- dns-wg - mailman.ripe.net

Outdated RIPE NCC Trust Anchors in Fedora Linux Repositories
by Anand Buddhdev 08 Feb '10

08 Feb '10

[Apologies for duplicates] Dear Colleagues, We have discovered that recent versions of the Fedora Linux distribution are shipping with a package called "dnssec-conf", which contains the RIPE NCC's DNSSEC trust anchors. This package is installed by default as a dependency of BIND, and it configures BIND to do DNSSEC validation. Unfortunately, the current version of this package (1.21) is outdated and contains old trust anchors. On 16 December 2009, we had a key roll-over event, where we removed the old Key-Signing Keys (KSKs). From that time, BIND resolvers running on Fedora Linux distributions could not validate any signed responses in the RIPE NCC's reverse zones. If you are running Fedora Linux with the standard BIND package, please edit the file "/etc/pki/dnssec-keys//named.dnssec.keys", and comment out all the lines in it containing the directory path "production/reverse". Then restart BIND. This will stop BIND from using the outdated trust anchors. If you do want to use the RIPE NCC's trust anchors to validate our signed zones, we recommend that you fetch the latest trust anchor file from our website and reconfigure BIND to use it instead of the ones distributed in the dnssec-conf package: https://www.ripe.net/projects/disi/keys/index.html Please remember to check frequently for updates to our trust anchor file, as we introduce new Key-Signing Keys (KSKs) every 6 months. Regards, Anand Buddhdev, DNS Services Manager, RIPE NCC

10 15

Measuring DNS Transfer Sizes - First Results
by Daniel Karrenberg 05 Feb '10

05 Feb '10

Apologies for the inevitable duplicates. You might be interested in reading about our measurements of real obtained DNS transfer sizes in relation to clients requesting DNSSEC responses. See here http://labs.ripe.net/content/measuring-dns-transfer-sizes-first-results Daniel

1 0

L-Root Maintenance 2010-01-27 1800 UTC - 2000 UTC
by Mehmet Akcin 25 Jan '10

25 Jan '10

Hi As part of staged, incremental deployment of DNSSEC in the root zone L-Root will begin serving a Deliberately Unvalidatable Root Zone (DURZ) after the completion of its scheduled maintenance at 2010-01-27 1800 UTC - 2000 UTC Please contact L-Root NOC via noc(a)dns.icann.org or T: +1.310.301.5817 if you have any questions. Please contact with rootsign(a)icann.org if you have any questions regarding DNSSEC Deployment at root zone. Regards Joe Abley / Mehmet Akcin / Dave Knight ICANN DNS Ops / L-ROOT

1 0

Reverse DNS Outage Announcement
by Sjoerd Oostdijck 22 Jan '10

22 Jan '10

[Apologies for duplicates] Dear Colleagues, At 13:50 on Thursday, 21 January, an error was introduced into the RIPE NCC's reverse DNS provisioning system. This caused reverse DNS delegations to stop working for allocations in the following range: 77.0.0.0 to 77.220.7.255 This error was triggered by an internal cleanup of our Early Registration Transfer (ERX) DNS delegations, which was being conducted as part of the RIPE NCC's Registration Data Quality (RDQ) project. The reverse DNS provisioning system was corrected again on 22 January at 09:50 (UTC). However, due to negative caching in DNS resolvers, the problem may have remained visible for a further two hours. The RIPE NCC is currently revising the reverse DNS provisioning system to prevent errors such as this occurring in future. If you have any questions or comments, please send an email to <ncc(a)ripe.net>. Regards, Sjoerd Oostdijck DNS Services Group, RIPE NCC

1 0

DNSSEC signed version of .PT
by Sara Monteiro 13 Jan '10

13 Jan '10

FYI - Apologies if you have already seen this on other lists. Sara Monteiro Pedro Veiga wrote, On 12-01-2010 14:36: > Dear colleagues, > > I'm glad to inform that we have signed the ccTLD .PT in the beginning of > 2010 and the DNSSEC signed version of .pt is in production since 4th of > January. > > For the outside world the .pt infrastructures didn't change, we still > have the same primary name server and a half a dozen of secondaries > (with dnssec-awareness), but we did add an hidden primary where the > signing it's made using an HSM to generate and store the keys. > > We are still working to improve the DNSSEC service in the administrative > side, and we hope to make it available to or Registrars/Registrants in > the next month. > > We are scheduling DNSSEC Technical Workshops to your Registrars and NREN > - National Research and Education Network since they are more proactive > and have the human resources and means to do it. We also have single > registrants with the enough DNS knowledge developing DNSSEC as well, > with the help of the documentation that we made available and also by > direct contact via email and phone. > > Further information, as .pt trust anchor it's available at: > > http://www.dnssec.pt/ > > (also available by mailing list. Send an email to info(a)dnssec.pt to > subscribe) > > Best Regards, > > Pedro Veiga > >

1 0

RIPE58 minutes
by Jim Reid 10 Jan '10

10 Jan '10

Colleagues, a combination of miscommunication and confusion by the WG co-chairs has meant that the RIPE58 minutes went astray. Until now.... Sorry about that. I thought the minutes had been circulated just before RIPE59. They hadn't. And then assumed in Lisbon that the WG's silence about the RIPE58 minutes meant they could be approved by the WG. Which was wrong too. Oh well. Apologies are also due to the NCC staff who (a) sent your WG co-chairs the minutes before RIPE58 ended; (b) politely nagged us a few times to get the minutes out; (c) had extra hassle keeping the WG web pages up to date. Here they are. Please submit any comments or corrections to the list.

1 0

A Review of Administrative Tools for DNSSEC
by Rickard Bellgrim 22 Dec '09

22 Dec '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi .SE (The Internet Infrastructure Foundation) has together with Certezza produced a report that show the current state of administrative tools for DNSSEC. The report is a summary of the functionality of some leading DNSSEC management tools. The focus of the examination has been on DNSSEC signing and key management functionality. An important part of the work has been to specify a set of user review points. It is our belief that the review points are fairly general and as such can be used in similar reviews in the future. The key finding in the study is that there has been a substantial development of DNSSEC tools during the last year, but in a few areas some improvement work still remains. In general the product standard is good and the tested products work as expected. We hope that this product review facilitates the deployment of DNSSEC and would also encourage others to follow up on this work. Please, read the review here: http://www.iis.se/docs/DNSSEC-Admin-tools-review-1.01.pdf // Rickard Bellgrim -----BEGIN PGP SIGNATURE----- Version: 9.8.3 (Build 4028) Charset: utf-8 wsBVAwUBSzC73+CjgaNTdVjaAQg0oAf+JuByCwfqLWCqje4DV/lg1ih9+9+MAeFe kS2HEEVd2rX0x7z+IjRyYz06U39lQsfeOURl2Eby/nOHc54Anw7TLR8u2zTmDZ68 UFCND/8DY7be6AY6uuvPRLx8L0RUpjRMLZSEjbkECXydmNslejuxZkm5nVVl+EKQ 2oc0BioEZ1uyQuvfT+BBD3g4D/gdZihlpF4pg2ey+nGC5bhO2PaTMjBYq+Y//M7L 2JvT/sesT+5KJDkwnBY1aVeplqWS823fIcbdK89bP36GZTjt9gV61OoYuY+PK4h3 47z3MIFyVpDA447i/YH4yxKd5qNpHfEOOwgCRR6nlOHfmMOMXhEkkg== =S0WO -----END PGP SIGNATURE-----

1 0

RIPE NCC Reply-size Test Application
by Anand Buddhdev 22 Dec '09

22 Dec '09

Dear Colleagues, The RIPE NCC is pleased to release an application for the purpose of determining the maximum size of DNS responses that a resolver can receive. This application is meant to assist users and network administrators to prepare their networks and resolvers for a signed root zone. To download this application, and learn how to use it, please see the RIPE Labs website: http://labs.ripe.net/content/testing-your-resolver-dns-reply-size-issues If you have any questions or comments, please feel free to post them on the RIPE Labs website. Regards, Anand Buddhdev, DNS Services Manager, RIPE NCC

1 0

RIPE NCC Confirms Commitment to DNSSEC Deployment in the Root Zone
by Andrei Robachevsky 16 Dec '09

16 Dec '09

[Apologies for duplicate emails] Dear Colleagues, On 1 December 2009, ICANN and VeriSign began to deploy DNSSEC across the root server system when they signed the root zone using DNSSEC. They noted that the signing would become public from January 2010, when the process of signing each of the 13 root servers in turn would begin. This process will continue until July 2010, when ICANN publishes the root zone trust anchor and root operators begin to serve the signed root zone with actual keys. On 15 December 2009, the root zone DNSSEC deployment team launched a website that provides information about DNSSEC for the root zone: http://www.root-dnssec.org/ The website is a repository for the documentation relating to the deployment of DNSSEC in the root zone, and it includes information such as technical status updates and the full timetable for the deployment of DNSSEC. The RIPE NCC, operator of K-root, confirms its commitment to support the ICANN/VeriSign initiative and coordinate with the other root zone server operators in the deployment of DNSSEC in the root zone. The RIPE NCC also provides data collection and measurements that allows monitoring of the effects the transition has on the overall performance of the root server system. This information is available on RIPE Labs at: http://labs.ripe.net/content/preparing-k-root-signed-root-zone Further details on the RIPE NCC's operation of K-root are available at: http://k.root-servers.org Best regards, Andrei Robachevsky Chief Technical Officer RIPE NCC

1 0

DOMAIN object proposals
by Denis Walker 14 Dec '09

14 Dec '09

Dear Colleagues, The RIPE NCC made two proposals recently concerning DOMAIN objects: 22 October New rules for reverse domain object creation in the RIPE Database http://www.ripe.net/ripe/maillists/archives/dns-wg/2009/msg00104.html 23 November Removal of Forward DOMAIN data from the RIPE Database http://www.ripe.net/ripe/maillists/archives/dns-wg/2009/msg00119.html There have been no comments for or against either of these proposals on the mailing lists. They were both discussed at RIPE Meetings, without any negative comments. We would like to ask for any final comments by this Friday, 4 December 2009, so the working group chairs can then draw a consensus. Regards, Denis Walker Business Analyst, Database Group RIPE NCC

3 2