- dns-wg - mailman.ripe.net

Action Item 48.4 (AAAA anomalies) Last Call
by Peter Koch 30 Oct '06

30 Oct '06

Dear WG, action item 48.4 reads <http://www.ripe.net/ripe/wg/dns/dns-actions.html>: Write up a draft RIPE Document summarising the observations made regarding AAAA resolution problems. Circulate to the list, initiate discussion what to do, i.e. who to approach with the list of errors/problems seen. After the presentation given by Dave Wilson (stepping in for David Malone) <http://www.ripe.net/ripe/meetings/ripe-53/presentations/aaa.pdf>, and also judging from the previous discussion, the majority of the wg seemed to agree that a separate RIPE document would not be necessary. David had already published his findings in the publicly accessible Cisco IPJ, volume 8.1 <http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_8-1/ipj_8-1.…> The wg chairs would like to thank David and Dave for their work and contributions and propose this AI be considered done. If you disagree, please speak up until October, 27th, preferrably with identification of any issue(s) you feel still need to be addressed. My understanding is that David is happy to continue his monitoring efforts, but as far as the WG is considered, the goal of raising awareness has been achieved. -Peter PS: Silence will be taken as consent.

1 1

DNS WG Action Items 52.2 and 52.4 closed
by Peter Koch 12 Oct '06

12 Oct '06

Dear WG, action items 52.2 and 52.4 <http://www.ripe.net/ripe/wg/dns/dns-actions.html> will now be marked "done": 52.2 RIPE NCC Report number of signed zones and signed delegations in the reverse tree. Addressed in the thread starting at <http://www.ripe.net/ripe/maillists/archives/dns-wg/2006/msg00151.html> as well as the presentation given at RIPE 53 <http://www.ripe.net/ripe/meetings/ripe-53/presentations/ncc_dnswg_update.pdf> The NCC agreed to continue collecting and reporting of statistics. 52.4 RIPE NCC Automate and streamline the process for ENUM delegations, including checks similar to those applied to the reverse tree. Reported in <http://www.ripe.net/ripe/maillists/archives/dns-wg/2006/msg00141.html> Action item 52.1 {Investigate causes for extra DNSSEC network traffic (in excess of the predicted growth) and extra CPU cycles} requires further investigation and is therefore "ongoing". -Peter

1 0

DRAFT DNS WG Agenda for RIPE 53
by Peter Koch 02 Oct '06

02 Oct '06

Dear WG, here's the draft agenda for next week's Wed and Thu. -Peter

1 2

2005-02 implementation: IP assignments for anycasting DNS
by leo vegoda 26 Sep '06

26 Sep '06

Dear Colleagues, We are pleased to announce that we will be able to accept e-mailed requests for assignments for anycasting DNS servers from 2 October 2006. The request form and supporting notes will be available from the RIPE Document Store at: http://www.ripe.net/ripe/docs/internet-registries.html We will make a separate announcement when it is possible to make requests via the LIR Portal. Assignments for anycasting DNS will come from reserved blocks: * IPv4 Anycast Assignments (/24) from 194.0.0.0/18 * IPv6 Anycast Assignments (/48) from 2001:0678::/29 You may want to update your filters. Regards, -- leo vegoda Registration Services Manager RIPE NCC

1 0

Lameness Checking Proposal
by Brett Carr 25 Sep '06

25 Sep '06

Dear Colleagues At RIPE 52, the RIPE NCC presented figures on the levels of lame DNS in the reverse tree within its service region. We were asked to propose a procedure for checking and reporting on the level of lameness. We sent a proposal to the DNS Working Group and received some comments. We have incorporated this feedback into a draft RIPE Document that you can find at: http://www.ripe.net/ripe/draft-documents/dns-lameness.html We will include this in a DNS presentation at the upcoming RIPE Meeting in Amsterdam. We welcome your comments and suggestions. Regards -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8

1 0

DNS Lameness Checking Proposal
by Brett Carr 22 Sep '06

22 Sep '06

As per the dns-wg Action point 52.3 from RIPE 52 "post questions and proposal to wg mailing list on how to deal with lame delegations when either the NCC is responsible for maintaining the parent or for running a (secondary) server for the child that is or is about to become delegated lame due to an unavailable *xfr source." Please find attached "dnslamecheckAug2006.txt" a proposal on how the RIPE NCC should test for lameness and what the resulting actions could be. Your feedback and discussion on this proposal is welcomed. Brett Carr. -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8

3 4

dnssec statistics action point 52.2
by Brett Carr 19 Sep '06

19 Sep '06

At the RIPE 52 meeting, the DNS Working Group asked us to provide statistics on secured delegations within RIPE NCC hosted zones. At the time of this e-mail, the figures are as follows: Total number of zones hosted as a primary by RIPE NCC - 113 Total number of primary zones that are signed - 72 Total number of NS records in all zones - 521,811 Total number of DS records in all zones - 61 We are of course happy to answer any questions about these numbers. Background Information: The RIPE NCC hosts the majority of the 41 unsigned zones on behalf of third parties. We can and will continue to expand the list of signed zones. The current keys for all zones that we sign are available at: https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys-new.txt We accept signed delegations (DS records) for all in-addr.arpa zones where we are primary. We cannot currently accept signed delegations (DS records) for those zones in ERX space, where we are not primary for the zone. The two graphs attached to this e-mail show the distribution of both NS and DS records. Regards. Brett. -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8

3 3

RIPE NCC DNSSEC Key Maintenance: Preemptive Key Signing Key Rollover
by Ruben van Staveren 15 Sep '06

15 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Apologies for duplicate e-mails] Dear Colleagues, Due to the recently published weakness in PKCS 1.5 signatures in OpenSSL RSA crypto, the RIPE NCC will be performing an key signing key (KSK) rollover earlier than planned. We have completed the first phase of the procedure and have published the new Key Signing Keys (KSK's). The deprecated keys will remain valid for a maximum of three months. We recommend that you reconfigure any resolvers to use the new keys. You can download them from: https://www.ripe.net/projects/disi//keys/ripe-ncc-dnssec-keys-new.txt The DNSSEC Key Maintenance Procedure is available at: https://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html The following references may be useful: http://www.openssl.org/news/secadv_20060905.txt http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339 We thank you for your patience and apologise for any inconvenience this maintenance may cause. If you have any questions regarding this maintenance please e-mail: ops(a)ripe.net. Regards, Ruben van Staveren Operations Group RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: For info see https://www.ripe.net/rs/pgp/ iD8DBQFFCVSambreNIsOKy8RAsRWAJ9jVQT++r9aZ3b0sCAl+IMFaUQLrgCfTtFb 5Az85tIv7TrWHVYoyt4Wvto= =tvtB -----END PGP SIGNATURE----- -- Ruben van Staveren RIPE Network Coordination Center Operations Group Singel 258 Amsterdam NL http://www.ripe.net +31 20 535 4444 PGP finger print 6501 4389 A675 477E DCE5 53D8 9108 49E2 DAFC 271B

3 2

Announcement DNS for LIRs Training Courses
by RIPE NCC Training Services 29 Aug '06

29 Aug '06

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Tuesday 5 September 2006 Time: 0900-1700 Location: Reykjavik, Iceland Hosted by: TM-Software http://www.t.is/ And Date: Friday 29 September 2006 Time: 0900-1700 Location: Amsterdam, Netherlands And Date: Friday 27 October 2006 Time: 0900-1700 Location: London, United Kingdom And Date: Tuesday 28 November 2006 Time: 0900-1700 Location: Rome, Italy Hosted by: CASPUR http://www.caspur.it/ Hosted by: NAMEX http://www.namex.it/ And Date: Friday 15 December 2006 Time: 0900-1700 Location: Moscow, Russian Federation The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

Review of IANA Root Zone Technical Checks
by Brett Carr 21 Aug '06

21 Aug '06

This may be of interest to some of the folks on here. Brett -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8 > -----Original Message----- > From: owner-dnsop(a)lists.uoregon.edu [mailto:owner- > dnsop(a)lists.uoregon.edu] On Behalf Of Kim Davies > Sent: Saturday, August 19, 2006 6:39 PM > To: dnsop(a)lists.uoregon.edu > Subject: [dnsop] Review of IANA Root Zone Technical Checks > > Dear Colleagues: > > Yesterday we started a review of IANA's procedures relating to > validating NS records and glue supplied by TLD operators for insertion > into the root zone. > > The discussion paper, as well as a public forum for comments, is at: > > http://www.icann.org/announcements/announcement-18aug06.htm > > We'll run this comment period until 30 September, after which we will > use the guidance provided to draft an operational procedure on the > topic. > > Kindest Regards, > > Kim Davies > Internet Assigned Numbers Authority > > > > . > dnsop resources:_____________________________________________________ > web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html > mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

1 0