- dns-wg - mailman.ripe.net

Re: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE
by Patrik Wallstrom 04 Jan '08

04 Jan '08

On Thu, 03 Jan 2008, Holger Zuleger wrote: >> New key signing key (KSK) for .SE >> As from today, 2008-01-03 .SE publish and take into use a new KSK for >> signing the .SE zone file. The key published with start 2006 with key >> id = 17686 is unvalid since 2008-01-01 and will be removed >> 2008-02-01. You should have configured the key published with start > Would it be possible to set the REVOKE Bit on that key, and announce it for > another 30 days? There was no time to fix this for this rollover. Next time. > Doing so enables a rfc5011 aware validator to discard the key automatically > from the list of possible trust anchor. Which resolvers honors the revocation bit? To my knowledge, no swedish resolver operators are using such software yet. -- patrik_wallstrom->foodfight->pawal(a)blipp.com->+46-733173956

2 1

Re: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE
by Holger Zuleger 03 Jan '08

03 Jan '08

> New key signing key (KSK) for .SE > > As from today, 2008-01-03 .SE publish and take into use a new KSK for > signing the .SE zone file. The key published with start 2006 with key > id = 17686 is unvalid since 2008-01-01 and will be removed > 2008-02-01. You should have configured the key published with start Would it be possible to set the REVOKE Bit on that key, and announce it for another 30 days? Doing so enables a rfc5011 aware validator to discard the key automatically from the list of possible trust anchor. Without it, the key ends up in state missing on the validator side. <quote rfc5011> Missing This is an abnormal state. The key remains a valid trust- point key, but was not seen at the resolver in the last validated DNSKEY RRSet. This is an abnormal state because the zone operator should be using the REVOKE bit prior to removal. </quote> So setting the revoke bit, would be one step to make the zone more compatible to RFC5011 (Automated Updates of DNS Security Trust Anchors) which is a way forward in implementing and using DNSSEC even without a signed root (and in absence of an elsewere trustable TAR). BTW: The same is true for all other signed TLDs and the signed zones managed by RIPE as well. Greets Holger

1 0

Bad secure delegation of ris.ripe.net
by Alexander Gall 13 Dec '07

13 Dec '07

Hello DISI The zone ris.ripe.net is bogus. It appears that the DS RR doesn't match the KSK DNSKEY RR. ripe.net is fine (with the newest trust anchors). According to drill: : gall@hadron[gall]; cat /tmp/ripe.key ripe.net. IN DNSKEY 257 3 5 AwEAAZ+vLzvkn0wkjcSmpoZRIOU0Suaw1EegrH9T0vwGOG9EbdgBYs6p 1lyjy2aHfZ4EnhVVVsElpSMBFzKItwzJeR9jxZC23dHw57saKC6enu7K K0m3fUQagzHqcu5RKn/T+0w1Q51UTdsLiBfCpqzQ10+T1oRxCXYWOyIi jApUQCFvybf1U6S/7lOLagzzoSU6lzxcUivWxLEM0SbzYIoV1OWXIjnj X/7/ChvZPqr01iY9th4nXlK52Da0mPaPbunLF353s4LQ6CsmcFG3zCfg 6iYRugF/NE1uMbdpzsff7nV1/K4PdSJjLt/AKsofQbbca8zH6YEolTcA T8o18/H13jE= : gall@hadron[gall]; drill -S -k /tmp/ripe.key ripe.net. soa | tail -5 DNSSEC Trust tree: ripe.net. (SOA) |---ripe.net. (DNSKEY keytag: 62805) |---ripe.net. (DNSKEY keytag: 21238) ;; Chase successful : gall@hadron[gall]; drill -S -k /tmp/ripe.key ris.ripe.net. soa | tail -5 ris.ripe.net. (SOA) |---ris.ripe.net. (DNSKEY keytag: 51156) |---ris.ripe.net. (DNSKEY keytag: 21022) No trusted keys found in tree: first error was: No DNSSEC public key(s) ;; Chase failed. The keytag of the DS record is 56179 : gall@hadron[unbound]; dig ris.ripe.net. ds +short 56179 5 1 B8F1169306DA0679416580D5AC3F43572B3318B6 -- Alex

2 1

DNSSEC deployed in the e164.arpa (ENUM) zone
by Anand Buddhdev 26 Nov '07

26 Nov '07

Dear Colleagues, Earlier today, the RIPE NCC signed the e164.arpa (ENUM) zone. The Key-Signing Keys (KSKs) for all zones signed by the RIPE NCC, including the e164.arpa zone, are available at the following secure URL: https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys-new.txt Details of the key maintenance procedure are available at: http://www.ripe.net/rs/enum/key-maint.html If you have any questions, please send an e-mail to <dns-help(a)ripe.net>. Regards, Anand Buddhev DNS Services Manager, RIPE NCC

1 0

Deployment of DNSSEC in the e164.arpa zone
by Anand Buddhdev 20 Nov '07

20 Nov '07

Dear Colleagues, As previously announced, the RIPE NCC will sign the e164.arpa (ENUM) zone on 26 November 2007. Details of the key maintenance procedure are available at: http://www.ripe.net/rs/enum/key-maint.html The Key Signing Key (KSK) will be published on 26 November 2007 at the following secure URL: https://www.ripe.net/projects/disi/keys/ If you have any questions, please send an e-mail to <dns-help(a)ripe.net>. -- Anand Buddhdev, DNS Services Manager, RIPE NCC

1 0

Re: [dns-wg] (off topic) DNS test protocol
by Austin Kinsella 14 Nov '07

14 Nov '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Both this message and the following one repeated the problem, but enabled me to identify it. It is related to the PGP signature, and seems to be occurring when Mail attempts an auto-verification. The hang does not occur if I open the message with no network connection. I will fire up ethereal and see if I can spot what is happening. Thanks for your help. AK At 12:04 on 13 Nov 2007 Patrik Wallstrom wrote: > I signed the message with PGP/MIME, I can send you a test message and > see if we could repeat the problem. > > -- > patrik_wallstrom->foodfight->pawal(a)blipp.com->+46-733173956 __ Austin Kinsella, Lecturer, Networks & Programming, Institute of Technology, Carlow, Ireland. +353 59 9170417 pgp public key is at http://w3.itcarlow.ie/pgpkey.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFHObdyYoy2ek64z4cRAvolAKCq8iorc6bY/dnMdgvbQ5eI5eLw0gCgoSYN RS3h3hGYAKqZssDbmvpegQM= =8kqR -----END PGP SIGNATURE-----

3 3

DNS test protocol
by Patrik Wallstrom 13 Nov '07

13 Nov '07

Hi, .SE is currently performing DNS tests of consumer broadband routers as we have had problems with DNSSEC and these types of products (EDNS0 and so on). We have been running a number of tests using the attached test specification. However, we would like to broaden the scope of our tests to include non-DNSSEC specific tests such as unknown RR types. If there are more specific tests regarding ENUM or IPv6 we could do please propose them to me. We assume that AAAA works, but could include that as well. We have also decided to test if the router is an open resolver on the external interface. Please read the test protocol and give me your comments, thanks. Patrik Wallström Project Manager, R&D .SE (Stiftelsen för Internetinfrastruktur) E-mail: patrik.wallstrom(a)iis.se Web: http://www.iis.se/

4 5

Announcement DNS for LIRs Training Courses
by RIPE NCC Training Services 12 Nov '07

12 Nov '07

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Tuesday 29 January 2008 Time: 09:00-17:00 Location: London, United Kingdom And Date: Wednesday 20 February 2008 Time: 09:00-17:00 Location: Vienna, Austria Hosted by: Nic.at: http://www.nic.at/ The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

v6 DNS testbed for TLD?
by Ruri Hiromi 26 Oct '07

26 Oct '07

Hello, I just join this mailing-list and I am very new to the DNS- WG@ARIN. As I said in my presentation "what can I do for dns grue record?", If we share some test environment/simulator for conformance and stable operation for TLD name servers, will it go a step forward? Or does ARIN community already have such testbed? Regards, ------------------------------- Ruri Hiromi hiromi(a)inetcore.com

1 1

Advisory - L.ROOT-SERVERS.NET changing to 199.7.83.42 on 2007-11-01
by Kim Davies 24 Oct '07

24 Oct '07

Colleagues, This is advance notice that there is a scheduled change to the IP address for one of the authorities listed for the DNS root zone. The change is to L.ROOT-SERVERS.NET, which is administered by ICANN. The new IPv4 address for this authority is: 199.7.83.42 This change is anticipated to be implemented in the root zone on 1 November 2007, however the new address is operational now. It will replace the previous IP address of 198.32.64.12. We encourage operators of DNS infrastructure to update any references to the old IP address, and replace it with the new address. In particular, many DNS resolvers have a DNS root "hints" file. This should be updated with the new IP address. New hints files will be available at the following URLs once the change has been formally executed: ftp://rs.internic.net/domain/db.cache ftp://rs.internic.net/domain/named.cache ftp://rs.internic.net/domain/named.root ftp://ftp.internic.net/domain/db.cache ftp://ftp.internic.net/domain/named.cache ftp://ftp.internic.net/domain/named.root It is expected that the old address will continue to work for at least six months after the transition, but will ultimately be retired from service. With kindest regards, Kim Davies Internet Assigned Numbers Authority

1 0