- dns-wg - mailman.ripe.net

Agenda for RIPE 57
by Jim Reid 15 Oct '08

15 Oct '08

Colleagues, here's the agenda for the Dubai RIPE meeting. I hope to see you there! Tuesday Afternoon Administrivia (5 mins) Review of Action Items (10 mins) ICANN/IANA Update (15 mins) Kim Davies, IANA Discussion on NTIA DNSSEC NoI (20 mins) Etisalat DNS Operational Experiences (10 mins) Abdulla Bushlaibi, Etisalat A description of Etisalat's experience in the field of implementing DNS services, across different type of services and requirements. It explains past, present and future plans for DNS architecture in Etisalat, considering network convergence as well as expansion. It describes problems and challenges on the way and some solutions. A versatile platform for DNS metrics with its (30 mins) application to IPv6 penetration Stephane Bortzmeyer, AFNIC AFNIC is developing a DNS-based measurements & statistics project in order to monitor the evolution of an open list of technical activities (IPv6, DNSSEC, EDNS0 support, SPF & DKIM deployment...). The project started with IPv6 penetration measurements and an overview of the results based on collected DNS data from .fr is presented. Wednesday Morning IETF WG news update (15 mins) Lars-Johan Liman, Autonomica NCC Update (15 mins) Anand Buddhdev, RIPE NCC (TBC) Discussion on stale domain objects (15 mins) Peter Koch, DENIC .org's Next Steps with DNSSEC (20 mins) Lance Wolak, PIR This described how .ORG has initiated an industry coalition to streamline the implementation of DNSSEC through the collaborative development of specific educational material, common tools and implementation guides. IDN GCC trial project (15 mins) Amani Mohammed Bin Sewaif, Etisalat The presentation will focus on how the DNS aspects of the IDN trial project that has been implemented among the GCC countries. It explains the initial discussion/requirements for the DNS architecture to serve the trial,what approaches were considered and the final setup. It will briefly show how it works, and elaborate on the tools developed for the community as well as point to other resources/work done in this project. Followup on NTIA DNSSEC NoI (5 mins) AOB/General Discussion (5 mins)

1 0

NTIA consultation on DNSSEC
by Jim Reid 09 Oct '08

09 Oct '08

Colleagues, the NTIA (the bit of DoC which oversees changes to the root zone) has just announced a consultation on the deployment of DNSSEC. I quote: "Commerce’s National Telecommunications and Information Administration (NTIA) today issued a Notice of Inquiry seeking public comments regarding the deployment of Domain Name and Addressing System Security Extensions (DNSSEC) into the Internet’s DNS infrastructure, including the authoritative root zone. " Further details are at: http://www.ntia.doc.gov/press/2008/DNSSEC_081009.html . Perhaps the WG would like to formulate a response to this consultation? I would also like the WG to give an indication if we should allocate some time at RIPE57 to discuss this consultation and any possible response to it.

2 1

Reverse DNS lameness alerts
by Anand Buddhdev 01 Oct '08

01 Oct '08

[Apologies for duplicate emails] Dear Colleagues, Some of you received email messages last month from the RIPE NCC with alerts about lame DNS servers. These messages were generated as part of the RIPE NCC's DNS lameness project. Unfortunately, the alerts were not entirely correct, and showed all the servers of some reverse zones as lame. This was caused by programming errors in the software that produced the messages. We have identified these errors, and we are correcting them. We are also introducing additional tests and safeguards to improve the quality of our DNS lameness measurements. For more information on the RIPE NCC's DNS lameness project, please see: http://www.ripe.net/info/stats/dns-lameness/ Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

Re: [dnssec-deployment] [dns-wg] Announcement: Test Report on DNSSEC impact on SOHO CPE
by Steve Crocker 16 Sep '08

16 Sep '08

Thanks. Steve On Sep 16, 2008, at 2:55 PM, Ray.Bellis(a)nominet.org.uk wrote: >> The report is excellent. Thank you very much for sharing it with us. > > You're welcome :) > >> I have two questions. >> >> 1) Vendor actions >> >> What are the vendor status and/or responses? Were they contacted? > did they >> respond? Are they planning updates? > > We did contact vendor technical support, in particular to determine > whether any work-arounds exist on those routers that don't appear > to allow > the DNS settings in the DHCP server to be changed. > > However attempts to reach product management types to talk about > implementation issues were generally fruitless. I did manage to > report my > findings to Zyxel UK through an existing contact, though. > > I'm hoping that some of the vendors will get in touch with me, now > that > the report is published. > >> 2) base OS? >> >> Is there a similarity in these firmwares? eg are they using >> the same >> DNS software inside? Perhaps the vendors are not the people we > should >> be talking to? For instance, many Linux based routers use the > "dnsmasq" >> software. Depending on its status, it might be worth >> contacting the >> upstream software provider of the commercial router vendors. > > We didn't see any direct evidence of shared code between vendors. > We did > see some quirks that might suggest commonality (e.g. NAT tranlation > failures) but didn't look for anything to prove a link. > > kind regards, > > Ray > > -- > Ray Bellis, MA(Oxon) > Senior Researcher in Advanced Projects, Nominet > e: ray(a)nominet.org.uk, t: +44 1865 332211 > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <dnssec-deployment(a)shinkuro.com>. > To unsubscribe, E-mail to: <dnssec-deployment-off(a)shinkuro.com> > A public archive is available here: <http://mail.shinkuro.com:8100/ > Lists/dnssec-deployment/> > and older material is at > <http://mail.shinkuro.com:8100/Lists/dnssec-deployment-archive/>

1 0

Announcement: Test Report on DNSSEC impact on SOHO CPE
by Ray.Bellis＠nominet.org.uk 16 Sep '08

16 Sep '08

[with apologies for the cross-postings to multiple lists] Dear Colleagues, We would like to announce the publication of a joint study entitled "DNSSEC Impact on Broadband Routers and Firewalls", available for download at: http://download.nominet.org.uk/dnssec-cpe/DNSSEC-CPE-Report.pdf In summary (based on 24 tested units): "... we conclude that just 6 units (25%) operate with full DNSSEC compatibility "out of the box." 9 units (37%) can be reconfigured to bypass DNS proxy incompatibilities. Unfortunately, the rest (38%) lack reconfigurable DHCP DNS parameters, making it harder for LAN clients to bypass their interference with DNSSEC use. These findings, their potential impact on DNSSEC use by broadband consumers, and implications for router/firewall manufacturers, are presented and analyzed in this report. " Ray Bellis Senior Researcher in Advanced Projects Nominet UK Lisa A. Phifer President, Core Competence, Inc.

2 2

Agenda items for RIPE57
by Jim Reid 09 Sep '08

09 Sep '08

It's that time again... The next RIPE meeting is just over 6 weeks away. So it's about time an agenda was put together for the WG sessions in Dubai. Could you please send suggestions for agenda topics and/or presentations to dns-wg-chair(a)ripe.net ? Thanks.

1 0

Upgrade of the reverse DNS provisioning system at 8 September 2008, between 09:00 and 12:00 (UTC)
by Wolfgang Nagele 03 Sep '08

03 Sep '08

[Apologies for duplicate emails] Dear Colleagues, On 8 September 2008, between 09:00 and 12:00 (UTC), the RIPE NCC will upgrade the reverse DNS provisioning system. This change will enable the server ns.ripe.net to perform zone transfers over IPv6. If your reverse zone has a master server with an IPv6 address, this will be used in preference to the IPv4 address after the change. We apologise for any inconvenience this change may cause. If you have any questions or concerns about this, please email <dns-help(a)ripe.net>. Regards, -- Wolfgang Nagele DNS System Engineer RIPE NCC Singel 258 1016 AB Amsterdam Tel: +31 20 535 4444 Fax: +31 20 535 4445

1 0

Signed .cz zone
by Ondřej Surý 02 Sep '08

02 Sep '08

Hello all, we have signed .cz on Sep 1st 2008. Key can be found at https://www.nic.cz/dnssec/ (bottom of the page). EPP interface for registering DS RRsets will be launched on Sep 30 2008. Please report any errors (hope there are none) or sugestions to my address. Regards, -- Ondřej Surý technický ředitel/Chief Technical Officer ----------------------------------------- CZ.NIC, z.s.p.o. -- .cz domain registry Americká 23,120 00 Praha 2,Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ sip:ondrej.sury@nic.cz tel:+420.222745110 mob:+420.739013699 fax:+420.222745112 -----------------------------------------

1 0

Planned maintenance on ns.ripe.net, 2 Sept.
by Sjoerd Oostdijck 01 Sep '08

01 Sep '08

[Apologies for duplicate e-mails.] Dear Colleagues, On Tuesday, 2 September 2008, the RIPE NCC will perform maintenance on the ns.ripe.net server between 10:00 and 12:00 (UTC). During this period, it may not be able to answer DNS queries. The aim of this maintenance is to introduce a second server to improve performance of the system. If ns.ripe.net provides secondary DNS name service for your zone, no changes on your side will be required. During the maintenance, other servers in your NS set will take over and no downtime will be visible to the Internet. We apologise for any inconvenience this maintenance may cause. If you have any questions or concerns about this, please email dns-help(a)ripe.net Regards, Sjoerd Oostdijck DNS Services The RIPE NCC

1 0

Subdomain Add Question
by Bill Honneus (honneus) 09 Aug '08

09 Aug '08

Hi, I have a domain hosted at a third party site called my.domain.com. In my company's zone file, we have NS records that refer to this third party hosting site, and we have an 'A' record set up that associates the my.domain.com domain to the IP address of a load balancer that balances traffic coming into the site between two web servers, all in a DMZ. We also have an MX record that refers the my.domain.com to a mail server host, also in the DMZ. Finally, we have PTR records that refer back to the load balancer and mail server hosts. All this is set up correctly, everything works, and all DNS checks pass. I need to add a subdomain, call it sub.my.domain.com, and I would like to associate the subdomain to the same load balancer if possible. What is the best way to do this without disrupting the incoming traffic to the primary domain or the flow of incoming SMTP traffic to the mail server? Is it best in this situation to use a CNAME to map the subdomain, or to use a whole new 'A' record? If I create a new 'A' record, I would not want to add a new PTR record for the sub.my.domain.com as the IP address would be the same as the PTR that refers back to my.domain.com. This I believe, would cause DNS checks on my mail server to fail, since there would be two hostnames associated with the same IP address. Your help is appreciated! Bill

2 1