- dns-wg - mailman.ripe.net

another concern over naming
by Jim Reid 06 Oct '10

06 Oct '10

Colleagues, I wonder if we've overlooked this rather important concern about the use of hyphens in domain name labels? http://forum.icann.org/lists/name-numbers-and-hyphens-domains/msg00000.html

2 1

Decommissioning of the RIPE NCC Reply-size Tester
by Anand Buddhdev 05 Oct '10

05 Oct '10

[Apologies for duplicates] Dear Colleagues, In December 2009, the RIPE NCC made a reply-size tester available to the community. The purpose of this was to allow users to test their networks for path MTU related issues and to help them prepare for the roll-out of a signed root zone. We installed the reply-size server component on a temporary basis at the global instances of K-root to allow testing against an actual root server instance. We collected some statistics and published some interesting research on the RIPE Labs website: http://labs.ripe.net/Members/dfk/content-measuring-dns-transfer-sizes-first… A signed root zone has been published since 15 July 2010, and we feel that the reply-size tester has served its function. We are therefore going to decommission it on Monday, 11 October 2010. If you wish to continue testing networks for path MTU issues, we recommend that you use the reply-size tester of DNS OARC: https://www.dns-oarc.net/oarc/services/replysizetest Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

OpenDNSSEC training
by Rickard Bellgrim 04 Oct '10

04 Oct '10

Hi OpenDNSSEC have now been deployed at six TLD:s (.dk, .fi, .fr, .nl, .se, and .uk) and ICANN. We are therefore continuing our effort on giving two-day training courses. You can select from two dates 1-2 November and 29-30 November. Please read the attached PDF and get back to me if you are interested. // Rickard Bellgrim

1 1

2nd DNS WG slot at RIPE61 rescheduled
by Peter Koch 04 Oct '10

04 Oct '10

Dear DNS WG, several WG members pointed out the undesirable scheduling conflict between the Anti-Abuse WG and the 2nd DNS WG slot for the Rome meeting. Thanks to the cooperation of other WGs this could be resolved and the overall situation hopefully improved. We have switched places with ENUM, i.e. DNS moved from Thu 1400-1530 to Tue 1600-1800. The full meeting plan is available at <http://www.ripe.net/ripe/meetings/ripe-61/meeting-plan.html> Also, please allow me to repeat our call for contributions: If you'd like to present a topic relevant to the DNS (or domain names) in operations, technology, research and/or policy, please contact the WG chairs at <dns-wg-chair(a)ripe.net>. Regards, Peter

1 0

RIPE-61 coming up
by Jaap Akkerhuis 23 Sep '10

23 Sep '10

All, Yes, it sneaks up on you before you know. Please send in your suggestions and requests for agenda time. It is your working group after all and your chairs don't want to dctate al the entertainment, pardon, the agenda items. The Draft meeting plan is already up <http://www.ripe.net/ripe/meetings/ripe-61/meeting-plan.html> and you can see that the DNS-WG is oppoiste the EIX and the Anti-Abuse WG. In case your suggestions etc. clash with that let us know which slot is preferred. jaap

3 3

Postponement of DNSSEC KSK Roll-over for RIPE NCC Zones
by Anand Buddhdev 22 Sep '10

22 Sep '10

[Apologies for duplicates] Dear colleagues, Yesterday, 21 September, we were scheduled to perform a roll-over of Key Signing Keys (KSKs) of all our signed zones. However, during the roll-over we had some issues with our signing infrastructure, which caused some zones to be generated with expired signatures. We therefore rolled back to the state before the roll-over. In order to allow proper resolution of the problems we encountered, we are delaying our roll-over to the end of October. We will announce a new date before the event. Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

Publicering av .SE:s DS-poster i rotzonen/Putting .SE's DS records into the root zone
by Anne-Marie Eklund-Löwinder 30 Aug '10

30 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Information in English will follow. Publicering av .SE:s DS-poster i rotzonen Med anledning av att rot nu är signerad har .SE lagt till sina DS-poster till rotzonen. Detta innebär rent tekniskt inga omedelbara problem för de som använder .SE som tillitsankare (Trust Anchor). Det gör det dock möjligt för den som så vill att byta till rot som tillitsankare för DNSSEC, något som vi rekommenderar att göra före nästa årsskifte då .SE kommer att rulla nycklar för DNSSEC enligt våra normala rutiner. Som en följd av att vi lägger våra DS-poster i rotzonen kommer .SE även att ta bort dem ur IANA:s ITAR. ITAR är en interimslösning som har fungerat väl för sitt syfte innan roten signerats, men fyller för vårt vidkommande nu ingen roll. DS-posterna kommer att tas bort från ITAR 30 dagar efter att de har publicerats i rotzonen. Vi råder er att prenumerera på meddelanden från dnssec-announce(a)lists.nic.se för att få information om viktiga förändringar av DNSSEC i .SE. Eventuella frågor kan ställas till dnssec-info(a)iis.se. Anne-Marie Eklund Löwinder Kvalitets- och säkerhetschef .SE (Stiftelsen för Internetinfrastruktur) Adress: Ringvägen 100 Postadress: Box 7399, 103 91 Stockholm Växel: 08-452 35 00 Direkt: 08-452 35 17 Mobil: 0734-31 53 10 E-post: anne-marie.eklund-lowinder(a)iis.se Webbplats: http://www.iis.se Putting .SE’s DS records into the root zone Since the root zone is now signed, .SE has submitted its DS records to the root zone. From a technical view this should not affect anyone using .SE as Trust Anchor. It will, however, make it possible to switch to using the root as Trust Anchor for DNSSEC. We recommend that you make this switch before the turn of the year when .SE’s next DNSSEC key rollover is scheduled to occur. As we publish our DS records in the root zone, we will remove them from IANA’s ITAR. ITAR is a temporary solution that served our needs well while the root zone was not signed, but it is to our concern no longer necessary. The DS records will be withdrawn from ITAR 30 days after they have become available in the root. We do advice you to subscribe to the dnssec-announce(a)lists.nic.se mailing list to get notified about key rollovers and any other important changes regarding DNSSEC in .SE. Questions may be addressed to dnssec-info(a)iis.se. Anne-Marie Eklund Löwinder Quality & Security Manager .SE (The Internet Infrastructure Foundation), PO Box 7399, SE-103 91 Stockholm, Sweden Phone: +46 (0)8-452 35 00/17 Mobile: +46 (0)734 315 310 E-mail: anne-marie.eklund-lowinder(a)iis.se Web: http://www.iis.se -----BEGIN PGP SIGNATURE----- Version: 9.8.3 (Build 4028) Charset: utf-8 wj8DBQFMe3h+pdzwAUKxz5QRAqmlAJ9A9sLTuwtTqm0nhxzZ6uT8i1ndIACg1KoL 1xLrob4+MeHAhfK2M7JrO6s= =qZP1 -----END PGP SIGNATURE-----

1 0

Health of Domain Name system report
by Kostas Zorbadelos 25 Aug '10

25 Aug '10

A lot of people in here might be aware of this, but I think it is interesting enough to share it :) http://www.enisa.europa.eu/media/news-items/health-of-domain-name-systems-r… Kostas Zorbadelos

1 0

DNSSEC and DNS slowdown
by Max Tulyev 30 Jul '10

30 Jul '10

Hello! I have a strange problem. When I enable DNSSEC in my resolver (bind 9) - it slows down in several times. What do I do wrong? Or may be it is a feature? -- WBR, Max Tulyev (MT6561-RIPE, 2:463/253@FIDO)

3 2

ACTION REQUIRED: Comment to US DoC NTIA on Signing the Root
by Daniel Karrenberg 30 Jun '10

30 Jun '10

Folks, it has come to my attention that the US government is still looking for comments about the plan to sign the root. We have said we want to see this happen before, but they apparently want to hear it again. So if you want to see this happening soon, please send them a note, however short. The relavant notice is attached. Written comments may be submitted by electronic mail to DNSSEC(a)ntia.doc.gov. I would recommend copying Ashley Heineman at aheineman(a)ntia.doc.gov. If you have questions, Ashley can be reached at +1 202 482?0298. Daniel

1 1