- dns-wg - mailman.ripe.net

Re: Latest version of BIND
by paul＠vix.com 24 Oct '95

24 Oct '95

>Does anybody know about the release date for the FINAL version of >bind-4.9.3. If so, please email it to me at ali(a)protosoft.com. there will be at least another beta. -- Paul Vixie La Honda, CA "Illegitimibus non carborundum." <paul(a)vix.com> pacbell!vixie!paul ----- End Included Message -----

1 0

TLD Questionnaire
by Guy Davies 15 Oct '95

15 Oct '95

Hello All, Here's the first draft for the TLD questionnaire. I propose to send it to the SOA for each European TLD with a note to forward it to the SOA for any neutral subdomains (e.g. co.uk, ac.at) as they are more likely to be aware of the day to day running of the domains available for use by the 'public'. If anyone has any objections or modifications, please contact me and I'll try to include them. If I hear nothing by the end of next week (20th October), I'll send the questionnaire unaltered. If anyone has a list of *all* the European TLDs, please send me a copy so I can mail all the SOAs. Regards, Guy Davies tel: 01223 250122 ---------- fax: 01223 250121 Network Support Engineer email: guyd(a)pipex.net Unipalm PIPEX url: http://www.pipex.net 216 Cambridge Science Park, Milton Road, Cambridge, CB4 4WA -------------------------------------------------------------------------- DNS Questionnaire ================= 1. Who defines your policies? 2. How do you establish your naming policies? 3. What legal status, if any, do your decisions/policies have? 4a. Would you register sub.tld (e.g. co.uk, ac.uk etc)? b. Do you have geographic subdomains in the tld (e.g. state.tld, county.tld)? c. If so, how do you split your tld? 5a. Would you register domain.tld (e.g. microsoft.uk)? b. Would you register domain.sub.tld (e.g. microsoft.co.uk)? 6a. Do you allow individuals to register names or just organisations? b. If you differentiate between individuals and organisations, what are your criteria? 7a. Do you require proof of identity? b. If so, how do you prove the identity of a requestor? 8. Do you register domains only for organisations/individuals located in your country or do you allow anyone to register in your tld? 9a. Do you allow a single organisation to register more than one domain? b. If so, do you limit the number of domains registered by a single organisation? 10a.To whom would you allocate well known names like digital.tld/ digital.sub.tld? b.What criteria do you use when deciding whether or not to allow a name? 11a.How do you arbitrate between two or more claims to the same name? b.Who is responsible for the arbitration? 12a.Do you allow the registration of geographical names (cities, countries, rivers, etc)? b.If so, would you register one for an individual organisation? 13a.Do you have any names which may not be registered (e.g. names in bad taste, names of protocols, etc)? 14a.Do you run secondary nameservice for subdomains of the tld? b.If so, is this optional/mandatory and do you charge for the service? 15a.Do you check for a running nameserver at the time of request? b.Do you check for a running nameserver at regular intervals after the name has been delegated? 16. Do you allow the reservation of names (i.e. no running service)? 17a.Do you charge for reservation/registration of names? b.If so, is it a one off fee, an annual subscription or both? c.How much is the fee? 18a.Do you remove unused domain names? b.If so, how do you define an unused domain? 19. Do you think that the current system you operate will be changed over the next 12 months? 20. Do you accept requests for domains from providers only, from anyone or from a different group only? 21. What resources are allocated to the administration of the domain? 22. Do you have any automation of the registration/delegation process?

1 0

RIPE 22 agenda proposal
by egoshin＠ihep.su 27 Sep '95

27 Sep '95

Hello All, I can suggest the following questions for discussion in nearest RIPE 22 on DNS WG. It is only my opinion, and any comments, proposal and objections are approved. 1. DNS failures. Report about some results of problem investigation. - I can do some short report. - Also it would be beautifull if somebody (from CH?) can comment the last situation about invalid A RR of one root server, I don't have detail information yet. 2. Directions of DNS development. During last IETF I met with Paul Vixie and we have some talk about possible directions of DNS development. I can report about this (DNS v2 ?). 3. Domain name payment. Consequences and problems for cooperation and DNS. It is about last decision of .XXX domain payment. Regards, - Leonid Yegoshin, LY22

1 0

Re: DNS Problem
by Mike Norris 15 Sep '95

15 Sep '95

On Mon, 11 Sep 1995 11:39:26 +0200 Willi Huber <huber(a)chx400.switch.ch> said: >Dear all, > >there seems to be a DNS problem regarding the root name servers. We >(that means the ch top-level DNS server) has picked up several times >now a false A record for E.ROOT-SERVERS.NET. The address picked up is binary >zero. A restart only helps for a short time. Other top-level DNS servers >contain the false entry as well. Are there any recommendations for hostmasters of (1) top-level domains and (2) subsidiary domains? Should all be using the new A, B, C etc list of root-level servers? Many thanks. Mike Norris

4 8

Re: DNS Problem
by e07＠nikhef.nl 15 Sep '95

15 Sep '95

> BTW, 'dig . txt' gives an empty response. Don't know > what to think of that... :-) I know what to think of that. See my message of yesterday on the ripe-list. (Sorry, couldn't resist :-) -- Eric

1 0

Re: DNS Problem
by e07＠nikhef.nl 15 Sep '95

15 Sep '95

> in the old situation one could see at first glance > where a root server is located. With the ABC list > system that's no longer possible. It is at second glance. -- Eric [] for SERVER in A B C D E F G H I [] do [] host -t txt ${SERVER}.root-servers.net [] done A.root-servers.net TXT "formerly ns.internic.net" B.root-servers.net TXT "formerly ns1.isi.edu" C.root-servers.net TXT "formerly c.psi.net" D.root-servers.net TXT "formerly terp.umd.edu" E.root-servers.net TXT "formerly ns.nasa.gov" F.root-servers.net TXT "formerly ns.isc.org" G.root-servers.net TXT "formerly ns.nic.ddn.mil" H.root-servers.net TXT "formerly aos.arl.army.mil" I.root-servers.net TXT "formerly nic.nordu.net"

2 1

Re: DNS Problem
by e07＠nikhef.nl 15 Sep '95

15 Sep '95

> your dislike of the new ABC system. For the sake of > alphabetical order it sacrifices useful positional > information. No, the only reason for the change was to be able to use much better name compression to prevent udp packet overflow for those replies that need the list of all root servers and their addresses. -- Eric

1 0

Re: DNS Problem
by zsako＠banknet.net 15 Sep '95

15 Sep '95

> From: Robert Martin-Legene <robert(a)dknet.dk> > To: Piet Beertema <Piet.Beertema(a)cwi.nl> > Cc: dns-wg(a)ripe.net > On Fri, 15 Sep 1995, Piet Beertema wrote: > > > - In the init file one could still see where a given > > root server is located, by comparing the A record > > with the A records of the root servers. > > A bit complicated.. If the in-addr.arpa didn't map to the root-servers.net > zone, but to the old name you could easily use host -A e.root-servers.net > and find the old "location". Why they didn't do that I'm not really sure.= I suppose it is mainly because the "old location" can have several IP addresses only one of which is defined in the root-servers.net domain (ns.nasa.gov is such an example). This can probably allow for security features such as packet filtering on destination address. By the way, PSI.NET has solved the problem in a similar manner to what you suggest, but the other way round: c.psi.net CNAME c.root-servers.net c.root-servers.net A 192.33.4.12 Janos Zsako

1 0

Announcement: new procedure for in-addr.arpa reverse delegations
by RIPE NCC IN-ADDR. ARPA Role Account 19 Jun '95

19 Jun '95

Dear all, As of today the RIPE NCC offers an automated method for the submission of reverse zone delegations in 193.in-addr.arpa and 194.in-addr.arpa. Your delegation requests and the zone files on all nameservers will be checked automatically. The diagnostics generated by these checks will be returned to you automatically too. This will make you aware of any problems very quickly, so that you can correct them and re-submit your request. When the automated procedure does not detect any errors, the request is forwarded to the inaddr role account person for some additional manual checks and the processing of the delegation itself. Of course, you will receive an acknowledgement when this has been done. To use the new automated procedure send your request in ripe-105 format to: <auto-inaddr(a)ripe.net> You can use some keywords in the 'Subject:' line of your E-mail to control the checking process. The use of the LONGACK keyword is very recommended. HELP - will send you a (patched) ripe-105 document CHANGE - is needed if you want to change an existing reverse delegation LONGACK - will give you the most verbose output as possible RIPE document ripe-105 requires you to send in a RIPE database 'inetnum' object with a 'rev-srv' attribute for each nameserver for single/multiple C's reverse delegation requests and for whole blocks 'domain' objects with 'nserver' attributes for each nameserver. I recommend to use the following procedure for doing your request: Send an E-mail to <auto-inaddr(a)ripe.net> with LONGACK in the 'Subject:' line and an appropriate RIPE database object as described in ripe-105 in the body of the message. We still accept the old method for reverse delegation requests (ripe-105 format request to <inaddr(a)ripe.net>), however it might take some more time to process them. After some time, when the software doesn't change daily anymore, the source code will be published. I am neither a DNS expert or native English writer ;-) so all your comments are welcome! Please send them together with complaints, bug reports or special requests to <inaddr(a)ripe.net>. Kind regards, David Kessens RIPE NCC

1 0

WG minutes draft
by egoshin＠ihep.su 22 May '95

22 May '95

Hello, Below you find the minutes draft of our meeting during RIPE 21 at Rome. You comments are welcome. - Leonid Yegoshin, LY22 -------------------------------------------------------------- DNS working group Chair: Leonid Yegoshin Scribe: Leonid Yegoshin We discussed agenda points in reverse order due to chair initiative. Leonid Yegoshin proposed to speak about new topics before old ones. 1. Mail routing & DNS - what about network load balancing ? Leonid Yegoshin gave short introduction about network resourse load balancing. The primary purpose of it are to diminish load on server hosts and decrease network traffic. Also it is very unlike then mail from one internal host to another internal host going to neigbour organisation or just country follow a MX record set of destination point. There are some activities to split load on network resourses: - use round-robin in DNS answers (BIND 4.9.3) - use short TTL of A records with recalculation of hosts load (see RFC 1794) - use separate sets of name servers for internal and world nets with different representation of DNS tree. Leonid Yegoshin described yet another decision for network resourse load balancing and gave short overview of experimental version of RU-BIND with "region" Resourse Records. This approach based on diversity of sourse IP addresses of DNS requests and description CIDR-syntax net regions in DNS zone. Some discussion were at this point about problems and dangers of this approach. One question was about caching RR's in high level name servers. Answer was that there is TTL=0 which don't cached but used an any way. Another question was about multiply RR's and it's combination in regions. There is the difference in security goal and load balancing - it is not a way to hide some RR's due to forwarder use. Dmitri Sidelnikov said that it is very dangerous approach - it can increase chaos in Internet and debug problems. Leonid Yegoshin lets take in attention that DNS UDP packet size limit is too small to transfer "region" RR of some providers and can be increased for it. Moreover XFER of "regions" require to change XFER format. Carl Malamud suggest Leonid Yegoshin to write RFC draft about it. This suggestion was supported by somebody else. Leonid Yegoshin final question "how many providers are interesting in network resourse load balancing" was remained without definite answer but there was opinion that it will be interesting. 2. DNS & network security (incl DNS security itself) The question "why is it need?" was clear. Commercial server providing require the relayable check of client source domain name (as another information in DNS). No objection was against this point expounded by Leonid Yegoshin. Now there are three ways to check it: - reverse domain check. It is very popular but in general case it is very simple to crash by experienced hacker. Moreover it is crashed time-to-time by some BIND bugs. - Source Responsibility Check (in RU-BIND, ftp://ftp.kiae.su/) or VALIDITY option in BIND 4.9.3. It accept RR's the only from responsible name server, not from arbitrary source. It is powerfull feature but unfortunately it is not work (yet?) in 4.9.3 - some comment exists that VALIDITY is not fully debugged. And it can't protect packet spoofing. - cryptographic sign of DNS exchange. There is RFC draft from DNSSEC WG of IETF for it. Some discussion was started from this point about situation in different countries with cryptography and electronic sign. - Russia (Dmitri Sidelnikov, Leonid Yegoshin cont.) forbidden by default, but license can be obtained from goverment body. Unfortunately it is already clear that the only methods from Russian FAPSI would be licensed (FAPSI is Federal Agency for Goverment Communication and Information). There is the difference between encryption and electronic sign in FAPSI policy, but it is unclear yet. Also the reality is the only FAPSI methods would be used as proof in court - all cryptoanalitic experts are FAPSI experts. - NL (Rob Blokjil) - draft to forbidden was rejected now. - France (Francis Dupont) - forbidden. Electronic sign is legal the only after announce the partners name for message exchange. No any proposal or decision for Europe was done yet about DNS electronic sign. It is obvious that there is very difficult political problem. I think that addition mail discussion is need about situation. Also it is important due to IPv6 authentication & encryption options. 3. What is need to keep in RIPE DB about DNS ? There was not very long discussion about agenda point. There is the objection against keeping information in two places - RIPE DB and DNS. Moreover Piet Beertema has the strong objection against the hold any information about DNS in RIPE DB which was repated in his mail to dns-wg after WG meeting. Nobody insist on holding. After short discussion how we can find in DNS tree the phone/fax and other (TXT records was again proposed for that) David Kessens was offered to propose "something" about distributed access to info (in offline, after meeting). Nobody said anything about separation the organisation and interorganisation domains. 4. What about primary/secondary disposition ? Net failure & DNS - where is the level of backup, what connectivity lost is essential for the European nets ? This topics was discussed together due to lack of time. France and some other time-to-time meet strange problems with root name server access. Discussion about influence of short UDP packet size problem and long root DNS list started. Carl Malamud said what root name servers are need to re-establish near *IX and it can help the problem. Leonid Yegoshin suppose to investigate problems with DNS failure to find the reasons (by himself) in offline. Any provider who has unexplained DNS problem is suggested to contact him about study. 5. After WG meeting. Some talks at lunches found yet another problem with current DNS in CIDR environment - reverse domains for Very Small Enterprises. Now in-addr.arpa standart has minimum 256 hosts in a single zone, and it is an uncomfortable maintenance with VSE. If DNS would be changed some way can be found to decide this large limit.

1 0