- dns-wg - mailman.ripe.net

Agenda items for RIPE71
by Jim Reid 13 Aug '15

13 Aug '15

Colleagues, it may seem odd to be doing this at the height of the summer holidays when the next RIPE meeting is 3 months away. If you have suggestions for agenda topics or presentations for the WG session(s) in Bucharest, could you please contact the co-chairs at dns-wg-chairs(a)ripe.net? Thanks. The draft meeting plan has allocated just one slot for the WG. It's tentatively scheduled for the Thursday morning (https://ripe71.ripe.net/programme/meeting-plan). The WG will only get a second slot (ideally also on the Thursday) if we have a draft agenda which shows the extra slot is needed. We also need to do that before any other WGs try to grab the currently free slots. So the sooner we can get an outline agenda put together, the better! Your co-chairs often get last-minute suggestions and/or overspill from the plenary which can be tricky to accommodate. That could be harder if we just have a single slot next time. So to avoid disappointment, please try to give us plenty of advance notice for your proposed agenda items and discussion topics. Ta. I hope you all enjoy the summer holidays and look forward to seeing everyone at RIPE71.

1 0

FYI: Live-streaming the Root Zone Key-Signing Key Ceremony 22
by Jaap Akkerhuis 12 Aug '15

12 Aug '15

In case people missed this announcment and are interested. jaap FYI, (Apologies if you see duplicates of this message.) ICANN, as the IANA Functions Operator, will be live-streaming the Root Zone Key-Signing Key Ceremony (number 22) on Thursday, August 13. The "main" ceremony that day is scheduled to begin at 2000UTC. (This is an activity related to DNSSEC.) For more information about the event see: https://www.iana.org/dnssec/ceremonies/22 On Thursday there will be two cermonies as listed on that web page. The first ceremnoy will rotate cryptographic officer duties, basically, a change in some of the trusted community representatives participating in the key ceremonies. The second ceremony (the "main") will feature the introduction of two new Hardware Security Modules. This is the ceremony that will start at 2000 UTC. Please see the above link for more information. The live-streaming link is at the bottom of the page. (https://icann.adobeconnect.com/kskceremony)

1 0

Live-streaming the Root Zone Key-Signing Key Ceremony 22
by Edward Lewis 12 Aug '15

12 Aug '15

FYI, (Apologies if you see duplicates of this message.) ICANN, as the IANA Functions Operator, will be live-streaming the Root Zone Key-Signing Key Ceremony (number 22) on Thursday, August 13. The "main" ceremony that day is scheduled to begin at 2000UTC. (This is an activity related to DNSSEC.) For more information about the event see: https://www.iana.org/dnssec/ceremonies/22 On Thursday there will be two cermonies as listed on that web page. The first ceremnoy will rotate cryptographic officer duties, basically, a change in some of the trusted community representatives participating in the key ceremonies. The second ceremony (the "main") will feature the introduction of two new Hardware Security Modules. This is the ceremony that will start at 2000 UTC. Please see the above link for more information. The live-streaming link is at the bottom of the page. (https://icann.adobeconnect.com/kskceremony)

1 0

FYI: Design Team Review of Plan for DNS Root Zone KSK Change
by Jaap Akkerhuis 07 Aug '15

07 Aug '15

The next annoncement might be of interest to readers this mail list. <https://www.icann.org/public-comments/root-ksk-2015-08-06-en> Purpose: This public comment proceeding seeks to review the Design Team’s findings to date related to issues and plans for changing the cryptographic key used to originate the DNSSEC chain of trust. Current Status: The Design Team has generated a preliminary report and will accept wider review. Next Steps: After the public comment proceeding, the Design Team will finalize its report and plan for changing the cryptographic key. jaap

1 0

RIPE NCC secondary DNS configuration changes complete
by Anand Buddhdev 03 Aug '15

03 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear colleagues, We announced some changes to the RIPE NCC's DNS provisioning infrastructure in June: https://www.ripe.net/ripe/mail/archives/dns-wg/2015-June/003095.html We have now completed this configuration change. The new servers are functioning as the hidden masters for ns.ripe.net, and the old server (193.0.0.198) is no longer performing this function. If you have any questions, please reply to <dns(a)ripe.net> Regards, Anand Buddhdev RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJVv0GcAAoJEBXgoyUMySoFXeQP/2R5fp28whuZxVWIncpk8wKg 00pZ07BDbPChyaxhF2f6NHMmTfJV3yp1xXI6tIoQbzmo602lTMnBvywH2ic4P8fO vOsSlBHqSkR5SCsNJ+AoMVbqpUygH7Sr9Om3H7hRFWzfS3PWfLd2YSdRRrV9LR9r 8A5B6sqy5dKWGcT1FfBJvmNHXBnLLDaFA6PpibNA8dN+9mteARyPuBPwF/u+tfCC dD4neRw5eI2M7C7B5313W33R4l57oCvHX7eeuKsfRQzWCOMHqlVQoWP/+/JfVZRG iMBtEUKpfXTMNOIDh1ikRHV7Ra6yWY57g8uWqs9umW6PfY3zSGAL1U+U7ExARvyU /6Ags0/71FWQUM26nNnvYuhpWP2IHoNuOHt1IFZ4UqNgGxRH+IGL8Nagm60DeHnT cOltmiygMs2MWs+ej560URsze82pAPFCauqIv1r0HArUhSPQEX90PbsPzyESL4PL G6rJfw5k1PtEApeos9ezlI4HRuMfWHMEO5HgQ5Eb6dSDv7XHfZMbKKxTgup1jPUk sjfSTPidbWj4pFsMkI+a3er8IPk1vEe2Z53BQR+ateMDK6Oa5aUoqz5sZBrklI5z 4EqRsn2Z44bQFVHMv71wiG55r4s9MP+MrBmyS4JIcK1OJmOYt86YBwtT37o+evsT FRu9FqzOQ3L9+wj7S/6h =07hR -----END PGP SIGNATURE-----

2 1

DNS-WG co-chair selection process
by Jaap Akkerhuis 07 Jul '15

07 Jul '15

All, In May we published the last proposal to adopt the co-chair selection process[1]. At the ripe-70 meeting Jim repeated this status and asked for last comments. Given that there has been no discussion after May, I'm happy to declare consensus to adopt the process as stated in [1]. Regards, jaap, speaking as co-chair [1] <https://www.ripe.net/ripe/mail/archives/dns-wg/2015-May/003089.html>

1 0

RIPE NCC domain registrations
by Romeo Zwart 01 Jul '15

01 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear colleagues, The RIPE NCC holds a number of domains besides ripe.net. Some of these domains were only registered as a "protection" mechanism, which was considered good practice at the time. We now plan to release the following domains, which are not being actively used by the RIPE NCC: ripe-ncc.org ripe-ncc.com ripe-ncc.net ripencc.com ripencc.net ripencc.org ripelabs.net ripen.cc ripe.int ipv6roadshow.com ipv6roadshow.net ipv6roadshow.org Depending on the registration expiration date of each of these domains, we will either let the domain expire or take steps to actively delete it. The following domains held by the RIPE NCC are still in use. We have no immediate plans to release any of these domains: ripe.net enumdata.org enog.org nro.net nro.org ipv6eyechart.net ipv6actnow.org ipv6actnow.com ipv6actnow.net Please let us know within two weeks if you have any comments or feedback about this process. Kind regards, Romeo Zwart -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJVkovvAAoJEKnY9vIUvfudPR8P/0PEnpvz435gKM941vSf7j3U rqYcnBD54MQBiw8MaUA4Q+UTjw/DsHsFw/EISXt1EFITp2ACrLBesQbMWWtr/V3Q ylz1DRDiRI8JKWuKvoAbCKcdwpbeH6C3JhNl4wlSvmNUq47EFF7la24XvpiuyrBo 1vf8K9q0I9HfBixXbbqfipd0VGlvw9RKejpTRhUwJ90kR5VytvJMcR+COJlBr/83 q9EHrXmk8fZn8rp/pakygITSxny+psvaaJY9HxffQJM23iClSPz11kwGmFFvhYFf JIxDvzbVtYPZHpZCKK20UWisXcrQsu7XdVNV4zechKzf+H7kHR5O+ODGsKE6w91A G1bWOlqqC9jLDIaq8pTKLV1kwtyM/1Ng2ZA8yG9Xk1RHnKkDCVBLZiShyjbd/MWs xwdqs9JKXVwKjaIBJq5p64pR3i94rHdn9qepfNgXQ8bbtEy+xHtlBpLce0jMoHKA y87Z7a82NyZymose6xfPIdF+Jz6FqDKyOxk3MwjC9b3XeEGbh9WpvzvSCn1b7ZIx gD3fcFC7xgQxTqo898CiZjDrxSwE7MXG0rSfZ3jDH9prrPyK6L4MpMalISqW5vvK Vu6m/vQQSIb4qamc1BaGBtLCroEQJP94Cs3OvwEg4mAKpmysfn9ZMyxnjdsDHSsw YnZLUwD60vPiurov+Am0 =4MS6 -----END PGP SIGNATURE-----

9 12

Call for Presentations - DNS-OARC Fall Workshop, Oct 2015
by Sean Stuart 18 Jun '15

18 Jun '15

The next DNS-OARC Fall Workshop will take place in Montreal on Oct 3rd and 4th, the weekend before NANOG65. DNS-OARC is requesting proposals for presentations, with a preference for DNSSEC work. We are looking for the whole spectrum, from measurement work using passive and active techniques, to applications and potential new uses of DNSSEC. This workshop intends to build from previous strong DNS-OARC workshops, where operational content and research is welcome. Presentations from DNS operators are particularly welcome, as well as from DNS researchers. All DNS-related subjects are accepted, introduction to new tools, visualizations, data analysis, DNSSEC and novel uses of the DNS. If you are an DNS-OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Time will be available for lighting talks to fit short presentations (5 to 10 minutes). Workshop Milestones 17 June 2015, Call for Presentations posted 17 June 2015, Open for submissions 30 July 2015, Deadline for submission 20 August 2015, Final Program published 1 October 2015, Final deadline for slideset submission Details for abstract submission will be published here: https://indico.dns-oarc.net/event/24/call-for-abstracts/ The workshop will be organized on different tracks, depending on the topics and the timing of each presentation. If you are interested in a lightning talk, let us know at the time of submission. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> if you have questions or concerns. Sean Stuart, for the DNS-OARC Programme Committee DNS-OARC is also seeking sponsorship for this workshop, please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that DNS-OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Sean Stuart Engineer, Resolution Operations sstuart(a)verisign.com m: +1-571-265-2148 t: +1-703-948-4204 12061 Bluemont Way, Reston, VA, 20190 VerisignInc.com <http://www.verisigninc.com/>

1 0

Improvements to the RIPE NCC DNS provisioning infrastructure
by Anand Buddhdev 02 Jun '15

02 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear colleagues, The RIPE NCC is improving the resiliency of our DNS infrastructure by introducing multiple provisioning and distribution servers. One of the services we provide is secondary DNS for large reverse DNS zones. LIRs request this by adding "ns.ripe.net" to the "nserver:" attribute of their domain objects. Our provisioning system then automatically configures the server ns.ripe.net as a secondary for the reverse zone in that domain object. However, ns.ripe.net is not a single physical server. It provides DNS service from several servers using BGP anycast. For this reason, we have separate hidden distribution servers. If you are using this service, you will need to update your configuration. You will need to change your DNS server access control lists, notify settings and firewall settings. Please allow the following two new name servers to transfer your reverse DNS zone(s): 193.0.19.190 / 2001:67c:2e8:11::c100:13be 93.175.159.250 / 2001:67c:2d7c:66::53 Additionally, if you would like ns.ripe.net to update promptly, then please send notify messages to the above four addresses. Note that any notify messages sent directly to the addresses of ns.ripe.net will not be seen. Also, we do NOT support any non-standard configurations (such as port numbers other than 53, TSIG keys and so on). Please update your configuration by 31 July 2015. This is the date when we’ll retire the old server. If you have any questions, please send an email to <dns(a)ripe.net> Regards, Anand Buddhdev RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJVbaqyAAoJEBXgoyUMySoFkcwP/iFoS32eGZYdmTkyGoKvFZgS 6bdIVZcUNZzE3KEbLj9mtLG4pZIdDrCtAkEgg+ZRGwElCjzzrxTXybQxziAOz/JJ Xy+FUpXyf2HpgQ0b6Zbu+Dx8lYbt++hVHD6NYSUrZgKZDVw4/nNE1b32XW63WUK3 Du4nou3JF8m5bOBG4qkLU4jPoQDuSr4pduOZ6LX7/Vilxfj4r12wgTED2hTCgaD/ +8vBmHVcxQPkYy+r8/ZG63raHIpTn8glEjb/ecAZJ9XGAgHGgS3nZkARKy0V80Yg HtBmEx6U3BksBYKq2iFiNZK1jYwD4yO9Jq66wgSpbH3Oqw9ocgiI4Q8VfqrevZC+ 98smPv60sKJAGj22yziscSWJESk3jWYYOrY1J+vVtqi777JbXw6vgIQUgki9+Udi V6qHNV0nRfjrPgyE9F9xdufZjrWMiNmiKffPa+LOSc15nTGFeY5A5FFW4fo+Up37 7qMvOpMML6tBJTbKVkG0uOPkQ/hzEoRgLnvvGiSvwG4uRie13MVk1nEVlnad1SKs c1UwsdhkVZ1qf4b7jlquB0rBkRn3KIZkuCE6TLSSI9BKZg4krX2A2CuvaC7cm+jn XIm/Kh4nyVg5wpqRP9eLkwneDD7aPmWKUDZ79GEdcRejg32Cmii22bGgcxa3gw1W JmMzYQFsa/UuDQI8nbJT =btiT -----END PGP SIGNATURE-----

1 0

K-root hosted nodes
by Romeo Zwart 13 May '15

13 May '15

Dear colleagues, Starting today, the RIPE NCC will accept requests from organisations interested in hosting a K-root node in their own networks. If your organisation is interested in hosting a node, you can find more information, including the technical requirements and details about the request process, online: http://k.root-servers.org/hosting More background information about these plans can be found in several RIPE Labs articles: https://labs.ripe.net/Members/kranjbar/future-of-ripe-ncc-technical-services https://labs.ripe.net/Members/romeo_zwart/k-root-expansion-plan https://labs.ripe.net/Members/romeo_zwart/new-architecture-for-k-root-local… As always, we welcome your feedback on these plans. Best regards, Romeo Zwart RIPE NCC

1 0