April 2012 - dns-wg - mailman.ripe.net

FWD from "policy-announce": Cosmetic Surgery Project: Extended Review Period on New Draft, Document for Reverse Address Delegation of IPv4 and IPv6 Address Space]
by Peter Koch 26 Apr '12

26 Apr '12

DNS WG, this announcement is potentially relevant to this forum. Please note that the 'Cosmetic Surgery Project' does not intend to _change_ policy but to enhance the text readability of the document. Discussion is invited onto the address-policy-wg mailing list (see below). -Peter ----- Forwarded message from Emilio Madaio <emadaio(a)ripe.net> ----- From: Emilio Madaio <emadaio(a)ripe.net> To: policy-announce(a)ripe.net Cc: address-policy-wg(a)ripe.net Subject: [policy-announce] Cosmetic Surgery Project: Extended Review Period on New Draft, Document for Reverse Address Delegation of IPv4 and IPv6 Address Space Date: Thu, 26 Apr 2012 15:10:22 +0200 Reply-To: address-policy-wg(a)ripe.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20120327 Thunderbird/11.0.1 Dear colleagues, As part of the Cosmetic Surgery Project, the RIPE NCC is moving forward with a review of the policy document ripe-302, "Policy for Reverse Address Delegation of IPv4 and IPv6 address space in the RIPE NCC Service Region". A draft of the policy document is online and ready for community review at: https://www.ripe.net/ripe/readability/improving-the-readability-of-ripe-doc… The Address Policy Working Group Co-Chairs decided to extend the review period until 24 May 2012 to allow the community more time to give their feedback. Please send your feedback on this draft document to the Address Policy Working Group at <address-policy-wg(a)ripe.net>. Kind regards, Emilio Madaio Policy Development Officer RIPE NCC ----- End forwarded message -----

1 0

DNSOK queries to k-root
by Daniel Karrenberg 20 Apr '12

20 Apr '12

Further to Olaf Kolkman's question at the meeting: we publish the number of queries with DNSOK set continuously at http://k.root-servers.org/statistics/ROOT/dnssec.html This can be at all times compared to http://k.root-servers.org/statistics/ROOT/nodes.html So the answer to Olaf's question is that at present roughly two thirds of the queries arriving at k-root have the DO-bit set.

4 4

ccTLDs the RIPE NCC provides secondary DNS service for
by Daniel Karrenberg 18 Apr '12

18 Apr '12

In addition to the response I gave at today's meeting about secondary DNS services here is the current list of ccTLDs that receive this service: ad, ae, af, al, am, an, ar, ba, bg, bi, bj, bt, by, ci, cm, cr, cu, cw, dz, er, et, ga, gd, gp, gs, gu, gy, il, is, jm, jo, kg, kh, kz, lk, lv, ly, ma, mc, md, mg, ml, mm, mt, mu, mw, nc, ne, np, om, ph, ps, py, qa, rs, sa, sd, sm, sn, sv, sy, sz, tc, th, tj, to, tp, tr, tt, ua, ug, uy, va, vg, vn, zw Note that for several of these, we also slave a number of SLDs, like co.TLD, org.TLD and so on. For four of these, we also slave their IDN ccTLDs. Daniel

1 0

yet another final WG agenda
by Jim Reid 13 Apr '12

13 Apr '12

This is almost certainly going to be the final version. Famous last words... I forgot to list Robert as the stuckee for the NCC report in the one sent earlier today. So here it is now: # # $Id: agenda,v 1.8 2012/04/13 12:38:07 jim Exp $ # DRAFT AGENDA FOR RIPE64 - There may be last-minute tweaks [0] Usual administrivia (5 mins) [1] NCC Report (10 mins) Robert Kisteleki, RIPE NCC [2] DNSSEC in .si (10 mins) Benjamin Zwittnig Observations and problems encountered during the preparations for .si signing, running a signed .si zone and future plans. [3] Dnssexy (15 mins) Willem Toorop, NLnetLabs Dnssexy (DNS SEc proXY) is a software-program to fortify DNSSEC availability. It operates as a bump in the wire between an hidden master and a public slave. It receives DNS-transfers from the hidden master, but only notifies the public slave when all records are properly assessed by means of a user defined programme. [4] Quality of DNS and DNSSEC in the .se zone (20 mins) Patrick Wallstrom, IIS As part of the Healthcheck programme in .SE, IIS have surveyed the .se zone for DNS quality and a more in-depth analysis of DNSSEC quality, looking at all DNSSEC related parameters and unexpected issues. [5] DNSSEC: dealing with hosts that don't get fragments (20 mins) Roland M. van Rijswijk, SURFnet Middleware Services Even of you sign your zone according to the book, querying hosts that don't accept large responses due to them blocking fragments may cause you grief. This presentation outlines the issues you may encounter and provides guidelines for dealing with them based on research we are currently doing at SURFnet. [6] Followup to Plenary DNS Presentations (10 mins) COFFEE [7] YADIFA Update (10 mins) Peter Janssen, EURid [8] Knot Update (10 mins) Ondřej Surý, CZ.NIC [9] OpenDNSSEC Status Update (15 mins) Jakob Schlyter, OpenDNSSEC The soon-to-be-release version 1.4 and roadmap for version 2.0 (planned for release later in 2012) and beyond. [10] ATLAS measurements & tools (10 mins) Robert Kisteleki, RIPE NCC [11] Dense Anycast Deployment of DNS Authority Servers (20 mins) Dave Knight, ICANN A description of the wide-scale anycast deployment of L-Root by ICANN with a focus on operations and architecture. The presentation will include details of the platform, approaches for automating deployment, distributed configuration management, monitoring and measurement. [12] Panel discussion on DNSChanger (30 mins) [13] AOB

1 0

final(?) agenda for RIPE64
by Jim Reid 13 Apr '12

13 Apr '12

Here's what I hope is the final version. The item on the SATIN conference has been dropped in favour of an update on YAFIDA from Peter Janssen. # # $Id: agenda,v 1.7 2012/04/13 12:14:56 jim Exp $ # DRAFT AGENDA FOR RIPE64 - There may be last-minute tweaks [0] Usual administrivia (5 mins) [1] NCC Report (10 mins) A N Other, RIPE NCC [2] DNSSEC in .si (10 mins) Benjamin Zwittnig Observations and problems encountered during the preparations for .si signing, running a signed .si zone and future plans. [3] Dnssexy (15 mins) Willem Toorop, NLnetLabs Dnssexy (DNS SEc proXY) is a software-program to fortify DNSSEC availability. It operates as a bump in the wire between an hidden master and a public slave. It receives DNS-transfers from the hidden master, but only notifies the public slave when all records are properly assessed by means of a user defined programme. [4] Quality of DNS and DNSSEC in the .se zone (20 mins) Patrick Wallstrom, IIS As part of the Healthcheck programme in .SE, IIS have surveyed the .se zone for DNS quality and a more in-depth analysis of DNSSEC quality, looking at all DNSSEC related parameters and unexpected issues. [5] DNSSEC: dealing with hosts that don't get fragments (20 mins) Roland M. van Rijswijk, SURFnet Middleware Services Even of you sign your zone according to the book, querying hosts that don't accept large responses due to them blocking fragments may cause you grief. This presentation outlines the issues you may encounter and provides guidelines for dealing with them based on research we are currently doing at SURFnet. [6] Followup to Plenary DNS Presentations (10 mins) COFFEE [7] YADIFA Update (10 mins) Peter Janssen, EURid [8] Knot Update (10 mins) Ondřej Surý, CZ.NIC [9] OpenDNSSEC Status Update (15 mins) Jakob Schlyter, OpenDNSSEC The soon-to-be-release version 1.4 and roadmap for version 2.0 (planned for release later in 2012) and beyond. [10] ATLAS measurements & tools (10 mins) Robert Kisteleki, RIPE NCC [11] Dense Anycast Deployment of DNS Authority Servers (20 mins) Dave Knight, ICANN A description of the wide-scale anycast deployment of L-Root by ICANN with a focus on operations and architecture. The presentation will include details of the platform, approaches for automating deployment, distributed configuration management, monitoring and measurement. [12] Panel discussion on DNSChanger (30 mins) [13] AOB

1 0

draft minutes from RIPE63
by Jim Reid 10 Apr '12

10 Apr '12

Colleagues, at long last here they are! Please send any corrections to dns-wg-chair(a)ripe.net.

1 0

draft agenda for RIPE64
by Jim Reid 05 Apr '12

05 Apr '12

Here's the draft agenda for the WG sessions in Ljubljana. It's not clear yet if there will be a report on the SATIN conference. Apart from that, no significant changes are expected. Though there may be the odd tweak to the running order. Have a nice Easter break and hope to see you all at RIPE64. # # $Id: agenda,v 1.6 2012/04/05 11:38:33 jim Exp $ # DRAFT AGENDA FOR RIPE64 - There may be last-minute tweaks [0] Usual administrivia (5 mins) [1] NCC Report (10 mins) A N Other, RIPE NCC [2] DNSSEC in .si (10 mins) Benjamin Zwittnig Observations and problems encountered during the preparations for .si signing, running a signed .si zone and future plans. [3] Dnssexy (15 mins) Willem Toorop, NLnetLabs Dnssexy (DNS SEc proXY) is a software-program to fortify DNSSEC availability. It operates as a bump in the wire between an hidden master and a public slave. It receives DNS-transfers from the hidden master, but only notifies the public slave when all records are properly assessed by means of a user defined programme. [4] Quality of DNS and DNSSEC in the .se zone (20 mins) Patrick Wallstrom, IIS As part of the Healthcheck programme in .SE, IIS have surveyed the .se zone for DNS quality and a more in-depth analysis of DNSSEC quality, looking at all DNSSEC related parameters and unexpected issues. [5] DNSSEC: dealing with hosts that don't get fragments (20 mins) Roland M. van Rijswijk, SURFnet Middleware Services Even of you sign your zone according to the book, querying hosts that don't accept large responses due to them blocking fragments may cause you grief. This presentation outlines the issues you may encounter and provides guidelines for dealing with them based on research we are currently doing at SURFnet. [6] Followup to Plenary DNS Presentations (10 mins) COFFEE [7] Report on SATIN conference? (10 mins) TBD [8] Knot Update (10 mins) Ondřej Surý, CZ.NIC [9] OpenDNSSEC Status Update (15 mins) Jakob Schlyter, OpenDNSSEC The soon-to-be-release version 1.4 and roadmap for version 2.0 (planned for release later in 2012) and beyond. [10] ATLAS measurements & tools (10 mins) Robert Kisteleki, RIPE NCC [11] Dense Anycast Deployment of DNS Authority Servers (20 mins) Dave Knight, ICANN A description of the wide-scale anycast deployment of L-Root by ICANN with a focus on operations and architecture. The presentation will include details of the platform, approaches for automating deployment, distributed configuration management, monitoring and measurement. [12] Panel discussion on DNSChanger (30 mins) [13] AOB

1 0