- dns-wg - mailman.ripe.net

AS information available via DNS
by Tony Bates 12 May '93

12 May '93

Folks, As one of the actions from the last RIPE meeting we have been thinking about a nice way to have an automatic update procedure based on DNS. As a trial for this an auto-script has been been produced that loads current AS derived data into zonefiles under the domain aut-num.ripe.net. This has two very nice features straight away. It allows you to see a list of networks associated with an AS. For example... [mature-tony-1480] host -lt txt as1104.aut-num.ripe.net AS1104.aut-num.ripe.net TXT 192.16.185.0 AS1104.aut-num.ripe.net TXT 192.16.186.0 AS1104.aut-num.ripe.net TXT 192.16.194.0 AS1104.aut-num.ripe.net TXT 192.16.195.0 AS1104.aut-num.ripe.net TXT 192.16.199.0 AS1104.aut-num.ripe.net TXT 192.87.45.0 I currently use TXT records for the zonefiles (suggestions are welcome if something else is more appropriate ?). Also, you can do more interesting things like perhaps generate access-lists.. For Example... [mature-tony-1482] host -lt txt as1104.aut-num.ripe.net | awk '{ printf ("acces s-list 30 permit %s\n", $3)}' access-list 30 permit 192.16.185.0 access-list 30 permit 192.16.186.0 access-list 30 permit 192.16.194.0 access-list 30 permit 192.16.195.0 access-list 30 permit 192.16.199.0 access-list 30 permit 192.87.45.0 and so on. You can also see what ASes are currently in the RIPE database. host -lt ns aut-num.ripe.net aut-num.ripe.net NS mature.ripe.net AS760.aut-num.ripe.net NS mature.ripe.net AS766.aut-num.ripe.net NS mature.ripe.net AS590.aut-num.ripe.net NS mature.ripe.net NONE-LOCAL.aut-num.ripe.net NS mature.ripe.net AS1717.aut-num.ripe.net NS mature.ripe.net AS2107.aut-num.ripe.net NS mature.ripe.net AS2108.aut-num.ripe.net NS mature.ripe.net AS2111.aut-num.ripe.net NS mature.ripe.net AS1205.aut-num.ripe.net NS mature.ripe.net AS786.aut-num.ripe.net NS mature.ripe.net AS2116.aut-num.ripe.net NS mature.ripe.net AS789.aut-num.ripe.net NS mature.ripe.net AS1213.aut-num.ripe.net NS mature.ripe.net AS2119.aut-num.ripe.net NS mature.ripe.net AS1899.aut-num.ripe.net NS mature.ripe.net AS2122.aut-num.ripe.net NS mature.ripe.net AS1739.aut-num.ripe.net NS mature.ripe.net AS1741.aut-num.ripe.net NS mature.ripe.net AS1923.aut-num.ripe.net NS mature.ripe.net AS1752.aut-num.ripe.net NS mature.ripe.net AS1755.aut-num.ripe.net NS mature.ripe.net AS1241.aut-num.ripe.net NS mature.ripe.net AS2148.aut-num.ripe.net NS mature.ripe.net AS137.aut-num.ripe.net NS mature.ripe.net AS1770.aut-num.ripe.net NS mature.ripe.net AS513.aut-num.ripe.net NS mature.ripe.net AS1257.aut-num.ripe.net NS mature.ripe.net AS2004.aut-num.ripe.net NS mature.ripe.net AS517.aut-num.ripe.net NS mature.ripe.net AS679.aut-num.ripe.net NS mature.ripe.net AS1104.aut-num.ripe.net NS mature.ripe.net AS1267.aut-num.ripe.net NS mature.ripe.net AS1274.aut-num.ripe.net NS mature.ripe.net AS1275.aut-num.ripe.net NS mature.ripe.net AS697.aut-num.ripe.net NS mature.ripe.net AS174.aut-num.ripe.net NS mature.ripe.net AS719.aut-num.ripe.net NS mature.ripe.net AS544.aut-num.ripe.net NS mature.ripe.net AS1290.aut-num.ripe.net NS mature.ripe.net AS2380.aut-num.ripe.net NS mature.ripe.net AS2036.aut-num.ripe.net NS mature.ripe.net AS553.aut-num.ripe.net NS mature.ripe.net AS2043.aut-num.ripe.net NS mature.ripe.net AS1324.aut-num.ripe.net NS mature.ripe.net AS559.aut-num.ripe.net NS mature.ripe.net AS378.aut-num.ripe.net NS mature.ripe.net AS1849.aut-num.ripe.net NS mature.ripe.net NONE.aut-num.ripe.net NS mature.ripe.net AS1853.aut-num.ripe.net NS mature.ripe.net AS565.aut-num.ripe.net NS mature.ripe.net AS224.aut-num.ripe.net NS mature.ripe.net AS60.aut-num.ripe.net NS mature.ripe.net The NONE and NONE-LOCAL zones are not currently loaded. The second aspect of this is the possibilty of having an update procedure based on DNS. Here we could delegate the zone to the "guardian" and if we provided a consistency checking tool to avoid conflicts it would be a nice "dynamic" mechanism for updating AS information. We would like to go this way if you feel using DNS is reasonable as opposed to using some form of login/ftp mechanism as previous used for ripe-60 tags and planned for ripe-81. Please let us know your views on this and also please try looking at the information in the aut-num.ripe.net zone. --Tony

2 4

Re: AS information available via DNS
by Tony Bates 06 May '93

06 May '93

"Willem van der Scheun, SARA, +31 20 5923079" <SCHEUN(a)SARA.NL> writes: * Tony, * * This sounds at first sight as a good idea. Fairly dynamic and distributed a * nd * the like. Right. * A remark about the possibility as building access lists and the like. You c * an * do that quite easily of course, but I would like to have one way of buildin * g * access lists (and BGP network lists for that matter) from the RIPE database * . * Currently we are using nlc. I would definitely prefer that we have ONE tool * to * generate the lists. Apart form this other nice solutions may be available. * Talking about this, will te the tool the NCC is working upon (as was report * ed * at the last RIPE), be based on nlc, or is it completely new? Sure - this was only an example of doing things interactively with the information is all. The tools we are working on will be able to make use of nlc also and generate both ASpath lists and network based lists. * * If you delegate zones should this delegation also be put in the AS object l * ike * it is in the domain object? Delegation can not be done to the guardian (I g * uess * that's why you used double quotes). For AS1103 (SURFnet) the guardian is a * alias for a list of responsibles. If you put delegation info in the AS info * , Well the thing is. Whatever way the update is done it will be some form of file maintainence and whether that is here or there, to me at least doesn't make a lot of difference even if it is multiple people maintaining the zone. * should this state nserver as well as zone-c and tech-c? * Possibly if it is decided this is how the update procedure is done. * Willem --T

1 0

RE: AS information available via DNS
by Willem van der Scheun, SARA, +31 20 5923079 06 May '93

06 May '93

Tony, This sounds at first sight as a good idea. Fairly dynamic and distributed and the like. A remark about the possibility as building access lists and the like. You can do that quite easily of course, but I would like to have one way of building access lists (and BGP network lists for that matter) from the RIPE database. Currently we are using nlc. I would definitely prefer that we have ONE tool to generate the lists. Apart form this other nice solutions may be available. Talking about this, will te the tool the NCC is working upon (as was reported at the last RIPE), be based on nlc, or is it completely new? If you delegate zones should this delegation also be put in the AS object like it is in the domain object? Delegation can not be done to the guardian (I guess that's why you used double quotes). For AS1103 (SURFnet) the guardian is a alias for a list of responsibles. If you put delegation info in the AS info, should this state nserver as well as zone-c and tech-c? Willem

1 0

193.in-addr.arpa procedures -> ripe-85
by Marten Terpstra 03 May '93

03 May '93

Folks, The 193.in-addr.arpa delegation procedures have been made into a RIPE document ripe-85. Only changes since version 1.4 are a few typos and cosmetic. You can find it as ftp.ripe.net:ripe/docs/ripe-docs/ripe-85.txt It is now version 1.5. Before asking for a block delegation, please read the document. Cheers, -Marten

1 0

193.in-addr.arpa procedures v1.4
by Marten Terpstra 19 Apr '93

19 Apr '93

Here's version 1.4 of the 193.in-addr.arpa delegation procedures. I have included Piet's recommended timer values, and the comment on reachability of servers for zones for individual nets. Please note that the second part of these procdures (single net delegations done by the NCC) is NOT yet in operation. Single net delegations in 193.x.y still have to be requested from hostmaster(a)ripe.net. After next weeks RIPE meeting we hope to implement the automatic procedure as soon as possible. The code is there, the operational environment isn't yet ;-) -Marten Guidelines for the delegation of zones in the 193.in-addr.arpa domain Marten Terpstra April 1993 V1.4 Introduction This document describes the procedures for the delegation of authority of zones in the 193.in-addr.arpa domain. As of March 16th 1993 the RIPE NCC has been delegated the authority for the 193.in-addr.arpa domain from the root. Due to the fact that in the 193.x.y address space blocks of 256 class C network numbers are further delegated to local registries , the possibility exists to also delegate the zone for these blocks in the 193.in-addr.arpa domain. This document describes some guidelines and procedures for this type of delegation and the delegation of reverse zones for individual class C networks in 193.x.y. A bit more explained With the assignment of class C network numbers following the CIDR (RFC 1338) model, in which large chunks of the address space are delegated to one region, and within that region blocks of class C network numbers are delegated to service providers and non-provider registries, some hierarchy in the address space is created, similar to the hierarchy in the domain name space. Due to this hierarchy the reverse Domain Name System mapping can also be delegated in a similar model as used for the normal Domain Name System. For instance, the RIPE NCC has been assigned the complete class C address space starting with 193. It is therefore possible to delegate the 193.in-addr.arpa domain completely to the RIPE NCC, instead of each and every reverse mapping in the 193.in-addr.arpa domain to be registered with the INTERNIC. This implies that all 193.in-addr.arpa resistrations will be done by the RIPE NCC. Even better, since service providers receive complete class C network blocks from the RIPE NCC, the RIPE NCC can delegate the reverse registrations for such complete blocks to these local registries. This implies that customers of these service providers no longer have to register their reverse domain mapping with the root, but the service provider have authority over that part of the reverse mapping. This decreases the workload on the INTERNIC and the RIPE NCC, and at the same time increase the service a provider can offer its customers by improve response times for reverse mapping changes . However there are some things that need to be examined a bit more closely to avoid confusion and inconsistencies. These issues are covered in the next section. Procedures for the delegation of direct subdomains of 193.in-addr.arpa 1. A secondary nameserver at ns.ripe.net is mandatory for all blocks of class C network numbers delegated in the 193.in-addr.arpa domain. 2. Because of the increasing importance of correct reverse address mapping, for all delegated blocks a good set of secondaries must be defined. There should be at least 2 nameservers for all blocks delegated, excluding the RIPE NCC secondary. 3. The delegation of a class C block in the 193.in-addr.arpa domain can be requested by sending in a domain object for the RIPE database to <hostmaster(a)ripe.net> with all necessary contact and nameserver information. The RIPE NCC will then forward all current reverse zones inside this block to the registry, and after addition of these by the registry, the NCC will check the working of the reverse server. Once everything is setup properly, the NCC will delegate the block, and submit the database object for inclusion in the database. An example domain object can be found at the end of this document. 4. All reverse servers for blocks must be reachable from the whole of the Internet. In short, all servers must meet similar connectivity requirements as top-level domain servers. 5. Running the reverse server for class C blocks does not imply that one controls that part of the reverse domain, it only implies that one administers that part of the reverse domain. 6. Before adding individual nets, the administrator of a reverse domain must check wether all servers to be added for these nets are indeed setup properly. 7. There are some serious implications when a customer of a service provider that uses address space out of the service provider class C blocks, moves to another service provider. The previous service provider cannot force its ex-customer to change network addresses, and will have to continue to provide the appropriate delegation records for reverse mapping of these addresses, even though it they are no longer belonging to a customer. 8. The registration of the reverse zones for individual class C networks will usually be done by the registry administering the class C block this network has been assigned from. The registry will make the necessary changes to the zone, and update the network objects in the RIPE database for these networks, to reflect the correct "rev-srv" fields. In case the RIPE NCC receives a request for the reverse zone of an individual class C network out of a block that has been delegated, the request will be forwarded to the zone contact for this reverse block. 9. The NCC advises the following timers and counters for direct subdomains of 193.in-addr.arpa: 8 hours refresh (28800 seconds), 2 hours retry (7200 seconds), 7 days expire (604800 seconds) and 1 day Time To Live (86400 seconds). The retry counter should be lowered where connectivity is unstable. Above procedures are defined to ensure the necessary high availability for the 193 reverse domains, and to minimize confusion. The NCC will ensure fast repsonse times for addition requests, and will in principle update the 193.in-addr.arpa domain at least once per working day. Example domain object to request a block delegation domain: 202.193.in-addr.arpa descr: Pan European Organisations class C block admin-c: Daniel Karrenberg tech-c: Marten Terpstra zone-c: Marten Terpstra nserver: ns.eu.net nserver: sunic.sunet.se nserver: ns.ripe.net changed: marten(a)ripe.net 930319 source: RIPE Procedures for the delegation of individual network zones by the RIPE NCC. The registration of the reverse zones for individual class C networks will usually be done by the registry administering the class C block this network has been assigned from. In case the zone corresponding to the class C block has not been delegated, the RIPE NCC will automatically add the reverse nameserver as specified in the "rev-srv" attribute of the RIPE database object for this network, using the following procedures: 1. Because of the increasing importance of correct reverse address mapping, for all delegated networks a good set of secondaries must be defined. There should be at least two nameservers for all networks delegated. 2. The "rev-srv" field should ONLY contain one fully qualified domain name of a nameserver which is authoritative for the reverse zone for this network. 3. If a network has or is going to have any external connectivity, it is strongly recommended that it has at least one reverse nameserver that can be reached from all of the Internet. 4. The checking and addition of the reverse zones for single networks is completely automated at the RIPE NCC. Although we do our best to check the setup of the nameservers, these does not receive the same level of scrutiny as nameservers for blocks of class C network numbers. It is the responsibility of the network contacts to ensure proper operation. 5. Any problems regarding the reverse zones in 193.in-addr.arpa should be directed to <hostmaster(a)ripe.net>. The NCC also suggests that similar procedures are set up for the delegation of reverse zones for individual class C networks from the registries to individual organisations.

1 0

Remark on 193.in-addr.arpa procedures
by Marten Terpstra 19 Apr '93

19 Apr '93

Folks, please have a read of the remark below. We sort of feel he Hakan has a point here. Did we miss something ? If not, then I will change the procedures to reflect this remark. -Marten ------- Forwarded Message Date: Thu, 8 Apr 93 12:57:15 +0200 From: hh(a)tip.net (Hakan Hansson) To: Marten.Terpstra(a)ripe.net cc: staff(a)tip.net Subject: Reachability of reverse servers. > Guidelines for the delegation > of zones in the 193.in-addr.arpa domain ... >4. All reverse servers for blocks must be reachable from the whole of >the Internet. In short, all servers must meet similar connectivity >requirements as top-level domain servers. ... >Procedures for the delegation of individual network zones ... >3. At least two reverse servers must be reachable from the whole of the >Internet. In short, these servers must meet similar connectivity >requirements as top-level domain servers. Marten, I've been thinking about the above guidelines. I fully agree with the statements in item 4 for block delegation, but I now realize I don't agree on item 3 for individual networks. I can't see why at least two reverse servers should be reachable from the whole of Internet. It must be enough that they are equally reachable as the actual network they are reverse serving for, or? If a network doesn't have NSFnet connectivity (that is what we are talking about, and should be mentioned in your document!), there is no need for anyone at NSF to lookup the reverse zone for that network either. These requriements don't apply to 192 networks, so why for 193? Regards, Hakan Hansson == Unisource Business Networks Sverige AB == Unidata IP Services * TIPnet NCC * Sweden == phone +46-31-7708072 * fax +46-31-114664 ------- End of Forwarded Message

2 1

Re: Question about top-level domains?
by pietrak＠camk.edu.pl 02 Apr '93

02 Apr '93

Date: Fri, 2 Apr 93 13:17:21 +0200 From: mfendt(a)eso.org I have a question or better need a clarification about the report of the DNS working group (on the 14 Ripe meeting in Prag, 25-27.1.1993) One of the topics was the "propper" top-level domain of multinational organizations, like European Parliament. (case of the day) The suggestions were: .org: rejected because it is not a North American organization. My questions are the following: Is there anywhere mentioned that .org top-level domain is only for North America organisations? Or does this rejection have any other reasons? The solution choosen (again for the European Parliament) was using the country top level domain and have the name reserved in every (member?) country. This solution implies for me that any European Institution (which has a similiar status like the European Parliament) should follow that roule (or would it be acceptable that other institutions would achieve different solutions? I hope so,because I hate changing names :-)) Sorry to buzzz with my 0.02$ wirth, but the sulution selected for the European Parlament is a clear misshap. EC meens something above countries so there is no reason to declare it _under_ country codes. A clean way to do it would be to declare such organization in town/country where it has its HQ. For 'migrating HQ' organization may sellect a place. On the other hand; a name is just a name, who cares. -Rafal

1 0

Question about top-level domains?
by mfendt＠eso.org 02 Apr '93

02 Apr '93

Hello, I have a question or better need a clarification about the report of the DNS working group (on the 14 Ripe meeting in Prag, 25-27.1.1993) One of the topics was the "propper" top-level domain of multinational organizations, like European Parliament. (case of the day) The suggestions were: .org: rejected because it is not a North American organization. My questions are the following: Is there anywhere mentioned that .org top-level domain is only for North America organisations? Or does this rejection have any other reasons? The solution choosen (again for the European Parliament) was using the country top level domain and have the name reserved in every (member?) country. This solution implies for me that any European Institution (which has a similiar status like the European Parliament) should follow that roule (or would it be acceptable that other institutions would achieve different solutions? I hope so,because I hate changing names :-)) Michael Fendt ________________________________________________________________________________ Michael Fendt ESO (European Southern Observatory) Karl-Schwarzschildstr. 2 D-8046 Garching Germany Tel: +49 89 32006 441 Fax: +49 89 32023 62 email: mfendt(a)eso.org

1 0

193.in-addr.arpa procedures V1.3
by Marten Terpstra 29 Mar '93

29 Mar '93

Folks, One last go. I think we folded in most of the comments from Blaso and others. We have included the procedures for single class C reverse zones, not via block zones. We are already doing our first trials with block delegations, all seems to work fine. Please let's get this document accepted and delegate these blocks. -Marten Guidelines for the delegation of zones in the 193.in-addr.arpa domain Marten Terpstra March 1993 V1.3 Introduction This document describes the procedures for the delegation of authority of zones in the 193.in-addr.arpa domain. As of March 16th 1993 the RIPE NCC has been delegated the authority for the 193.in-addr.arpa domain from the root. Due to the fact that in the 193.x.y address space blocks of 256 class C network numbers are further delegated to local registries , the possibility exists to also delegate the zone for these blocks in the 193.in-addr.arpa domain. This document describes some guidelines and procedures for this type of delegation and the delegation of reverse zones for individual class C networks in 193.x.y. A bit more explained With the assignment of class C network numbers following the CIDR (RFC 1338) model, in which large chunks of the address space are delegated to one region, and within that region blocks of class C network numbers are delegated to service providers and non-provider registries, some hierarchy in the address space is created, similar to the hierarchy in the domain name space. Due to this hierarchy the reverse Domain Name System mapping can also be delegated in a similar model as used for the normal Domain Name System. For instance, the RIPE NCC has been assigned the complete class C address space starting with 193. It is therefore possible to delegate the 193.in-addr.arpa domain completely to the RIPE NCC, instead of each and every reverse mapping in the 193.in-addr.arpa domain to be registered with the INTERNIC. This implies that all 193.in-addr.arpa resistrations will be done by the RIPE NCC. Even better, since service providers receive complete class C network blocks from the RIPE NCC, the RIPE NCC can delegate the reverse registrations for such complete blocks to these local registries. This implies that customers of these service providers no longer have to register their reverse domain mapping with the root, but the service provider have authority over that part of the reverse mapping. This decreases the workload on the INTERNIC and the RIPE NCC, and at the same time increase the service a provider can offer its customers by improve response times for reverse mapping changes . However there are some things that need to be examined a bit more closely to avoid confusion and inconsistencies. These issues are covered in the next section. Procedures for the delegation of direct subdomains of 193.in-addr.arpa 1. A secondary nameserver at ns.ripe.net is mandatory for all blocks of class C network numbers delegated in the 193.in-addr.arpa domain. 2. Because of the increasing importance of correct reverse address mapping, for all delegated blocks a good set of secondaries must be defined. There should be at least 2 nameservers for all blocks delegated, excluding the RIPE NCC secondary. 3. The delegation of a class C block in the 193.in-addr.arpa domain can be requested by sending in a domain object for the RIPE database to <hostmaster(a)ripe.net> with all necessary contact and nameserver information. The RIPE NCC will then forward all current reverse zones inside this block to the registry, and after addition of these by the registry, the NCC will check the working of the reverse server. Once everything is setup properly, the NCC will delegate the block, and submit the database object for inclusion in the database. An example domain object can be found at the end of this document. 4. All reverse servers for blocks must be reachable from the whole of the Internet. In short, all servers must meet similar connectivity requirements as top-level domain servers. 5. Running the reverse server for class C blocks does not imply that one controls that part of the reverse domain, it only implies that one administers that part of the reverse domain. 6. Before adding individual nets, the administrator of a reverse domain must check wether all servers to be added for these nets are indeed setup properly. 7. There are some serious implications when a customer of a service provider that uses address space out of the service provider class C blocks, moves to another service provider. The previous service provider cannot force its ex-customer to change network addresses, and will have to continue to provide the appropriate delegation records for reverse mapping of these addresses, even though it they are no longer belonging to a customer. 8. The registration of the reverse zones for individual class C networks will usually be done by the registry administering the class C block this network has been assigned from. The registry will make the necessary changes to the zone, and update the network objects in the RIPE database for these networks, to reflect the correct "rev-srv" fields. In case the RIPE NCC receives a request for the reverse zone of an individual class C network out of a block that has been delegated, the request will be forwarded to the zone contact for this reverse block. Above procedures are defined to ensure the necessary high availability for the 193 reverse domains, and to minimize confusion. The NCC will ensure fast repsonse times for addition requests, and will in principle update the 193.in-addr.arpa domain at least once per working day. Example domain object to request a block delegation domain: 202.193.in-addr.arpa descr: Pan European Organisations class C block admin-c: Daniel Karrenberg tech-c: Marten Terpstra zone-c: Marten Terpstra nserver: ns.eu.net nserver: sunic.sunet.se nserver: ns.ripe.net changed: marten(a)ripe.net 930319 source: RIPE Procedures for the delegation of individual network zones The registration of the reverse zones for individual class C networks will usually be done by the registry administering the class C block this network has been assigned from. In case the zone corresponding to the class C block has not been delegated, the RIPE NCC will automatically add the reverse nameserver as specified in the "rev-srv" attribute of the RIPE database object for this network, using the following procedures: 1. Because of the increasing importance of correct reverse address mapping, for all delegated networks a good set of secondaries must be defined. There should be at least two nameservers for all networks delegated. 2. The "rev-srv" field should ONLY contain one fully qualified domain name of a nameserver which is authoritative for the reverse zone for this network. 3. At least two reverse servers must be reachable from the whole of the Internet. In short, these servers must meet similar connectivity requirements as top-level domain servers. 4. The checking and addition of the reverse zones for single networks is completely automated at the RIPE NCC. Although we do our best to check the setup of the nameservers, these does not receive the same level of scrutiny as nameservers for blocks of class C network numbers. It is the responsibility of the network contacts to ensure proper operation. 5. Any problems regarding the reverse zones in 193.in-addr.arpa should be directed to <hostmaster(a)ripe.net>. The NCC also suggests that similar procedures are set up for the delegation of reverse zones for individual class C networks from the registries to individual organisations.

4 5

Blocks in 193.in-addr.arpa domain document
by Marten Terpstra 24 Mar '93

24 Mar '93

Folks, Here's the updated document. I was planning on sending this out over the weekend, but forgot the modem cable ;-( Anyway, let's see if we can get agreement on this. Please note that the database specific things I do not want to spend too much on, this should be done at the RIPE meeting. A few more days to comment. Want to start delegating blocks end of the week, and during next week (although I will be at the IETF). -Marten Guidelines for the delegation of class C blocks in the 193.in-addr.arpa domain Marten Terpstra March 1993 V1.1 Introduction This document describes the procedures for the delegation of authority of zones in the 193.in-addr.arpa domain. As of March 16th 1993 the RIPE NCC has been delegated the authority for the 193.in-addr.arpa domain from the root. Due to the fact that in the 193.x.y address space blocks of 256 class C network numbers are further delegated to local registries and national registries, the possibility exists to also delegate the zone for these blocks in the 193.in-addr.arpa domain. This document describes some guidelines and procedures for this type of delegation. A bit more explained With the assignment of class C network numbers following the CIDR (RFC 1338) model, in which large chunks of the address space are delegated to one region, and within that region blocks of class C network numbers are delegated to service providers and national registries, some hierarchy in the address space is created, similar to the hierarchy in the domain name space. Due to this hierarchy the reverse Domain Name System mapping can also be delegated in a similar model as used for the normal Domain Name System. For instance, the RIPE NCC has been delegated the complete class C address space starting with 193. It is therefore possible to delegate the 193.in-addr.arpa domain completely to the RIPE NCC, in stead of each and every reverse mapping in the 193.in-addr.arpa domain to be registered with the INTERNIC. This implies that all 193.in-addr.arpa resistrations will be done by the RIPE NCC. Even better, since service providers receive complete class C network blocks from the RIPE NCC, the RIPE NCC can delegate the reverse registrations for such complete blocks to these local registries. This implies that customers of these service providers no longer have to register their reverse domain mapping with the root, but the service provider have authority over that part of the reverse mapping. This decreases the workload on the INTERNIC and the RIPE NCC, and at the same time increase the service a provider can offer its customers and response times for such additions. However there are some things that need to be examined a bit more closely to avoid confusion and inconsistencies. These issues are covered in the next section. Procedures 1. A secondary nameserver at ns.ripe.net is mandatory for all blocks of class C network numbers delegated in the 193.in-addr.arpa domain. 2. Because of the increasing importance of correct reverse address mapping, for all delegated blocks a good set of secondaries must be defined. There should be at least 2 nameservers for all blocks delegated, excluding the RIPE NCC secondary. 3. The delegation of a class C block in the 193.in-addr.arpa domain can be requested by sending in a domain object for the RIPE database to <hostmaster(a)ripe.net> with all necessary contact and nameserver information. The RIPE NCC will then forward all current reverse zones inside this block to the registry, and after addition by the registry, the NCC will check the working of the reverse server. Once everything is setup properly, the NCC will delegate the block, and submit the database object for inclusion in the database. An example domain object can be at the end of this document. 4. All reverse servers for blocks must be reachable from the whole of the Internet. In short, all servers must meet similar connectivity requirements as top-level domain servers. 5. Running the reverse server for class C blocks does not imply that one controls that part of the reverse domain, it only implies that one administers that part of the reverse domain. 6. Before adding individual nets, the administrator of a reverse domain must check wether all servers to be added for these nets are indeed setup properly. 7. There are some serious implications when a customer of a service provider that uses address space out of the service provider class C blocks, moves to another service provider. The service provider cannot force its ex-customer to change network addresses, and will have to continue to provide the appropriate delegation records for reverse mapping of these addresses, even though it is no longer a customer of his. 8. The registration of the reverse zones for individual class C networks will usually be done by the registry administering the class C block this network has been assigned from. The registry will make the necessary changes to the zone, and update the network objects in the RIPE database for these networks, to reflect the correct "rev-srv" fields. In case the RIPE NCC receives a request for the reverse zone of an individual class C network out of a block that has been delegated, the request will be forwarded to the zone contact for this reverse block. Above procedures are defined to ensure the necessary high availability for the 193 reverse domains, and to minimize confusion. The NCC will ensure fast repsonse times for addition requests, and will in principle update the 193.in-addr.arpa domain at least once per working day. The NCC also suggests that similar procedures are set up for the delegation of reverse zones from the registries to individual organisations. Example domain object to request a block delegation domain: 202.193.in-addr.arpa descr: Pan European Organisations class C block admin-c: Daniel Karrenberg tech-c: Marten Terpstra zone-c: Marten Terpstra nserver: ns.eu.net nserver: sunic.sunet.se nserver: ns.ripe.net changed: marten(a)ripe.net 930319 source: RIPE

3 3