- dns-wg - mailman.ripe.net

Re: Signing of the ARPA zone
by Joe Abley 17 Mar '10

17 Mar '10

Colleagues, This is a follow-up to the operational announcement regarding changes to the ARPA top-level domain that was sent on 2010-03-10. Apologies in advance for duplicates received through different mailing lists. As of 2010-03-17 1630 UTC all the authoritative servers for ARPA are serving a signed ARPA zone. We would like to solicit feedback from the technical community to allow us to identify any operational ill-effects that this change has caused. We will monitor this mailing list for feedback, and I will also distribute any feedback sent to me personally so that it can be considered. If no harmful effects have been identified by 2010-03-21 the trust anchor for the ARPA zone will be published through the IANA ITAR at <https://itar.iana.org/>. Regards, Joe Begin forwarded message: > From: Joe Abley <joe.abley(a)icann.org> > Date: 10 March 2010 16:13:46 EST > To: Joe Abley <joe.abley(a)icann.org> > Subject: Signing of the ARPA zone > > Colleagues, > > This is a technical, operational announcement regarding changes to the ARPA top-level domain. Apologies in advance for duplicates received through different mailing lists. > > No specific action is requested of operators. This message is for your information only. > > The ARPA zone is about to be signed using DNSSEC. The technical parameters by which ARPA will be signed are as follows: > > KSK Algorithm and Size: 2048 bit RSA > KSK Rollover: every 2-5 years, scheduled rollover to follow RFC 5011 > KSK Signature Algorithm: SHA-256 > Validity period for signatures made with KSK: 15 days; new signatures published every 10 days > ZSK Algorithm and Size: 1024 bit RSA > ZSK Rollover: every 3 months > ZSK Signature Algorithm: SHA-256 > Authenticated proof of non-existence: NSEC > Validity period for signatures made with ZSK: 7 days; zone generated and re-signed twice per day > > The twelve root server operators [1] will begin to serve a signed ARPA zone instead of the (current) unsigned ARPA zone during a maintenance window which will open at 2010-03-15 0001 UTC and close at 2010-03-17 2359 UTC. Individual root server operators will carry out their maintenance at times within that window according to their own operational preference. > > The trust anchor for the ARPA zone will be published in the ITAR [2], and in the root zone in the form of a DS record once the root zone is signed. > > If you have any concerns or require further information, please let me know. > > Regards, > > > Joe Abley > Director DNS Operations, ICANN > > [1] <http://www.root-servers.org/> > [2] <https://itar.iana.org/>

1 0

Signed .ARPA Zone Roll Out On K-root
by Wolfgang Nagele 16 Mar '10

16 Mar '10

[Apologies for duplicate emails] Dear Colleagues, We successfully rolled out the signed .ARPA zone on K-root. Regards, Wolfgang Nagele RIPE NCC DNS System Engineer

1 0

A Look at DNS Priming Queries to K-root
by Mirjam Kuehne 12 Mar '10

12 Mar '10

Dear colleagues, In preparation for signing the root, Emile Aben of the RIPE NCC looked at DNS priming queries arriving during the deployment of a DNSSEC signed zone at the DNS root servers. Find the results here on RIPE Labs: http://labs.ripe.net/content/look-dns-priming-queries-k-root Kind Regards, Mirjam Kühne

1 0

Signed .ARPA Zone Roll Out On K-root
by Wolfgang Nagele 11 Mar '10

11 Mar '10

[Apologies for duplicates] Dear Colleagues, As outlined by Joe Abley, ICANN, on the RIPE DNS Working Group mailing list, the DNS root servers will switch to a signed .ARPA zone at the beginning of next week. The mailing list archives can be found at: http://www.ripe.net/ripe/maillists/archives/dns-wg/index.html As the operator of K-root, the RIPE NCC has planned a maintenance window on 15 March 2010 between 09:00-13:00 UTC. During this period we will roll out the signed .ARPA zone. We will inform the working group once this change has been carried out. Regards, Wolfgang Nagele RIPE NCC DNS System Engineer

1 0

Signing of the ARPA zone
by Joe Abley 10 Mar '10

10 Mar '10

Colleagues, This is a technical, operational announcement regarding changes to the ARPA top-level domain. Apologies in advance for duplicates received through different mailing lists. No specific action is requested of operators. This message is for your information only. The ARPA zone is about to be signed using DNSSEC. The technical parameters by which ARPA will be signed are as follows: KSK Algorithm and Size: 2048 bit RSA KSK Rollover: every 2-5 years, scheduled rollover to follow RFC 5011 KSK Signature Algorithm: SHA-256 Validity period for signatures made with KSK: 15 days; new signatures published every 10 days ZSK Algorithm and Size: 1024 bit RSA ZSK Rollover: every 3 months ZSK Signature Algorithm: SHA-256 Authenticated proof of non-existence: NSEC Validity period for signatures made with ZSK: 7 days; zone generated and re-signed twice per day The twelve root server operators [1] will begin to serve a signed ARPA zone instead of the (current) unsigned ARPA zone during a maintenance window which will open at 2010-03-15 0001 UTC and close at 2010-03-17 2359 UTC. Individual root server operators will carry out their maintenance at times within that window according to their own operational preference. The trust anchor for the ARPA zone will be published in the ITAR [2], and in the root zone in the form of a DS record once the root zone is signed. If you have any concerns or require further information, please let me know. Regards, Joe Abley Director DNS Operations, ICANN [1] <http://www.root-servers.org/> [2] <https://itar.iana.org/>

1 0

Ripe-60 coming up
by Jaap Akkerhuis 08 Mar '10

08 Mar '10

Folks, Over two months RIPE-60 will take place in Prague from 3 to 7 May. According to the meeting plan, the DNS-WG meeting will be Thursday the 6th. Please send suggestions for agenda items and/or presentations to the chairs (dns-wg-chair(a)ripe.net) or directly to me. Note that the (draft) minutes of Ripe-59 are available in the usual place. If there are comments, for these it would be nice to receive them before the meeting s these can incorporated swiftly. Regards, jaap Ripe-60: <http://www.ripe.net/ripe/meetings/ripe-60/> Meeting-plan: <http://www.ripe.net/ripe/meetings/ripe-60/meeting-plan.html> Minutes: <http://www.ripe.net/ripe/wg/dns/r59-minutes.html>

1 0

specify dns for reverse lookup
by Athiqur Rahman 25 Feb '10

25 Feb '10

I have the 217.73.64.0/20 IP block assigned to me. I am trying to setup some reverse DNS records. I created the zone 64.73.217.in-addr.arpa which is answering queries fine. However when I create any other zone files withing that /20, they do not answer the queries. I have logged into the RIPE website and am trying to find where the DNS is specified for an IP range but can not seem to find it. Any advice on how to proceed with this problem?

2 1

Outdated RIPE NCC Trust Anchors in Fedora Linux Repositories
by Anand Buddhdev 08 Feb '10

08 Feb '10

[Apologies for duplicates] Dear Colleagues, We have discovered that recent versions of the Fedora Linux distribution are shipping with a package called "dnssec-conf", which contains the RIPE NCC's DNSSEC trust anchors. This package is installed by default as a dependency of BIND, and it configures BIND to do DNSSEC validation. Unfortunately, the current version of this package (1.21) is outdated and contains old trust anchors. On 16 December 2009, we had a key roll-over event, where we removed the old Key-Signing Keys (KSKs). From that time, BIND resolvers running on Fedora Linux distributions could not validate any signed responses in the RIPE NCC's reverse zones. If you are running Fedora Linux with the standard BIND package, please edit the file "/etc/pki/dnssec-keys//named.dnssec.keys", and comment out all the lines in it containing the directory path "production/reverse". Then restart BIND. This will stop BIND from using the outdated trust anchors. If you do want to use the RIPE NCC's trust anchors to validate our signed zones, we recommend that you fetch the latest trust anchor file from our website and reconfigure BIND to use it instead of the ones distributed in the dnssec-conf package: https://www.ripe.net/projects/disi/keys/index.html Please remember to check frequently for updates to our trust anchor file, as we introduce new Key-Signing Keys (KSKs) every 6 months. Regards, Anand Buddhdev, DNS Services Manager, RIPE NCC

10 15

Measuring DNS Transfer Sizes - First Results
by Daniel Karrenberg 05 Feb '10

05 Feb '10

Apologies for the inevitable duplicates. You might be interested in reading about our measurements of real obtained DNS transfer sizes in relation to clients requesting DNSSEC responses. See here http://labs.ripe.net/content/measuring-dns-transfer-sizes-first-results Daniel

1 0

L-Root Maintenance 2010-01-27 1800 UTC - 2000 UTC
by Mehmet Akcin 25 Jan '10

25 Jan '10

Hi As part of staged, incremental deployment of DNSSEC in the root zone L-Root will begin serving a Deliberately Unvalidatable Root Zone (DURZ) after the completion of its scheduled maintenance at 2010-01-27 1800 UTC - 2000 UTC Please contact L-Root NOC via noc(a)dns.icann.org or T: +1.310.301.5817 if you have any questions. Please contact with rootsign(a)icann.org if you have any questions regarding DNSSEC Deployment at root zone. Regards Joe Abley / Mehmet Akcin / Dave Knight ICANN DNS Ops / L-ROOT

1 0