- dns-wg - mailman.ripe.net

A proposal from RIPE DNS Working Group
by Antonio_Blasco Bonito 31 Oct '95

31 Oct '95

Dear Artur Romao, I'm glad to contact you, acting on request of the ripe dns working group which, during the last RIPE meeting in Amsterdam, discussed about DNS failures and made a proposal as stated in the following excerpt from the minutes: {...} Some people do not watch their name servers: it happens that some name servers are left unattended and fail without anyone noticing. This has an impact on the performance and reliability of the overall name service. People should watch their name servers and their zones on their primary and secondaries. At least the 'host' command can be used with the '-C' option to do this at regular intervals. During the plenary session someone remembered the existance of RFC1713 A. Romao, "Tools for DNS debugging", which is usually referred to as the guide for DNS administrators and suggested to ask the author to include such recommendation. [ACTION on ABB] {...} ---------- ---------- Antonio_Blasco Bonito E-Mail: bonito(a)nis.garr.it GARR - Network Information Service c=it;a=garr;p=garr;o=nis;s=bonito c/o CNUCE - Istituto del CNR Tel: +39 50 593246 Via S. Maria, 36 Fax: +39 50 904052 I-56126 PISA Telex: 500371 CNUCE I Italy Url: http://www.nis.garr.it/nis/staff/bonito.html ---------- ----------

1 0

Draft minutes of ripe22-dnswg
by Antonio_Blasco Bonito 30 Oct '95

30 Oct '95

Better late than never... Here are the drafts minutes scribed by Benoit Grange and edited by me. Please send corrections/additions to the list before 951110. ---------- ---------- Antonio_Blasco Bonito E-Mail: bonito(a)nis.garr.it GARR - Network Information Service c=it;a=garr;p=garr;o=nis;s=bonito c/o CNUCE - Istituto del CNR Tel: +39 50 593246 Via S. Maria, 36 Fax: +39 50 904052 I-56126 PISA Telex: 500371 CNUCE I Italy Url: http://www.nis.garr.it/nis/staff/bonito.html ---------- ---------- --------------------cut here------------ DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT RIPE 22 DNS Working Group minutes Amsterdam 12 October 1995 Chairman: Antonio Blasco Bonito (ABB) Scribe: Benoit Grange (BG) Preliminaries ------------- Rob Blokzijl presented the apologies from the working group chairman, Leonid Yegoshin (LY), who had a visa problem and asked ABB to chair the group. The agenda was reorganized and agreed. 1) Reports about DNS Failures -------------------------- [This item should have been covered by LY, but because he was not there some of us reported current problems] BG talked about the known problem with uncesessary glues that appear in zone transfers. This happens on most old implementations (BIND prior to 4.9) as shipped my most of the vendors. DNS Operation suffer from old implementation that have known bugs and proble ms. The usual suggestion is to install a recent version of BIND, which happens to be a beta version. It was noted that, altough that effectively eliminates the problem, many DNS administrators are not willing to use a beta version. The working group agreed on sending a letter to the ISC to ask to put BIND 4.9.3 in final so that doubts about it are solved. [ACTION on ABB] Many expressed concern about how delegation changes are done at the Internic. Today Internic accepts any change to current delegation (normal and reverse) and also to glue records. This leads to situation where some bad data is introduced, either as an error, or as some malicious action. Eg: 'ns.ripe.net' (193.0.0.193) is primary for 'ripe.net' and a lot of important zones. John Doe wants to create a 'johndoe.com' zone and submits a request to Internic mentionning both 'banana.johndoe.com' (198.1.2.3) as primary and 'ns.ripe.net' with a WRONG address 193.0.0.93 because of a typo. Internic creates the 'johndoe.com' zone and CHANGES the glue record for 'ns.ripe.net'. All delegations to 'ns.ripe.net' are affected because Internic accepted unnecessary glue record from John Doe and blindly accepted to change an existing name server IP address. The working group recommends that Internic does not accept unneccessary glue records and double checks any change to existing glue records. [ACTION on Geert Jan de Groot] Some people do not watch their name servers: it happens that some name servers are left unattended and fail without anyone noticing. This has an impact on the performance and reliability of the overall name service. People should watch their name servers and their zones on their primary and secondaries. At least the 'host' command can be used with the '-C' option to do this at regular intervals. During the plenary session someone remembered the existance of RFC1713 A. Romao, "Tools for DNS debugging", which is usually referred to as the guide for DNS administrators and suggested to ask the author to include such recommendation. [ACTION on ABB] 2) 'in-addr.arpa' automatic checking and delegation (D. Kessens) ------------------------------------------------------------- David briefly talked about the tool he wrote which is being used at RIPE- NCC. This tools checks if the reverse zone is correctly configured as per RIPE requirements. Usage: Send an e-mail message to 'auto-inaddr(a)ripe.net' containing the 'inet-num' object with 'rev-svr:' attributes listing the desired name servers (1 name server per line). Send an empty message to get help. The final editing of the zone file is still done manually and the operators also checks the author of the update. After a short discussion the group agreed that some authentication mechanism be added in order to avoid malicious changes to current delegation, specially when the reverse delegation process will be completly automated. [ACTION on RIPE-NCC] This tool could also be used to check for normal delegations, but only after some rewriting because some of the checks are specific to reverse delegation or RIPE requirements. Sources are on ftp://ftp.ripe.net/tools/inaddrtool-VERSION Another tool to check delegation exist under http://www.nic.fr/ZoneCheck Sources of this tool will be freely available by the end of the year. [ACTION on BG] 3) Future developments of the name servers --------------------------------------- It was reported that: Paul Vixie got RU-BIND and will somehow merge the two programs. IBM has donated code to do dynamic updates, and an other source is available as well. 4) About the recent changes of the root name servers ------------------------------------------------- All root name servers have been renamed as '<letter>.root-servers.net'. If you want to know the "old name" of a name server, query for the TXT record associated with the name. A new primary for the root zone will be created and managed directly from IANA, and the primary for the '.com', etc. zones will remain managed by Internic. 5) Charging for domain names, etc. ------------------------------- A European 'TLD' forum might be useful, and the first move should be to collect how TLD management is done over Europe. Different countries have different policies, etc. Some multinational company which wants to create a bunch of domains in different countries needs more information on how this can be done and who should be contacted. The working group decided to set up a questionnaire and Guy Davies (GD) collected a lot of questions. He will organise the questionnaire and submit it to the list for review and later send it to the European TLD admins. [Action on GD] DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT-DRAFT

5 8

list of European/Southern & Eastern Mediterranean countries
by Guy Davies 27 Oct '95

27 Oct '95

Hi All, This is the list of Countries to which I have sent the questionnaire. It is based on the list in The Whole Internet... and includes those countries in Europe, on the Eastern and Southern Coast of the Mediterranean and those I recognised from the former Soviet Union. 'al','dz','ad','am','at','az','by','be','ba','bg','hr','cy','cz','dk','eg','ee', 'fo','fi','fr','ge','de','gi','gr','gl','hu','is','ie','il','it','kz','kg','lv', 'lb','ly','li','lt','lu','mk','mt','md','mc','ma','nl','no','pl','pt','ro','ru', 'sm','sk','si','su','es','se','ch','tj','tn','tr','tm','ua','uk','uz','va','yu' If anyone knows of a country I have missed, please do not be offended. Tell me who it is and I will send the SOA a copy of the questionnaire. :-) Regards, Guy Davies tel: 01223 250122 ---------- fax: 01223 250121 Network Support Engineer email: guyd(a)pipex.net Unipalm PIPEX url: http://www.pipex.net 216 Cambridge Science Park, Milton Road, Cambridge, CB4 4WA

2 1

Final version of BIND
by zsako＠banknet.net 24 Oct '95

24 Oct '95

Hello everybody, You probably remember the discussion at the 22nd RIPE meeting about trying to get a "final" version of BIND, that could be recommended for everybody to use. It seems it is not possible yet. :( Regards, Janos ----- Begin Included Message -----

1 0

Re: Latest version of BIND
by paul＠vix.com 24 Oct '95

24 Oct '95

>Does anybody know about the release date for the FINAL version of >bind-4.9.3. If so, please email it to me at ali(a)protosoft.com. there will be at least another beta. -- Paul Vixie La Honda, CA "Illegitimibus non carborundum." <paul(a)vix.com> pacbell!vixie!paul ----- End Included Message -----

1 0

TLD Questionnaire
by Guy Davies 15 Oct '95

15 Oct '95

Hello All, Here's the first draft for the TLD questionnaire. I propose to send it to the SOA for each European TLD with a note to forward it to the SOA for any neutral subdomains (e.g. co.uk, ac.at) as they are more likely to be aware of the day to day running of the domains available for use by the 'public'. If anyone has any objections or modifications, please contact me and I'll try to include them. If I hear nothing by the end of next week (20th October), I'll send the questionnaire unaltered. If anyone has a list of *all* the European TLDs, please send me a copy so I can mail all the SOAs. Regards, Guy Davies tel: 01223 250122 ---------- fax: 01223 250121 Network Support Engineer email: guyd(a)pipex.net Unipalm PIPEX url: http://www.pipex.net 216 Cambridge Science Park, Milton Road, Cambridge, CB4 4WA -------------------------------------------------------------------------- DNS Questionnaire ================= 1. Who defines your policies? 2. How do you establish your naming policies? 3. What legal status, if any, do your decisions/policies have? 4a. Would you register sub.tld (e.g. co.uk, ac.uk etc)? b. Do you have geographic subdomains in the tld (e.g. state.tld, county.tld)? c. If so, how do you split your tld? 5a. Would you register domain.tld (e.g. microsoft.uk)? b. Would you register domain.sub.tld (e.g. microsoft.co.uk)? 6a. Do you allow individuals to register names or just organisations? b. If you differentiate between individuals and organisations, what are your criteria? 7a. Do you require proof of identity? b. If so, how do you prove the identity of a requestor? 8. Do you register domains only for organisations/individuals located in your country or do you allow anyone to register in your tld? 9a. Do you allow a single organisation to register more than one domain? b. If so, do you limit the number of domains registered by a single organisation? 10a.To whom would you allocate well known names like digital.tld/ digital.sub.tld? b.What criteria do you use when deciding whether or not to allow a name? 11a.How do you arbitrate between two or more claims to the same name? b.Who is responsible for the arbitration? 12a.Do you allow the registration of geographical names (cities, countries, rivers, etc)? b.If so, would you register one for an individual organisation? 13a.Do you have any names which may not be registered (e.g. names in bad taste, names of protocols, etc)? 14a.Do you run secondary nameservice for subdomains of the tld? b.If so, is this optional/mandatory and do you charge for the service? 15a.Do you check for a running nameserver at the time of request? b.Do you check for a running nameserver at regular intervals after the name has been delegated? 16. Do you allow the reservation of names (i.e. no running service)? 17a.Do you charge for reservation/registration of names? b.If so, is it a one off fee, an annual subscription or both? c.How much is the fee? 18a.Do you remove unused domain names? b.If so, how do you define an unused domain? 19. Do you think that the current system you operate will be changed over the next 12 months? 20. Do you accept requests for domains from providers only, from anyone or from a different group only? 21. What resources are allocated to the administration of the domain? 22. Do you have any automation of the registration/delegation process?

1 0

RIPE 22 agenda proposal
by egoshin＠ihep.su 27 Sep '95

27 Sep '95

Hello All, I can suggest the following questions for discussion in nearest RIPE 22 on DNS WG. It is only my opinion, and any comments, proposal and objections are approved. 1. DNS failures. Report about some results of problem investigation. - I can do some short report. - Also it would be beautifull if somebody (from CH?) can comment the last situation about invalid A RR of one root server, I don't have detail information yet. 2. Directions of DNS development. During last IETF I met with Paul Vixie and we have some talk about possible directions of DNS development. I can report about this (DNS v2 ?). 3. Domain name payment. Consequences and problems for cooperation and DNS. It is about last decision of .XXX domain payment. Regards, - Leonid Yegoshin, LY22

1 0

Re: DNS Problem
by Mike Norris 15 Sep '95

15 Sep '95

On Mon, 11 Sep 1995 11:39:26 +0200 Willi Huber <huber(a)chx400.switch.ch> said: >Dear all, > >there seems to be a DNS problem regarding the root name servers. We >(that means the ch top-level DNS server) has picked up several times >now a false A record for E.ROOT-SERVERS.NET. The address picked up is binary >zero. A restart only helps for a short time. Other top-level DNS servers >contain the false entry as well. Are there any recommendations for hostmasters of (1) top-level domains and (2) subsidiary domains? Should all be using the new A, B, C etc list of root-level servers? Many thanks. Mike Norris

4 8

Re: DNS Problem
by e07＠nikhef.nl 15 Sep '95

15 Sep '95

> BTW, 'dig . txt' gives an empty response. Don't know > what to think of that... :-) I know what to think of that. See my message of yesterday on the ripe-list. (Sorry, couldn't resist :-) -- Eric

1 0

Re: DNS Problem
by e07＠nikhef.nl 15 Sep '95

15 Sep '95

> in the old situation one could see at first glance > where a root server is located. With the ABC list > system that's no longer possible. It is at second glance. -- Eric [] for SERVER in A B C D E F G H I [] do [] host -t txt ${SERVER}.root-servers.net [] done A.root-servers.net TXT "formerly ns.internic.net" B.root-servers.net TXT "formerly ns1.isi.edu" C.root-servers.net TXT "formerly c.psi.net" D.root-servers.net TXT "formerly terp.umd.edu" E.root-servers.net TXT "formerly ns.nasa.gov" F.root-servers.net TXT "formerly ns.isc.org" G.root-servers.net TXT "formerly ns.nic.ddn.mil" H.root-servers.net TXT "formerly aos.arl.army.mil" I.root-servers.net TXT "formerly nic.nordu.net"

2 1