RIPE NCC Operated K-Root Server Distributing Root Zone Signed with DNSSEC

24 March 2010 - The RIPE NCC, the operator of the K-root server, confirmed today that K-root is now serving the signed root zone as part of a staged global deployment of DNSSEC across the root zone system. Starting with L-root in January 2010, the root servers began serving the signed root zone in batches in the form of a Deliberately Unvalidatable Root Zone (DURZ). This rollout period is scheduled to end in May 2010 and ICANN is scheduled to sign the root zone with real keys and release the trust anchor after 1 July 2010.

The RIPE NCC has been supporting the efforts of ICANN for signing the root and as the operator of K-root is participating in a coordinated, staged deployment plan with all other root server operators. Together with other root operators the RIPE NCC participates in coordinated data collection and analysis to monitor the effects of the deployment of DURZ.

In addition, the RIPE NCC has been monitoring and analysing the impact of signing the root. "In preparation for the deployment of the signed root, we looked at all components of the K-root system," noted Andrei Robachevsky, Chief Technical Officer, RIPE NCC. "Together with NLnet Labs we conducted extensive load and TCP tests. Our monitoring system was upgraded as well as the infrastructure in several locations to ensure that all nodes are well provisioned for serving the DURZ."

The RIPE NCC has also provided a range of tools, such as a DNS reply size tool, to help the Internet community prepare for the signing of the root. The reply size test tool, launched late in 2009, enabled users to test if their resolvers were likely to encounter any difficulties resolving names when the root zone is signed with DNSSEC. In January 2010, the RIPE NCC presented the first results and analysis from the DNS reply size testing.

"The idea is to provide a quick and easy to use tool that will enable people to pre-empt potential problems and to identify the correct solution," said Robachevsky. "We've also conducted a range of measurements including packet capture traces of K-root and priming queries. The goal of our effort in this area is to provide the tools and measurements that can best help the RIPE community prepare for the signing of the root zone."

The RIPE NCC plans to collect data continuously, and perform analysis at regular intervals. These results will be available to the community via RIPE Labs as well as the RIPE NCC website and the K-root home page. The primary focus of these efforts is to help the RIPE NCC and the operator community detect and solve any significant issues before 1 July 2010, after which ICANN is scheduled to sign the root zone with real keys.

More information

RIPE Labs

The reply size tool, results and analysis is available from RIPE Labs, a website dedicated to innovative tools, measurements and analysis. This website also features a range of recent articles dealing with Internet number resource measurements, related to IPv4 and IPv6 allocation rates, and DNS developments such as the signing of the root zone.

K-root

More information about the RIPE NCC's activities as the operator of the K-root server is available at:
http://k.root-servers.org/

About the RIPE NCC

Founded in 1992, the RIPE NCC is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet. The most prominent activity of the RIPE NCC is to act as a Regional Internet Registry (RIR) providing global Internet resources and related services to a current membership base of around 6,500 members in over 75 countries.

These members consist mainly of Internet Service Providers (ISPs), telecommunication organisations and large corporations located in Europe, the Middle East and parts of Central Asia.

As one of the world's five RIRs, the RIPE NCC performs a range of critical functions including:

• The reliable and stable allocation of Internet number resources (IPv4, IPv6 and AS Number resources)
• The responsible storage and maintenance of this registration data
• The provision of an open, publicly accessible database where this data can be accessed

The RIPE NCC also provides a range of technical and coordination services for the Internet community. These services include the operation of K-root (one of the 13 root name servers), the Deployment of Internet Security Infrastructure (DISI) and DNS Monitoring (DNSMON). As a result of its established position in the Internet industry, the RIPE NCC has played an important role in the World Summit on the Information Society (WSIS), the Internet Governance Forum (IGF), European Union (EU) workshops and government briefings on key issues in the current Internet landscape.

Media Enquiries

For media enquiries please contact:
Lucie Smith/ Gabriela Warren at Racepoint Group UK
Tel: +44 208 752 3200
Email: ripencc@racepointgroup.com