Hi, On Wed, Sep 05, 2012 at 04:53:41PM +0200, Shane Kerr wrote:
On Wednesday, 2012-09-05 15:56:01 +0200, Gert Doering <gert@space.net> wrote:
If it's too costly, I assure you that there are several DNS companies that would be happy to take over the task.
So, how would you authenticate that I'm authorized or not to have a DNS delegation for 30.195.in-addr.arpa? Without help of the RIPE NCC?
People seem to be able to manage this on the routing side today, so presumably those mechanisms would work here too.
Do they? What I've seen here that *works* is "query the RIPE DB for the published route(6): objects for a given AS number, and accept that". What I've seen that does *not* work is "believe if the customer tells you that they own a given network" - one /24 out of my address space was announced by a foreign AS, and their upstream *opened up* their filters to permit it, because the customer called and yelled at them... I'm not aware of any IRRDB *that is properly authenticated* that is not run along the RIR hierarchy - RADB is nice, but since anyone can register anything there, it's worthless for actual verification against purposeful misdoings (or sufficiently advanced fat fingers). RPKI is another option - using RIR hierarchy.
But of course it would be even better to have explicit authorization mechanisms. Perhaps the RIRs could develop some sort of address certification technology... ;)
That could be done, yes. Using the PKI tech for "DNSOA" certification - but that smells like much more effort than to just run the DNS servers :-)
I'm not seriously proposing separating DNS management from the RIPE NCC, merely pointing out that all because things have always been done that way doesn't mean that the necessarily have to be done that way.
I agree with you - but still it's enormously comfortable to use the existing knowledge about address space ownership :-) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279