- dns-wg - mailman.ripe.net

RIPE Community Requests that ICANN Signs DNS Root
by Axel Pawlik 14 Jun '07

14 Jun '07

[Apologies for duplicates.] Dear Colleagues, During the RIPE 54 Meeting in Tallinn, Estonia on 7 -11 October, the RIPE DNS Working Group agreed that a formal request should be made to the Internet Corporation for Assigned Names and Numbers (ICANN) for it to sign the DNS root as soon as possible. The working group formulated a statement and asked the RIPE community for endorsement during the closing plenary. The RIPE community unanimously supported this statement and, as a result, a formal letter of request was sent to ICANN. This letter, which includes the statement, can be viewed at: http://www.ripe.net/ripe/wg/dns/icann-root-signing.pdf Regards, Axel Pawlik Managing Director RIPE NCC

2 2

Secondary service on ns.ripe.net for reverse delegations.
by Brett Carr 05 Jun '07

05 Jun '07

As mentioned in my presentation at RIPE 54 last week we have become aware that there is an inconsistency between ipv4 and ipv6 with regard to obtaining reverse delegation. The reverse delegation procedure listed at http://www.ripe.net/rs/ reverse/reverse_howto.html has the following listed: -----snip Secondary Service by the RIPE NCC For IPv4: If your zone is a /16 reverse zone, you will need to set up ns.ripe.net as a secondary server For IPv6: If your zone is a /32 reverse zone, you may use ns.ripe.net as a secondary -----snip We think it would be a good idea to address this inconsistency, this could be done in several ways including but not limted to: Make ns.ripe.net mandatory on ipv4 and ipv6 delegations Make ns.ripe.net optional on ipv4 and ipv6 delegations Discontinue the secondary service on ns.ripe.net for new delegations. Our suggestion and preference would be to make ns.ripe.net optional on both ipv4 and ipv6 delegations. We would welcome and encourage input from the dns community on this subject. Regards Brett -- Brett Carr Manager -- DNS Services Group RIPE Network Coordination Centre Amsterdam

8 8

RIPE NCC Network Maintenance Thursday 07 June 1700-1900 UTC
by Mark Guz 04 Jun '07

04 Jun '07

[apologies for duplicates] Dear Colleagues, Between 17:00 and 19:00 (UTC/GMT) on Thursday, 07 June 2007, the RIPE NCC will carry out planned maintenance work on our network infrastructure. During this period, www.ripe.net and associated sites, ftp.ripe.net, whois.ripe.net and Authorative DNS services as provided by the RIPE NCC may be interupted. We apologise for any inconvenience that this may cause. If you have any questions about this, please e-mail ops(a)ripe.net Regards Mark Guz Senior Engineer Operations Department RIPE NCC

1 0

RIPE NCC Network Maintenance Wednesday 23 May 1700 - 1900 UTC/GMT - COMPLETED
by Mark Guz 24 May '07

24 May '07

Dear Colleagues, The above mentioned maintenance was performed successfully and within the specified maintenance window. If you have any questions about this, please e-mail ops(a)ripe.net Regards Mark Guz Senior Engineer Operations Dept RIPE NCC

1 0

RIPE NCC Network Maintenance Wednesday 23 May 1700 - 1900 UTC/GMT - COMPLETED
by Mark Guz 24 May '07

24 May '07

Dear Colleagues, The above mentioned maintenance was preformed successfully and within the specified maintenance window. If you have any questions about this, please e-mail ops(a)ripe.net Regards Mark Guz Senior Engineer Operations Dept RIPE NCC

1 0

RIPE NCC Network Maintenance Wednesday 23 May 1700 - 1900 UTC/GMT
by Mark Guz 21 May '07

21 May '07

Dear Colleagues, Between 17:00 and 19:00 (UTC) on Wednesday, 23 May 2007, the RIPE NCC will carry out planned maintenance work on our core network infrastructure. During this period all RIPE NCC services will suffer intermittent interruptions We apologise for any inconvenience that this may cause. If you have any questions about this, please e-mail ops(a)ripe.net Regards Mark Guz Senior Engineer Operations Dept RIPE NCC

1 0

Announcement DNS for LIRs Training Courses
by Rumy Kanis 21 May '07

21 May '07

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Friday 3 August 2007 Time: 09:00-17:00 Location: St.Petersburg, Russian Federation And Date: Friday 7 September 2007 Time: 09:00-17:00 Location: Nottingham, United Kingdom And Date: Friday 14 September 2007 Time: 09:00-17:00 Location: Amsterdam, Netherlands And Date: Wednesday 20 February 2008 Time: 09:00-17:00 Location: Vienna, Austria Hosted by: Nic.at: http://www.nic.at/ The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

Pointer to Proposal 2007-02: Change in IP Assignments for Anycasting DNS Policy
by Peter Koch 02 May '07

02 May '07

Dear All, for those of you not on the <policy-announce> mailing list, here's a pointer to a recent proposal for "Change in IP Assignments for Anycasting DNS Policy": <http://www.ripe.net/ripe/policies/proposals/2007-02.html>. The venue for discussion was chosen to be the address policy WG. Since we will have a full agenda in Tallinn and AP meets before DNS, there might be some I/O between the groups with little time for on-site discussion. Please consider this a "heads up". See you in Estonia, Peter

1 0

Agenda for RIPE54
by Jim Reid 24 Apr '07

24 Apr '07

Here is the agenda for the DNS WG sessions in Tallinn. This will be on the RIPE web site shortly. As always, items may be subject to last minute changes due to external circumstances. # # $Id: dnswgagenda,v 2.2 2007/04/24 14:00:20 jim Exp $ # [1] Administrivia (5 mins) [2] Review of Action Items (15 mins) [3] IETF WG news update (10 mins) Anton Verschuren, SIDN (TBC) [4] NCC Update (10 mins) Brett Carr, RIPE NCC [5] Proposal on rev-srv (10 mins) Peter Koch, DENIC [6] Finding a DNSSEC Trust Anchor (30 mins) Mats Dufberg, TeliaSonera In the absence of a signed root zone, DNS resolving risks of either being isolated (only for the local TLD) or cumbersome and error-prone (through the chasing for the latest key of all signed TLD's). It is in the interest of both ISP's and DNSsec if there would be one safe place with good reputation to get the keys from. We see RIPE NCC to be a good candidate to host such a trust anchor in co-operation with all registries of signed TLD's. Such a trust-anchor should be limited to TLD's and reverse tree. [7] Discussion time for EOF items (10 mins) Lunch Break [8] IDN progress at ICANN (5 mins) Leo Vegoda, ICANN [9] OARC News & DNS DDoS Followup (10 mins) Keith Mitchell, OARC [10] Traffic analysis the .SE way using DNS2DB. (25 mins) Niclas Rosell, NIC-SE DNS2DB is a newly developed tool for analyzing dns-data. It converts raw pcap-files with dns-traffic to Sqlite-databases which then can be used to dig into and analyze the traffic. This presentation will demonstrate this tool and show how it's used in the daily work at the cctld .se. [11] Anycast experiences in Japan (15 mins) Shinta Sato, JPRS In the presentation, the experience of the test run of the new anycast site is shown. Through the presentation, what the actual TLD operators are doing for its measurement is briefly described. [12] AOB/General Discussion (5 mins)

1 0

What about the last mile, was: getting DNSSEC deployed
by Roy Arends 06 Apr '07

06 Apr '07

Kudo's to TDC Song, C&W and others. Real nice they're validating data. So what about joe end user. Are there initiatives to offer tsig/sig0/dtls between user and isp ? Are there initiatives to deploy code at the OS level, similar as to what the NLNetLabs and Sparta folk are building for the application level ? Are formentioned providers deploying either of these two sets of solutions to their end users ? Or is it all just security theater ? Bring dns validation to where dns requests are initiated and where it is consumed; at the end user. That part is still vulnerable to spoofing while we're trying to secure the invisible infrastructure. Note that with end user validation, and well established methods to update the end users' certificate store, we might be well on our way. See also: http://dnss.ec/blog/?p=10 Sure, signing the root is crucial, and I'm not convinced dlv is a viable alternative, but thats all meaningless if layer 6/7 don't get some fondling. Roy

14 49