- dns-wg - mailman.ripe.net

Draft agenda for RIPE
by Jim Reid 03 Nov '10

03 Nov '10

Colleagues, here is an almost final agenda for the WG at RIPE61. I don't expect there will be significant changes: perhaps minor tweaks to the running order. There are one or two loose ends that need to be clarified. However these are unlikely to make much impact on the overall agenda. Please note that the WG slots are not back-to-back for the first time in ages. The first one is on the Tuesday afternoon and is 2 hours long instead of 90 minutes. Your co-chairs have done some trading of slots with the other WGs to minimise the clashes with other WGs that would have been unpopular. That's why we gave up one of the usual Thursday slots this time. As always, comments and questions on the agenda are welcome. See most of you in Rome.

1 0

DNSSEC KSK Roll-over Event for RIPE NCC Zones
by Anand Buddhdev 25 Oct '10

25 Oct '10

[Apologies for duplicates] Dear Colleagues, On 21 September, we performed a roll-over of Key Signing Keys (KSKs) of all our signed zones. However, we encountered some issues with the signing infrastructure, and we had to perform a roll-back and delay the key roll-over event. We have resolved the issues with the signing infrastructure, and we will perform a roll-over of KSKs on Wednesday 27 October, and publish new trust anchor files on the RIPE NCC website: More information on DNSSEC keys is available at: https://www.ripe.net/dnssec-keys/index.html Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

request about RIPE vs. ISP and RFC 1921, 2.1
by thoma spolnik 15 Oct '10

15 Oct '10

Hello, if RIPE assigns an large ip net to an ISP - Does RIPE accept, that this ISP ignores RFC 1921, 2.1 [1] (for commercial interests)? Are commercial interests a valid reason [2] for RIPE, that an ISP does not set (generic) PTR records for an used IP? Does or does not RIPE claim the compliance with (basic) RFCs (like RFC 1921, 2.1 - I think it is a basic, that every IP must have a correct PTR record.) for assigned IP nets? I hope, I found the correct mailing list for my question. If this the wrong list, which should I use for my question? Best regards, thomas polnik. [1] 2.1 Inconsistent, Missing, or Bad Data Every Internet-reachable host should have a name. The consequences of this are becoming more and more obvious. Many services available on the Internet will not talk to you if you aren't correctly registered in the DNS. Make sure your PTR and A records match. For every IP address, there should be a matching PTR record in the in-addr.arpa domain. [...] [2] RFC 2119 [...] 3. SHOULD This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course. [...]

4 5

another concern over naming
by Jim Reid 06 Oct '10

06 Oct '10

Colleagues, I wonder if we've overlooked this rather important concern about the use of hyphens in domain name labels? http://forum.icann.org/lists/name-numbers-and-hyphens-domains/msg00000.html

2 1

Decommissioning of the RIPE NCC Reply-size Tester
by Anand Buddhdev 05 Oct '10

05 Oct '10

[Apologies for duplicates] Dear Colleagues, In December 2009, the RIPE NCC made a reply-size tester available to the community. The purpose of this was to allow users to test their networks for path MTU related issues and to help them prepare for the roll-out of a signed root zone. We installed the reply-size server component on a temporary basis at the global instances of K-root to allow testing against an actual root server instance. We collected some statistics and published some interesting research on the RIPE Labs website: http://labs.ripe.net/Members/dfk/content-measuring-dns-transfer-sizes-first… A signed root zone has been published since 15 July 2010, and we feel that the reply-size tester has served its function. We are therefore going to decommission it on Monday, 11 October 2010. If you wish to continue testing networks for path MTU issues, we recommend that you use the reply-size tester of DNS OARC: https://www.dns-oarc.net/oarc/services/replysizetest Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

OpenDNSSEC training
by Rickard Bellgrim 04 Oct '10

04 Oct '10

Hi OpenDNSSEC have now been deployed at six TLD:s (.dk, .fi, .fr, .nl, .se, and .uk) and ICANN. We are therefore continuing our effort on giving two-day training courses. You can select from two dates 1-2 November and 29-30 November. Please read the attached PDF and get back to me if you are interested. // Rickard Bellgrim

1 1

2nd DNS WG slot at RIPE61 rescheduled
by Peter Koch 04 Oct '10

04 Oct '10

Dear DNS WG, several WG members pointed out the undesirable scheduling conflict between the Anti-Abuse WG and the 2nd DNS WG slot for the Rome meeting. Thanks to the cooperation of other WGs this could be resolved and the overall situation hopefully improved. We have switched places with ENUM, i.e. DNS moved from Thu 1400-1530 to Tue 1600-1800. The full meeting plan is available at <http://www.ripe.net/ripe/meetings/ripe-61/meeting-plan.html> Also, please allow me to repeat our call for contributions: If you'd like to present a topic relevant to the DNS (or domain names) in operations, technology, research and/or policy, please contact the WG chairs at <dns-wg-chair(a)ripe.net>. Regards, Peter

1 0

RIPE-61 coming up
by Jaap Akkerhuis 23 Sep '10

23 Sep '10

All, Yes, it sneaks up on you before you know. Please send in your suggestions and requests for agenda time. It is your working group after all and your chairs don't want to dctate al the entertainment, pardon, the agenda items. The Draft meeting plan is already up <http://www.ripe.net/ripe/meetings/ripe-61/meeting-plan.html> and you can see that the DNS-WG is oppoiste the EIX and the Anti-Abuse WG. In case your suggestions etc. clash with that let us know which slot is preferred. jaap

3 3

Postponement of DNSSEC KSK Roll-over for RIPE NCC Zones
by Anand Buddhdev 22 Sep '10

22 Sep '10

[Apologies for duplicates] Dear colleagues, Yesterday, 21 September, we were scheduled to perform a roll-over of Key Signing Keys (KSKs) of all our signed zones. However, during the roll-over we had some issues with our signing infrastructure, which caused some zones to be generated with expired signatures. We therefore rolled back to the state before the roll-over. In order to allow proper resolution of the problems we encountered, we are delaying our roll-over to the end of October. We will announce a new date before the event. Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

Publicering av .SE:s DS-poster i rotzonen/Putting .SE's DS records into the root zone
by Anne-Marie Eklund-Löwinder 30 Aug '10

30 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Information in English will follow. Publicering av .SE:s DS-poster i rotzonen Med anledning av att rot nu är signerad har .SE lagt till sina DS-poster till rotzonen. Detta innebär rent tekniskt inga omedelbara problem för de som använder .SE som tillitsankare (Trust Anchor). Det gör det dock möjligt för den som så vill att byta till rot som tillitsankare för DNSSEC, något som vi rekommenderar att göra före nästa årsskifte då .SE kommer att rulla nycklar för DNSSEC enligt våra normala rutiner. Som en följd av att vi lägger våra DS-poster i rotzonen kommer .SE även att ta bort dem ur IANA:s ITAR. ITAR är en interimslösning som har fungerat väl för sitt syfte innan roten signerats, men fyller för vårt vidkommande nu ingen roll. DS-posterna kommer att tas bort från ITAR 30 dagar efter att de har publicerats i rotzonen. Vi råder er att prenumerera på meddelanden från dnssec-announce(a)lists.nic.se för att få information om viktiga förändringar av DNSSEC i .SE. Eventuella frågor kan ställas till dnssec-info(a)iis.se. Anne-Marie Eklund Löwinder Kvalitets- och säkerhetschef .SE (Stiftelsen för Internetinfrastruktur) Adress: Ringvägen 100 Postadress: Box 7399, 103 91 Stockholm Växel: 08-452 35 00 Direkt: 08-452 35 17 Mobil: 0734-31 53 10 E-post: anne-marie.eklund-lowinder(a)iis.se Webbplats: http://www.iis.se Putting .SE’s DS records into the root zone Since the root zone is now signed, .SE has submitted its DS records to the root zone. From a technical view this should not affect anyone using .SE as Trust Anchor. It will, however, make it possible to switch to using the root as Trust Anchor for DNSSEC. We recommend that you make this switch before the turn of the year when .SE’s next DNSSEC key rollover is scheduled to occur. As we publish our DS records in the root zone, we will remove them from IANA’s ITAR. ITAR is a temporary solution that served our needs well while the root zone was not signed, but it is to our concern no longer necessary. The DS records will be withdrawn from ITAR 30 days after they have become available in the root. We do advice you to subscribe to the dnssec-announce(a)lists.nic.se mailing list to get notified about key rollovers and any other important changes regarding DNSSEC in .SE. Questions may be addressed to dnssec-info(a)iis.se. Anne-Marie Eklund Löwinder Quality & Security Manager .SE (The Internet Infrastructure Foundation), PO Box 7399, SE-103 91 Stockholm, Sweden Phone: +46 (0)8-452 35 00/17 Mobile: +46 (0)734 315 310 E-mail: anne-marie.eklund-lowinder(a)iis.se Web: http://www.iis.se -----BEGIN PGP SIGNATURE----- Version: 9.8.3 (Build 4028) Charset: utf-8 wj8DBQFMe3h+pdzwAUKxz5QRAqmlAJ9A9sLTuwtTqm0nhxzZ6uT8i1ndIACg1KoL 1xLrob4+MeHAhfK2M7JrO6s= =qZP1 -----END PGP SIGNATURE-----

1 0