(1) by removing AXFR privileges to the world (including our hostcount host, 130.59.1.30), or

(2) by moving to a "split" DNS scheme, in which only hosts with external services (in the "DMZ") are listed in the DNS, the internal hosts being in another version of the organisation's zone which is only visible from the inside.

The latter is proably difficult to work around.

The effect of (1) could be reduced by kindly asking people to allow AXFR from 130.59.1.80 when setting up zones directly under .ch/.li. Some cooperation from large hosting organisations, or ISPs which operate large numbers of secondaries on behalf of their customers would be valuable for keeping the hostcount realistic.

I agree, Simon. We see a lot of (1) in the .ie domain as well and would endorse and widen your plea to apply to all TLDs in the RIPE area. To help in this, RIPE NCC have set up a domain hostcount.ripe.net, which is designed to advertise forward mappings to the hostcount collector in each ccTLD. Thus, for example, ie-collector.hostcount.ripe.net maps to 193.1.193.194, while the reverse mapping is handled locally by the .ie collector (HEAnet in this case). In that way, RIPE NCC authenticates the IP address of their hostcount collectors. I would hope that this would carry some weight with the ISPs/ASPs in question and would persuade them to take part in this collaborative effort.

Asking for such cooperation would be easier if there was a strict privacy policy for the intermediate data produced by the hostcount software.

Absolutely. Mike Norris