September 2005 - dns-wg - mailman.ripe.net

RIPE's MNAME recommendation
by Paul Herman 04 Oct '05

04 Oct '05

Hello dns-wg list! SUMMARY: In short, in a SOA RR of ours we have an MNAME that corresponds to a primary master server which has a private IP address. This is causing problems with many RIPE member registrars. PROBLEM: Using the language described in Section 2.1 of [RFC 1996], we have a primary master DNS server and two slave DNS servers. The primary master has a private [RFC 1918] IP address and the Slaves have public IP address, are named in the NS RRs for the zone and use zone transfer to recieve the zone from the primary master. Furthermore, in accordance with [RFC 1996], [RPC 1035] and [RIPE1] I have named the primary master as the original/primary source of the data for the zone. Here is an example zone file from what I'm talking about: example.com. 3600 SOA dns.private.example.com. hostmaster.example.com. ( 1999022301 ; serial YYYYMMDDnn 86400 ; refresh ( 24 hours) 7200 ; retry ( 2 hours) 3600000 ; expire (1000 hours) 172800 ) ; minimum ( 2 days) NS slave1.example.com. NS slave2.example.com. slave1 A {public-ip} slave2 A {public-ip} dns.private A 10.11.12.13 So far so good. Our zone appears to be fully RFC compliant. However, the problem arises when I try to transfer, say, the ownership of a ".de" zone using DENIC, because [RIPE1] additionally recommends that this be a valid address of the primary master, "valid" being the key word here. This is a problem, because many RIPE member registrars are indeed enforcing this policy. I gather, however, from more recent messages from Mr. Koch (who authored [RIPE1]), that the "MNAME field need not be part of the NS RRSet and need not be accessible." [ICANN-FORUM]. BTW, to my knowledge this is also neither enforced by IANA nor ICANN. Is it possible that RIPE could consider relaxing this "recommendation" that causes problems for RFC compliant zones? How do you, the DNS community, feel about this? Thank you for your attention in this matter. With kindest regards, Paul Herman Network Architect cleverbrige AG www.cleverbridge.com REFERENCES: ---------- [RFC 1035] Mockapetris,P., "Domain Names - Implementation and Specification", RFC 1035, STD 13, November 1987 [RFC 1918] Y. Rekhter, B. Moskowitz, D. Karrenberg, G. J. de Groot, E. Lear. "Address Allocation for Private Internets." February 1996 [RFC 1996] Vixie,P., "A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)", RFC 1996, August 1996 [ICANN-FORUM] http://forum.icann.org/lists/iana-del-data-comments/msg00004.html [RIPE1] Koch,P., "Recommendations for DNS SOA Values", ripe-203, http://www.ripe.net/ripe/docs/ripe-203.html , June 1999

11 18

RIPE NCC Service Interruption
by RIPE NCC Operations 30 Sep '05

30 Sep '05

[apologies for duplicate mails] Dear Colleagues, >From 07:00 until 08:00 GMT, the RIPE NCC experienced an unexpected disruption to services. Although this may have caused delays to updates to the RIPE Whois Database, these updates have been processed normally. The disruption may have also affected some of these RIPE NCC services: - whois.ripe.net - www.ripe.net - lirportal.ripe.net - ns*.ripe.net - ftp.ripe.net - www.aso.icann.org - www.nro.net - k.root-servers.org (Global node at the AMS-IX) - AS112.ripe.net We apologise for any interruption or delay to services. If you have any questions or concerns regarding this issue, please contact <ops(a)ripe.net>. Regards, RIPE NCC Operations

4 4

Fwd: [dns-wg-chair] 2005-07 One Week to End of Discussion Period
by Jim Reid 29 Sep '05

29 Sep '05

Folks, just a reminder.... If you have any comments on this policy proposal, please submit them in the next couple of days. Begin forwarded message: > From: RIPE NCC Policy Coordinator <adrian(a)ripe.net> > Date: September 29, 2005 08:21:51 BDT > To: dns-wg-chair(a)ripe.net > Cc: Olaf Kolkman <olaf(a)ripe.net> > Subject: [dns-wg-chair] 2005-07 One Week to End of Discussion Period > Reply-To: webmaster(a)ripe.net > > > PDP Number: 2005-07 > Introducing DNSSEC Service to Reverse DNS Trees > > Dear Colleagues > > The "Last Call" period for the new RIPE Document described in proposal > 2005-07 is due to end in one week on 6 October 2005. > > You can find the full proposal at: > > http://www.ripe.net/ripe/policies/proposals/2005-7.html > > When the "Last Call" period ends, we will write to you to ask if > consensus has been reached. > > Regards > > Adrian Bedford > RIPE NCC > > >

1 0

DNS USer
by Chandrashekhar Kulkarni 28 Sep '05

28 Sep '05

Any one how know about dns with kerberose

2 1

upcoming meeting ripe 51
by Jaap Akkerhuis 27 Sep '05

27 Sep '05

The minutes of the ripe-51 DNS-WG can found at the usual place: http://ripe.net/ripe/wg/dns/r50-minutes.html The draft agenda follows below. I'll be off ine the week before the RIPE meeting, so please send remarks etc. directly to the list. jaap Agenda Item Time Speaker Title ------------------------------------------------------------------------------------- Wednesday 16:00 -- 17:00 ------------------------------------------------------------------------------------- A 2 min Agenda bashing & Scribe B 10 min Chair Minutes ripe-50; Action points Reports C.1 5 min Olaf Kolkman -- NLnet Labs IETF DNSEXT WG C.2 5 min Marcos Sanz -- DENIC IETF CRISP WG C.3 5 min Scott Hollenbeck -- Verisign EPP: The next steps Proxied by Jaap Talks D 20 min Lorenzo Colitti -- Ripe NCC Effect of anycast on K-root: early results E 10 min Carsten Strotmann -- Men & Mice DNS Guru contest ------------------------------------------------------------------------------------- Thursday 11:00 -- 12:30 ------------------------------------------------------------------------------------- F 10 min Brett Carr -- RIPE NCC DNS restructuring update at RIPE NCC G 15 min Andrei Robachevsky -- Ripe NCC Deprecation of ip6.int H 15 min Johan Ihren -- Autonomica Key rollover Paper & Tools I 15 min Lars-Johan Liman -- Autonomica Ripe NCC secondary service policy J 15 min Jakob Schlyter -- SUNIC DNSSEC in Sweden K 10 min Peter Koch -- Denic Update to RIPE 203 Recommenda- tions for SOA values L 10 min Peter Koch -- Denic ENUM DNS predelegation checks Z 3 min AOB -------------------------------------------------------------------------------------

1 0

DNSSEC Signed Zones at the RIPE NCC
by Brett Carr 26 Sep '05

26 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Colleagues, As part of the project to deploy DNSSEC in the RIPE NCC Service region, we have been signing a number of zones over recent weeks. The following zones are currently signed: ripe.net ripencc.com ripencc.net ripencc.org ripe-ncc.com ripe-ncc.net ripe-ncc.org If you want to configure your resolvers to verify these zones using DNSSEC, you can get the key signing keys for these zones from: https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys.txt. For information about how to use the keys, and further details about DNSSEC deployment at the RIPE NCC, see: http://www.ripe.net/projects/disi/keys/. Regards Brett Carr RIPE NCC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFDN/0pP/nJBHjtetsRAg+dAJ0fMl1aZPRr+r2P+SIZJQZVlQC7ogCfXpYK LsbPUyhiOoYPBthLRf7lDoc= =AQQB

1 0

NREN swapping secondary name-servers?
by João Pagaime 21 Sep '05

21 Sep '05

Hello all, My name is João Pagaime and I work for FCCN, the Portuguese NREN that also operates the ccTLD-PT We're about to move "edu.pt" to a standalone DNS zone, and I'm searching for a secondary name server outside AS1930 Is there any NREN interested in swapping seconday name service? We can provide for secondary name service along the lines layed out bellow Our general requirements guidelines for the edu.pt are the following: availability requirements------------------------ It would be nice to have no more than 12 hours down time every 3 months that's 99.4% of availability response time------------------------------------ Less that 140 ms "DNS round-trip-time", measured from the .PT primary name server "DNS round-trip-time" on this context is considered to be the time it takes to answer a DNS query. We use "dig" to get this value estimated zone size------------------------------ about 2MB (measured at the secondary server text file) estimated query load-------------------------------- 20 queries/sec update/transfer strategy----------------------------- AXFR with notifies (no need to actually respond to notify. SOA timers suffice) 3 updates every day zone access policy-------------------------------- restricted Thank you, João Pagaime

1 1

RIPE-51 contributions sought.
by Jaap Akkerhuis 13 Sep '05

13 Sep '05

Hi All, It is that time off the year again. Over a month or so you all will be gathering in ``sunny'' Amsterdam for the RIPE-51 meeting. The DNS working group meeting is at Wednesday 16:00-17:00 and Thursday 11:00-12:30, see the meeting plan at the usual place: http://www.ripe.net/ripe/meetings/ripe-51/meeting-plan.html Hereby we are seeking contributions of the agenda. Note that the success of the meeting is as usual depending on you contributions. jaap

1 0

Last call for DNSSEC policy proposal
by Jim Reid 12 Sep '05

12 Sep '05

Colleagues, you'll have seen the email from Henk earlier today about the NCC's policy proposal concerning DNSSEC deployment. We're following the new policy development process (PDP) even though this hasn't been formally adopted yet. The discussion phase is now over and Henk has updated the proposal to incorporate the comments that were made. The new documents are at: http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html http://www.ripe.net/rs/reverse/dnssec/key-maintenance- procedure.html http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html The next stage in the new PDP is the Last Call phase. So this message is to announce that the proposal has entered this phase. We now have 4 weeks to decide whether there is consensus for this proposal. Hopefully this decision can be endorsed by the WG Chairs during RIPE51.

1 0

DNSSEC deployment on the reverse tree.
by Henk Uijterwaal 12 Sep '05

12 Sep '05

Dear Colleagues, In June, Olaf Kolkman wrote: >The RIPE NCC has been involved with the development of the DNSSEC >protocol. Now that the protocol has become available, we plan to >implement DNSSEC on our domains in the reverse DNS tree. The >deployment of DNSSEC is the second and last phase of the Reverse DNS >restructuring project. [...] >We welcome your feedback on this poposal before 1 August 2005. Please >send your comments to the DNS Working Group Mailing List. The comment period was extended to 1 September and some comments were posted to the list. These have all been incorporated and the new documents are at: >You can find the proposed policy at: > ><http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html>http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html. > "DNSSEC Key Maintenance Procedure" > ><http://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html>http://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html > "Procedure for Requesting DNSSEC Delegations" > ><http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html>http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html I'm going to suggest to the chairs of the WG to do a last call on these documents and have them published as RIPE documents. Kind regards, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

1 0