September 2006 - dns-wg - mailman.ripe.net

DRAFT DNS WG Agenda for RIPE 53
by Peter Koch 02 Oct '06

02 Oct '06

Dear WG, here's the draft agenda for next week's Wed and Thu. -Peter

1 2

2005-02 implementation: IP assignments for anycasting DNS
by leo vegoda 26 Sep '06

26 Sep '06

Dear Colleagues, We are pleased to announce that we will be able to accept e-mailed requests for assignments for anycasting DNS servers from 2 October 2006. The request form and supporting notes will be available from the RIPE Document Store at: http://www.ripe.net/ripe/docs/internet-registries.html We will make a separate announcement when it is possible to make requests via the LIR Portal. Assignments for anycasting DNS will come from reserved blocks: * IPv4 Anycast Assignments (/24) from 194.0.0.0/18 * IPv6 Anycast Assignments (/48) from 2001:0678::/29 You may want to update your filters. Regards, -- leo vegoda Registration Services Manager RIPE NCC

1 0

Lameness Checking Proposal
by Brett Carr 25 Sep '06

25 Sep '06

Dear Colleagues At RIPE 52, the RIPE NCC presented figures on the levels of lame DNS in the reverse tree within its service region. We were asked to propose a procedure for checking and reporting on the level of lameness. We sent a proposal to the DNS Working Group and received some comments. We have incorporated this feedback into a draft RIPE Document that you can find at: http://www.ripe.net/ripe/draft-documents/dns-lameness.html We will include this in a DNS presentation at the upcoming RIPE Meeting in Amsterdam. We welcome your comments and suggestions. Regards -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8

1 0

DNS Lameness Checking Proposal
by Brett Carr 22 Sep '06

22 Sep '06

As per the dns-wg Action point 52.3 from RIPE 52 "post questions and proposal to wg mailing list on how to deal with lame delegations when either the NCC is responsible for maintaining the parent or for running a (secondary) server for the child that is or is about to become delegated lame due to an unavailable *xfr source." Please find attached "dnslamecheckAug2006.txt" a proposal on how the RIPE NCC should test for lameness and what the resulting actions could be. Your feedback and discussion on this proposal is welcomed. Brett Carr. -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8

3 4

dnssec statistics action point 52.2
by Brett Carr 19 Sep '06

19 Sep '06

At the RIPE 52 meeting, the DNS Working Group asked us to provide statistics on secured delegations within RIPE NCC hosted zones. At the time of this e-mail, the figures are as follows: Total number of zones hosted as a primary by RIPE NCC - 113 Total number of primary zones that are signed - 72 Total number of NS records in all zones - 521,811 Total number of DS records in all zones - 61 We are of course happy to answer any questions about these numbers. Background Information: The RIPE NCC hosts the majority of the 41 unsigned zones on behalf of third parties. We can and will continue to expand the list of signed zones. The current keys for all zones that we sign are available at: https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys-new.txt We accept signed delegations (DS records) for all in-addr.arpa zones where we are primary. We cannot currently accept signed delegations (DS records) for those zones in ERX space, where we are not primary for the zone. The two graphs attached to this e-mail show the distribution of both NS and DS records. Regards. Brett. -- Brett Carr RIPE Network Coordination Centre Systems Engineer -- Operations Group Amsterdam, Netherlands GPG Key fingerprint = F20D B2A7 C91D E370 44CF F244 B6A1 EF48 E743 F7D8

3 3

RIPE NCC DNSSEC Key Maintenance: Preemptive Key Signing Key Rollover
by Ruben van Staveren 15 Sep '06

15 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Apologies for duplicate e-mails] Dear Colleagues, Due to the recently published weakness in PKCS 1.5 signatures in OpenSSL RSA crypto, the RIPE NCC will be performing an key signing key (KSK) rollover earlier than planned. We have completed the first phase of the procedure and have published the new Key Signing Keys (KSK's). The deprecated keys will remain valid for a maximum of three months. We recommend that you reconfigure any resolvers to use the new keys. You can download them from: https://www.ripe.net/projects/disi//keys/ripe-ncc-dnssec-keys-new.txt The DNSSEC Key Maintenance Procedure is available at: https://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html The following references may be useful: http://www.openssl.org/news/secadv_20060905.txt http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339 We thank you for your patience and apologise for any inconvenience this maintenance may cause. If you have any questions regarding this maintenance please e-mail: ops(a)ripe.net. Regards, Ruben van Staveren Operations Group RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: For info see https://www.ripe.net/rs/pgp/ iD8DBQFFCVSambreNIsOKy8RAsRWAJ9jVQT++r9aZ3b0sCAl+IMFaUQLrgCfTtFb 5Az85tIv7TrWHVYoyt4Wvto= =tvtB -----END PGP SIGNATURE----- -- Ruben van Staveren RIPE Network Coordination Center Operations Group Singel 258 Amsterdam NL http://www.ripe.net +31 20 535 4444 PGP finger print 6501 4389 A675 477E DCE5 53D8 9108 49E2 DAFC 271B

3 2