August 2015 - dns-wg - mailman.ripe.net

Advance notice - H-root address change on December 1, 2015
by Kash, Howard M CIV USARMY RDECOM ARL (US) 16 Nov '15

16 Nov '15

This is advance notice that there is a scheduled change to the IP addresses for one of the authorities listed for the DNS root zone and the .ARPA TLD. The change is to H.ROOT-SERVERS.NET, which is administered by the U.S. Army Research Laboratory. The new IPv4 address for this authority is 198.97.190.53. The new IPv6 address for the authority is 2001:500:1::53. This change is anticipated to be implemented in the root zone on 1 December 2015, however the new addresses are operational now. They will replace the previous IP addresses of 128.63.2.53 and 2001:500:1::803f:235 (also previously known as AOS.BRL.MIL and AOS.ARL.ARMY.MIL). We encourage operators of DNS infrastructure to update any references to the old IP addresses and replace them with the new addresses. In particular, many DNS resolvers have a DNS root "hints" file. This should be updated with the new IP addresses. New hints files will be available at the following URLs once the change has been formally executed on December 1: http://www.internic.net/domain/named.root http://www.internic.net/domain/named.cache The old IPv4 address will continue to work for six months after the transition (until 1 June 2016), at which point it will be retired from service. The address will remain under the control of the Army Research Laboratory, never to be used again for DNS service. The old IPv6 address will continue to work indefinitely, but may ultimately be retired from service. Simultaneous to the retirement of the old address on June 1, 2016, the ASN for H-root will change from 13 to 1508. You can monitor the transition of queries to the new addresses at the following URL: http://h.root-servers.org/old_vs_new.html -- Howard Kash U.S. Army Research Laboratory

1 1

Agenda items for RIPE71
by Jim Reid 13 Aug '15

13 Aug '15

Colleagues, it may seem odd to be doing this at the height of the summer holidays when the next RIPE meeting is 3 months away. If you have suggestions for agenda topics or presentations for the WG session(s) in Bucharest, could you please contact the co-chairs at dns-wg-chairs(a)ripe.net? Thanks. The draft meeting plan has allocated just one slot for the WG. It's tentatively scheduled for the Thursday morning (https://ripe71.ripe.net/programme/meeting-plan). The WG will only get a second slot (ideally also on the Thursday) if we have a draft agenda which shows the extra slot is needed. We also need to do that before any other WGs try to grab the currently free slots. So the sooner we can get an outline agenda put together, the better! Your co-chairs often get last-minute suggestions and/or overspill from the plenary which can be tricky to accommodate. That could be harder if we just have a single slot next time. So to avoid disappointment, please try to give us plenty of advance notice for your proposed agenda items and discussion topics. Ta. I hope you all enjoy the summer holidays and look forward to seeing everyone at RIPE71.

1 0

FYI: Live-streaming the Root Zone Key-Signing Key Ceremony 22
by Jaap Akkerhuis 12 Aug '15

12 Aug '15

In case people missed this announcment and are interested. jaap FYI, (Apologies if you see duplicates of this message.) ICANN, as the IANA Functions Operator, will be live-streaming the Root Zone Key-Signing Key Ceremony (number 22) on Thursday, August 13. The "main" ceremony that day is scheduled to begin at 2000UTC. (This is an activity related to DNSSEC.) For more information about the event see: https://www.iana.org/dnssec/ceremonies/22 On Thursday there will be two cermonies as listed on that web page. The first ceremnoy will rotate cryptographic officer duties, basically, a change in some of the trusted community representatives participating in the key ceremonies. The second ceremony (the "main") will feature the introduction of two new Hardware Security Modules. This is the ceremony that will start at 2000 UTC. Please see the above link for more information. The live-streaming link is at the bottom of the page. (https://icann.adobeconnect.com/kskceremony)

1 0

Live-streaming the Root Zone Key-Signing Key Ceremony 22
by Edward Lewis 12 Aug '15

12 Aug '15

FYI, (Apologies if you see duplicates of this message.) ICANN, as the IANA Functions Operator, will be live-streaming the Root Zone Key-Signing Key Ceremony (number 22) on Thursday, August 13. The "main" ceremony that day is scheduled to begin at 2000UTC. (This is an activity related to DNSSEC.) For more information about the event see: https://www.iana.org/dnssec/ceremonies/22 On Thursday there will be two cermonies as listed on that web page. The first ceremnoy will rotate cryptographic officer duties, basically, a change in some of the trusted community representatives participating in the key ceremonies. The second ceremony (the "main") will feature the introduction of two new Hardware Security Modules. This is the ceremony that will start at 2000 UTC. Please see the above link for more information. The live-streaming link is at the bottom of the page. (https://icann.adobeconnect.com/kskceremony)

1 0

FYI: Design Team Review of Plan for DNS Root Zone KSK Change
by Jaap Akkerhuis 07 Aug '15

07 Aug '15

The next annoncement might be of interest to readers this mail list. <https://www.icann.org/public-comments/root-ksk-2015-08-06-en> Purpose: This public comment proceeding seeks to review the Design Team’s findings to date related to issues and plans for changing the cryptographic key used to originate the DNSSEC chain of trust. Current Status: The Design Team has generated a preliminary report and will accept wider review. Next Steps: After the public comment proceeding, the Design Team will finalize its report and plan for changing the cryptographic key. jaap

1 0

RIPE NCC secondary DNS configuration changes complete
by Anand Buddhdev 03 Aug '15

03 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear colleagues, We announced some changes to the RIPE NCC's DNS provisioning infrastructure in June: https://www.ripe.net/ripe/mail/archives/dns-wg/2015-June/003095.html We have now completed this configuration change. The new servers are functioning as the hidden masters for ns.ripe.net, and the old server (193.0.0.198) is no longer performing this function. If you have any questions, please reply to <dns(a)ripe.net> Regards, Anand Buddhdev RIPE NCC -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJVv0GcAAoJEBXgoyUMySoFXeQP/2R5fp28whuZxVWIncpk8wKg 00pZ07BDbPChyaxhF2f6NHMmTfJV3yp1xXI6tIoQbzmo602lTMnBvywH2ic4P8fO vOsSlBHqSkR5SCsNJ+AoMVbqpUygH7Sr9Om3H7hRFWzfS3PWfLd2YSdRRrV9LR9r 8A5B6sqy5dKWGcT1FfBJvmNHXBnLLDaFA6PpibNA8dN+9mteARyPuBPwF/u+tfCC dD4neRw5eI2M7C7B5313W33R4l57oCvHX7eeuKsfRQzWCOMHqlVQoWP/+/JfVZRG iMBtEUKpfXTMNOIDh1ikRHV7Ra6yWY57g8uWqs9umW6PfY3zSGAL1U+U7ExARvyU /6Ags0/71FWQUM26nNnvYuhpWP2IHoNuOHt1IFZ4UqNgGxRH+IGL8Nagm60DeHnT cOltmiygMs2MWs+ej560URsze82pAPFCauqIv1r0HArUhSPQEX90PbsPzyESL4PL G6rJfw5k1PtEApeos9ezlI4HRuMfWHMEO5HgQ5Eb6dSDv7XHfZMbKKxTgup1jPUk sjfSTPidbWj4pFsMkI+a3er8IPk1vEe2Z53BQR+ateMDK6Oa5aUoqz5sZBrklI5z 4EqRsn2Z44bQFVHMv71wiG55r4s9MP+MrBmyS4JIcK1OJmOYt86YBwtT37o+evsT FRu9FqzOQ3L9+wj7S/6h =07hR -----END PGP SIGNATURE-----

2 1