- dns-wg - mailman.ripe.net

Getting the iana.org trust anchor
by Joao Damas 28 Oct '08

28 Oct '08

Givens the near-future availability of the IANA TAR, where can I get securely obtain the trust anchor for the iana.org zone (or the zone where the TAR will be served from) ? Any paper stubs available here at the RIPE meeting, perchance? Joao

2 3

Maintaining DOMAIN objects
by Denis Walker 16 Oct '08

16 Oct '08

[Apologies for duplicate emails] Dear Colleagues, The RIPE Data Protection Task Force advised the RIPE NCC that all objects in the RIPE Database should be maintained. Maintaining Routing Policy Specification Language (RPSL) objects in the RIPE Database was optional for PERSON, ROLE and DOMAIN objects. All the DOMAIN objects in the RIPE Database are now maintained and protected. As there may have been a possibility to exploit this data if any advance warning had been made, the RIPE NCC did not publicly announce that it was going to add maintainers to unmaintained DOMAIN objects before doing so. For further details of what was done, please see this web page: http://www.ripe.net/db/support/security/domain/syntax.html Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

Re: [dns-wg] NTIA NoI: does anyone care?
by Xiaodong Lee 15 Oct '08

15 Oct '08

As I know, if doing root server signing, there are some problems for name servers with BIND software to protect their zone file. -- -- Xiaodong LEE [The best answer is doing] +86-10-58813020 mailto:lee@cnnic.cn http://lixiaodong.cn 在 2008-10-15，下午5:12， Jim Reid 写道： > So far there has been no discussion on the list about the NTIA > proposals about getting the root signed. I would have hoped someone > would have said something by now. Sigh. > > Please try to find some time to look at the NTIA's suggestions and > if possible send your comments to the list. I think this WG has an > obligation to make some sort of "official" response to the NTIA's > consultation. After all, we played our part to get the ball rolling > by producing the "sign the root" letter to ICANN at the Tallinn > meeting. So now that there are some concrete proposals for > consideration, I feel the WG should look at them and respond. > > I would also welcome suggestions from WG members about how to > stimulate a discussion here about the NTIA proposals. Although time > has been set aside in the RIPE57 agenda, that won't be enough. The > majority of people on this list won't be in Dubai. And besides, it's > really the list that should decide the WG's opinion and what action > it should take. > > Over to you.... >

2 1

Agenda for RIPE 57
by Jim Reid 15 Oct '08

15 Oct '08

Colleagues, here's the agenda for the Dubai RIPE meeting. I hope to see you there! Tuesday Afternoon Administrivia (5 mins) Review of Action Items (10 mins) ICANN/IANA Update (15 mins) Kim Davies, IANA Discussion on NTIA DNSSEC NoI (20 mins) Etisalat DNS Operational Experiences (10 mins) Abdulla Bushlaibi, Etisalat A description of Etisalat's experience in the field of implementing DNS services, across different type of services and requirements. It explains past, present and future plans for DNS architecture in Etisalat, considering network convergence as well as expansion. It describes problems and challenges on the way and some solutions. A versatile platform for DNS metrics with its (30 mins) application to IPv6 penetration Stephane Bortzmeyer, AFNIC AFNIC is developing a DNS-based measurements & statistics project in order to monitor the evolution of an open list of technical activities (IPv6, DNSSEC, EDNS0 support, SPF & DKIM deployment...). The project started with IPv6 penetration measurements and an overview of the results based on collected DNS data from .fr is presented. Wednesday Morning IETF WG news update (15 mins) Lars-Johan Liman, Autonomica NCC Update (15 mins) Anand Buddhdev, RIPE NCC (TBC) Discussion on stale domain objects (15 mins) Peter Koch, DENIC .org's Next Steps with DNSSEC (20 mins) Lance Wolak, PIR This described how .ORG has initiated an industry coalition to streamline the implementation of DNSSEC through the collaborative development of specific educational material, common tools and implementation guides. IDN GCC trial project (15 mins) Amani Mohammed Bin Sewaif, Etisalat The presentation will focus on how the DNS aspects of the IDN trial project that has been implemented among the GCC countries. It explains the initial discussion/requirements for the DNS architecture to serve the trial,what approaches were considered and the final setup. It will briefly show how it works, and elaborate on the tools developed for the community as well as point to other resources/work done in this project. Followup on NTIA DNSSEC NoI (5 mins) AOB/General Discussion (5 mins)

1 0

NTIA consultation on DNSSEC
by Jim Reid 09 Oct '08

09 Oct '08

Colleagues, the NTIA (the bit of DoC which oversees changes to the root zone) has just announced a consultation on the deployment of DNSSEC. I quote: "Commerce’s National Telecommunications and Information Administration (NTIA) today issued a Notice of Inquiry seeking public comments regarding the deployment of Domain Name and Addressing System Security Extensions (DNSSEC) into the Internet’s DNS infrastructure, including the authoritative root zone. " Further details are at: http://www.ntia.doc.gov/press/2008/DNSSEC_081009.html . Perhaps the WG would like to formulate a response to this consultation? I would also like the WG to give an indication if we should allocate some time at RIPE57 to discuss this consultation and any possible response to it.

2 1

Reverse DNS lameness alerts
by Anand Buddhdev 01 Oct '08

01 Oct '08

[Apologies for duplicate emails] Dear Colleagues, Some of you received email messages last month from the RIPE NCC with alerts about lame DNS servers. These messages were generated as part of the RIPE NCC's DNS lameness project. Unfortunately, the alerts were not entirely correct, and showed all the servers of some reverse zones as lame. This was caused by programming errors in the software that produced the messages. We have identified these errors, and we are correcting them. We are also introducing additional tests and safeguards to improve the quality of our DNS lameness measurements. For more information on the RIPE NCC's DNS lameness project, please see: http://www.ripe.net/info/stats/dns-lameness/ Regards, Anand Buddhdev DNS Services Manager, RIPE NCC

1 0

Re: [dnssec-deployment] [dns-wg] Announcement: Test Report on DNSSEC impact on SOHO CPE
by Steve Crocker 16 Sep '08

16 Sep '08

Thanks. Steve On Sep 16, 2008, at 2:55 PM, Ray.Bellis(a)nominet.org.uk wrote: >> The report is excellent. Thank you very much for sharing it with us. > > You're welcome :) > >> I have two questions. >> >> 1) Vendor actions >> >> What are the vendor status and/or responses? Were they contacted? > did they >> respond? Are they planning updates? > > We did contact vendor technical support, in particular to determine > whether any work-arounds exist on those routers that don't appear > to allow > the DNS settings in the DHCP server to be changed. > > However attempts to reach product management types to talk about > implementation issues were generally fruitless. I did manage to > report my > findings to Zyxel UK through an existing contact, though. > > I'm hoping that some of the vendors will get in touch with me, now > that > the report is published. > >> 2) base OS? >> >> Is there a similarity in these firmwares? eg are they using >> the same >> DNS software inside? Perhaps the vendors are not the people we > should >> be talking to? For instance, many Linux based routers use the > "dnsmasq" >> software. Depending on its status, it might be worth >> contacting the >> upstream software provider of the commercial router vendors. > > We didn't see any direct evidence of shared code between vendors. > We did > see some quirks that might suggest commonality (e.g. NAT tranlation > failures) but didn't look for anything to prove a link. > > kind regards, > > Ray > > -- > Ray Bellis, MA(Oxon) > Senior Researcher in Advanced Projects, Nominet > e: ray(a)nominet.org.uk, t: +44 1865 332211 > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <dnssec-deployment(a)shinkuro.com>. > To unsubscribe, E-mail to: <dnssec-deployment-off(a)shinkuro.com> > A public archive is available here: <http://mail.shinkuro.com:8100/ > Lists/dnssec-deployment/> > and older material is at > <http://mail.shinkuro.com:8100/Lists/dnssec-deployment-archive/>

1 0

Announcement: Test Report on DNSSEC impact on SOHO CPE
by Ray.Bellis＠nominet.org.uk 16 Sep '08

16 Sep '08

[with apologies for the cross-postings to multiple lists] Dear Colleagues, We would like to announce the publication of a joint study entitled "DNSSEC Impact on Broadband Routers and Firewalls", available for download at: http://download.nominet.org.uk/dnssec-cpe/DNSSEC-CPE-Report.pdf In summary (based on 24 tested units): "... we conclude that just 6 units (25%) operate with full DNSSEC compatibility "out of the box." 9 units (37%) can be reconfigured to bypass DNS proxy incompatibilities. Unfortunately, the rest (38%) lack reconfigurable DHCP DNS parameters, making it harder for LAN clients to bypass their interference with DNSSEC use. These findings, their potential impact on DNSSEC use by broadband consumers, and implications for router/firewall manufacturers, are presented and analyzed in this report. " Ray Bellis Senior Researcher in Advanced Projects Nominet UK Lisa A. Phifer President, Core Competence, Inc.

2 2

Agenda items for RIPE57
by Jim Reid 09 Sep '08

09 Sep '08

It's that time again... The next RIPE meeting is just over 6 weeks away. So it's about time an agenda was put together for the WG sessions in Dubai. Could you please send suggestions for agenda topics and/or presentations to dns-wg-chair(a)ripe.net ? Thanks.

1 0

Upgrade of the reverse DNS provisioning system at 8 September 2008, between 09:00 and 12:00 (UTC)
by Wolfgang Nagele 03 Sep '08

03 Sep '08

[Apologies for duplicate emails] Dear Colleagues, On 8 September 2008, between 09:00 and 12:00 (UTC), the RIPE NCC will upgrade the reverse DNS provisioning system. This change will enable the server ns.ripe.net to perform zone transfers over IPv6. If your reverse zone has a master server with an IPv6 address, this will be used in preference to the IPv4 address after the change. We apologise for any inconvenience this change may cause. If you have any questions or concerns about this, please email <dns-help(a)ripe.net>. Regards, -- Wolfgang Nagele DNS System Engineer RIPE NCC Singel 258 1016 AB Amsterdam Tel: +31 20 535 4444 Fax: +31 20 535 4445

1 0