- dns-wg - mailman.ripe.net

yet another final WG agenda
by Jim Reid 13 Apr '12

13 Apr '12

This is almost certainly going to be the final version. Famous last words... I forgot to list Robert as the stuckee for the NCC report in the one sent earlier today. So here it is now: # # $Id: agenda,v 1.8 2012/04/13 12:38:07 jim Exp $ # DRAFT AGENDA FOR RIPE64 - There may be last-minute tweaks [0] Usual administrivia (5 mins) [1] NCC Report (10 mins) Robert Kisteleki, RIPE NCC [2] DNSSEC in .si (10 mins) Benjamin Zwittnig Observations and problems encountered during the preparations for .si signing, running a signed .si zone and future plans. [3] Dnssexy (15 mins) Willem Toorop, NLnetLabs Dnssexy (DNS SEc proXY) is a software-program to fortify DNSSEC availability. It operates as a bump in the wire between an hidden master and a public slave. It receives DNS-transfers from the hidden master, but only notifies the public slave when all records are properly assessed by means of a user defined programme. [4] Quality of DNS and DNSSEC in the .se zone (20 mins) Patrick Wallstrom, IIS As part of the Healthcheck programme in .SE, IIS have surveyed the .se zone for DNS quality and a more in-depth analysis of DNSSEC quality, looking at all DNSSEC related parameters and unexpected issues. [5] DNSSEC: dealing with hosts that don't get fragments (20 mins) Roland M. van Rijswijk, SURFnet Middleware Services Even of you sign your zone according to the book, querying hosts that don't accept large responses due to them blocking fragments may cause you grief. This presentation outlines the issues you may encounter and provides guidelines for dealing with them based on research we are currently doing at SURFnet. [6] Followup to Plenary DNS Presentations (10 mins) COFFEE [7] YADIFA Update (10 mins) Peter Janssen, EURid [8] Knot Update (10 mins) Ondřej Surý, CZ.NIC [9] OpenDNSSEC Status Update (15 mins) Jakob Schlyter, OpenDNSSEC The soon-to-be-release version 1.4 and roadmap for version 2.0 (planned for release later in 2012) and beyond. [10] ATLAS measurements & tools (10 mins) Robert Kisteleki, RIPE NCC [11] Dense Anycast Deployment of DNS Authority Servers (20 mins) Dave Knight, ICANN A description of the wide-scale anycast deployment of L-Root by ICANN with a focus on operations and architecture. The presentation will include details of the platform, approaches for automating deployment, distributed configuration management, monitoring and measurement. [12] Panel discussion on DNSChanger (30 mins) [13] AOB

1 0

final(?) agenda for RIPE64
by Jim Reid 13 Apr '12

13 Apr '12

Here's what I hope is the final version. The item on the SATIN conference has been dropped in favour of an update on YAFIDA from Peter Janssen. # # $Id: agenda,v 1.7 2012/04/13 12:14:56 jim Exp $ # DRAFT AGENDA FOR RIPE64 - There may be last-minute tweaks [0] Usual administrivia (5 mins) [1] NCC Report (10 mins) A N Other, RIPE NCC [2] DNSSEC in .si (10 mins) Benjamin Zwittnig Observations and problems encountered during the preparations for .si signing, running a signed .si zone and future plans. [3] Dnssexy (15 mins) Willem Toorop, NLnetLabs Dnssexy (DNS SEc proXY) is a software-program to fortify DNSSEC availability. It operates as a bump in the wire between an hidden master and a public slave. It receives DNS-transfers from the hidden master, but only notifies the public slave when all records are properly assessed by means of a user defined programme. [4] Quality of DNS and DNSSEC in the .se zone (20 mins) Patrick Wallstrom, IIS As part of the Healthcheck programme in .SE, IIS have surveyed the .se zone for DNS quality and a more in-depth analysis of DNSSEC quality, looking at all DNSSEC related parameters and unexpected issues. [5] DNSSEC: dealing with hosts that don't get fragments (20 mins) Roland M. van Rijswijk, SURFnet Middleware Services Even of you sign your zone according to the book, querying hosts that don't accept large responses due to them blocking fragments may cause you grief. This presentation outlines the issues you may encounter and provides guidelines for dealing with them based on research we are currently doing at SURFnet. [6] Followup to Plenary DNS Presentations (10 mins) COFFEE [7] YADIFA Update (10 mins) Peter Janssen, EURid [8] Knot Update (10 mins) Ondřej Surý, CZ.NIC [9] OpenDNSSEC Status Update (15 mins) Jakob Schlyter, OpenDNSSEC The soon-to-be-release version 1.4 and roadmap for version 2.0 (planned for release later in 2012) and beyond. [10] ATLAS measurements & tools (10 mins) Robert Kisteleki, RIPE NCC [11] Dense Anycast Deployment of DNS Authority Servers (20 mins) Dave Knight, ICANN A description of the wide-scale anycast deployment of L-Root by ICANN with a focus on operations and architecture. The presentation will include details of the platform, approaches for automating deployment, distributed configuration management, monitoring and measurement. [12] Panel discussion on DNSChanger (30 mins) [13] AOB

1 0

draft minutes from RIPE63
by Jim Reid 10 Apr '12

10 Apr '12

Colleagues, at long last here they are! Please send any corrections to dns-wg-chair(a)ripe.net.

1 0

draft agenda for RIPE64
by Jim Reid 05 Apr '12

05 Apr '12

Here's the draft agenda for the WG sessions in Ljubljana. It's not clear yet if there will be a report on the SATIN conference. Apart from that, no significant changes are expected. Though there may be the odd tweak to the running order. Have a nice Easter break and hope to see you all at RIPE64. # # $Id: agenda,v 1.6 2012/04/05 11:38:33 jim Exp $ # DRAFT AGENDA FOR RIPE64 - There may be last-minute tweaks [0] Usual administrivia (5 mins) [1] NCC Report (10 mins) A N Other, RIPE NCC [2] DNSSEC in .si (10 mins) Benjamin Zwittnig Observations and problems encountered during the preparations for .si signing, running a signed .si zone and future plans. [3] Dnssexy (15 mins) Willem Toorop, NLnetLabs Dnssexy (DNS SEc proXY) is a software-program to fortify DNSSEC availability. It operates as a bump in the wire between an hidden master and a public slave. It receives DNS-transfers from the hidden master, but only notifies the public slave when all records are properly assessed by means of a user defined programme. [4] Quality of DNS and DNSSEC in the .se zone (20 mins) Patrick Wallstrom, IIS As part of the Healthcheck programme in .SE, IIS have surveyed the .se zone for DNS quality and a more in-depth analysis of DNSSEC quality, looking at all DNSSEC related parameters and unexpected issues. [5] DNSSEC: dealing with hosts that don't get fragments (20 mins) Roland M. van Rijswijk, SURFnet Middleware Services Even of you sign your zone according to the book, querying hosts that don't accept large responses due to them blocking fragments may cause you grief. This presentation outlines the issues you may encounter and provides guidelines for dealing with them based on research we are currently doing at SURFnet. [6] Followup to Plenary DNS Presentations (10 mins) COFFEE [7] Report on SATIN conference? (10 mins) TBD [8] Knot Update (10 mins) Ondřej Surý, CZ.NIC [9] OpenDNSSEC Status Update (15 mins) Jakob Schlyter, OpenDNSSEC The soon-to-be-release version 1.4 and roadmap for version 2.0 (planned for release later in 2012) and beyond. [10] ATLAS measurements & tools (10 mins) Robert Kisteleki, RIPE NCC [11] Dense Anycast Deployment of DNS Authority Servers (20 mins) Dave Knight, ICANN A description of the wide-scale anycast deployment of L-Root by ICANN with a focus on operations and architecture. The presentation will include details of the platform, approaches for automating deployment, distributed configuration management, monitoring and measurement. [12] Panel discussion on DNSChanger (30 mins) [13] AOB

1 0

DOMAIN Object Syntax Review - Final Call
by Denis Walker 22 Mar '12

22 Mar '12

Dear colleagues, Now that all forward DOMAIN objects have been removed, the RIPE NCC is working on the action point from RIPE 62 that asked us to consider the attributes in DOMAIN objects. This topic has since been raised several times on RIPE working group mailing lists. There has been very little community response, which may suggest that these attributes are not important to anyone. After discussion with the Working Group Chairs, it has been agreed to send out a final call for comments. If there is no negative response, the syntax change outlined below will be implemented. Please send any comments to the DNS-WG mailing list before Monday, 2 April 2012. The proposal is to deprecate these attributes from the DOMAIN object: mnt-lower sub-dom dom-net refer We propose the following timeline for deprecating these four attributes: - Final mailing list comments by 2 April 2012 If there are no objections posted to the mailing list: - Announcement of the change at RIPE 64 - Change syntax for RIPE Database updates shortly after RIPE 64 - Notify maintainers of objects that include these attributes when syntax is changed - Cleanup of data by changing any instances of these attributes into "remarks:" by RIPE 65 Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

Migration of ns.ripe.net to new IP addresses
by Anand Buddhdev 12 Mar '12

12 Mar '12

Dear colleagues, The RIPE NCC allows users to use ns.ripe.net as a secondary DNS server for reverse zones of /16 IPv4 and /32 IPv6 address space. This name server has had the addresses 193.0.0.193 and 2001:610:240:0:53::193 for several years. We are now migrating all the secondary zones on this server to a new, modern cluster of servers. For this, we have to assign new addresses to ns.ripe.net. These new addresses will be: 193.0.9.6 2001:67c:e0::6 We will change the addresses tomorrow, 13 March. The TTL of the address records is currently six hours, so we expect that most DNS clients will be talking to the new server by the next morning. This change has one important consequence as far as NOTIFY messages are concerned. Our new DNS cluster is in an anycast prefix, so we do not transfer zones directly to any server in the cluster. We transfer zones to our provisioning server, and then transfer them to the cluster. If you wish to use DNS NOTIFY, please add the following IP addresses of our provisioning server to your notify list and allow zone transfers to these addresses: 193.0.0.198 2001:67c:2e8:5:53::6 If you do not send NOTIFY messages to our provisioning server, the zones will be refreshed based on the refresh timer in the SOA record of the zone. Finally, I would like to take this opportunity to remind users that the use of ns.ripe.net as a secondary server is not mandatory. You do not have to use it. If you have good DNS infrastructure and do not require ns.ripe.net as a secondary, you may remove it from your zone and from the domain object of that zone in the RIPE Database. If you have any other questions about this change of addresses, please send email to <dns(a)ripe.net>. Regards, Anand Buddhdev RIPE NCC

1 0

Wanted: DNS WG Agenda items
by Jaap Akkerhuis 06 Mar '12

06 Mar '12

Dear all, The RIPE meeting will be upon us soon. The website http://ripe64.ripe.net/ is up with the tentative programme, time to get you agenda proposals in for the DNS-WG meeting. Send them to this list or to the chairs <dns-wg-chair(a)ripe.net> directly. Remember, it is your working group and you meeting. Regards, jaap

1 0

Knot DNS v1.0.0 released
by Ondřej Surý 29 Feb '12

29 Feb '12

Hi all, I wouldn't normally crosspost this, but since it's our 1.0.0 version... So sorry for duplicates and please download, enjoy, awe, test and report bugs :). Thanks, Ondrej Begin forwarded message: > From: Lubos Slovak <lubos.slovak(a)nic.cz> > Subject: [knot-dns-users] Knot DNS v1.0.0 released! > Date: 29. února 2012 17:13:47 GMT+01:00 > To: knot-dns-users(a)lists.nic.cz > > Dear Knot DNS users, > > special days deserve special events and this day will surely be extraordinary not only for us, but for the whole DNS community. CZ.NIC Labs released first stable version of Knot DNS! > > Please visit our website http://www.knot-dns.cz for more information and all relevant links. > > Source files are available here: http://public.nic.cz/files/knot-dns/knot-1.0.0.tar.gz > (SHA256: ab947ff09655f44bd4106da65764810ff760b646b83e9b0939ee994f943372a6) > Packages will be available shortly from usual repositories. Instructions on how to setup them are available at http://www.knot-dns.cz. > > Lots of testing has been done in the past few weeks and we believe Knot DNS is as stable and bugfree as possible. Thank you all for support and feedback! > > We will continue developing Knot DNS - there is still place for a lot of optimizations, minor tweaks or new features, so stay tuned for next releases. > > Thank you again for using Knot DNS! -- Ondřej Surý vedoucí výzkumu/Head of R&D department ------------------------------------------- CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 -------------------------------------------

1 0

New on RIPE Labs: Tool to Measure K-root Performance
by Mirjam Kuehne 21 Feb '12

21 Feb '12

[apologies for duplicate mails] Dear colleagues, Please see this new article on RIPE Labs describing a tool that visualises the performance of K-root: https://labs.ripe.net/Members/csquarce/visualk Kind regards, Mirjam Kuehne RIPE NCC

3 5

Forward DOMAIN Object Cleanup and Syntax Changes
by Denis Walker 31 Jan '12

31 Jan '12

[Apologies for duplicate emails] Dear colleagues, At RIPE 57, the RIPE NCC was asked to remove all forward domain data from the RIPE Database. The last two ccTLD operators' data was removed today, 31 January 2011. The RIPE NCC can now confirm the completion of action point AP57.2 from the RIPE Database Working Group. At RIPE 62, the RIPE NCC was asked to look at the attributes in DOMAIN objects. With the removal of any hierarchy in reverse delegations and the removal of forward domain data, we no longer see any use case for the "mnt-lower:" attribute. Other attributes that it has been suggested were used only for forward domains are: - "refer:" - "sub-dom:" - "dom-net:" The statistics listed at the bottom of this email show how many of these attributes have been added to ENUM and reverse delegation DOMAIN objects. It has also been suggested that the "nserver:" optional attribute could be made a "required" attribute in reverse delegation DOMAIN objects. It could remain optional in ENUM DOMAIN objects or it could be disallowed. The RIPE NCC asked the community in July 2011 if anyone saw any justification for the use of these attributes in ENUM or reverse delegation DOMAIN objects. We did not receive any feedback on this. If there is no justification, the syntax of the DOMAIN object can be adjusted to deprecate these attributes. Then all current DOMAIN objects in the RIPE Database can be "cleaned" to remove this data. Business rules can be added to make the "nserver:" attribute required or disallowed in different types of DOMAIN objects, if this is considered useful. To keep the discussion focused, please send any comments or feedback to the DNS Working Group mailing list. Regards, Denis Walker Business Analyst RIPE NCC Database Group Statistics (as at July 2011) ---------- Number of each attribute used in reverse delegations or ENUMs and the number of unique maintainers who manage these objects. "refer:" = 6 unique maintainers = 1 "sub-dom:" = 271 unique maintainers = 23 "dom-net:" = 2,219 unique maintainers = 140 "mnt-lower:" = 46,485 unique maintainers = 4,208

2 1