of who raised the issue. For the reverse mapping, similar problems had not been reported. During previous discussion after the action item was initially assigned, the general problem was acknowledged but with little evidence of being re-occuring or pressing. No operators of DNS name servers had come forward to suggest any operational urgency. This action item is now DONE. ----------------------------------------------------------------------------- 49.2 Document on DNS Server Migration The working group has taken several attempts to finish the document, including defining the target audience, scope and level of detail. While discussions in both Berlin and Dubai had demonstrated some level of interest, the available momentum could not drive the draft towards a WG consensus. The conclusion in Dubai (RIPE 57) was to drop this project with thanks to all contributors. An archived version is available at <http://www.ripe.net/ripe/maillists/archives/dns-wg/2008/msg00031.html> and may serve as a starting point for a new initiative. This action item is now DONE. ----------------------------------------------------------------------------- 57.1 RIPE NCC (Anand) to consider pros and cons of submitting the trust anchors of zones signed by the RIPE NCC into ISC DLV This action item is NEW. ----------------------------------------------------------------------------- 57.2 Peter Koch will document the WGs advice that the old forward DNS zone domain objects in the RIPE DB should be deleted and liaise with the DB WG This was acted upon during the database WG meeting in Dubai. The DB WG agreed to take over, so this will continue as DB WG item 57.1. This action item is DONE. ----------------------------------------------------------------------------- Open action items are [51.4] and [57.1]. ----------------------------------------------------------------------------- -Peter

1 0