From dknight at ca.afilias.info Tue Jun 2 23:15:23 2009 From: dknight at ca.afilias.info (Dave Knight) Date: Tue, 2 Jun 2009 17:15:23 -0400 Subject: [dns-wg] .ORG is signed Message-ID: Colleagues, On behalf of PIR Technical Support I would like to announce that as of today, 2009-06-02, at 16:00 UTC .ORG is DNSSEC signed. Press release at http://www.afilias.info/afilias+signs+org+zone The following KSK is now valid for .ORG org. IN DNSKEY 257 3 7 ( AwEAAYpYfj3aaRzzkxWQqMdl7YExY81NdYSv+qayuZDo dnZ9IMh0bwMcYaVUdzNAbVeJ8gd6jq1sR3VvP/SR36mm GssbV4Udl5ORDtqiZP2TDNDHxEnKKTX+jWfytZeT7d3A bSzBKC0v7uZrM6M2eoJnl6id66rEUmQC2p9DrrDg9F6t XC9CD/zC7/y+BNNpiOdnM5DXk7HhZm7ra9E7ltL13h2m x7kEgU8e6npJlCoXjraIBgUDthYs48W/sdTDLu7N59rj CG+bpil+c8oZ9f7NR3qmSTpTP1m86RqUQnVErifrH8Kj DqL+3wzUdF5ACkYwt1XhPVPU+wSIlzbaAQN49PU= ) ; key id = 21366 Please note that due to the use of NSEC3 this key should not be used with BIND versions less than 9.6.0. Please refer to http://pir.org/dnssec for more information. As always, please report operational concerns with any Afilias-hosted zone to dave -- Dave Knight Director, Resolution Services Afilias PIR Technical Support URL: http://www.pir.org E-mail: techsupport at pir.org Phone: +1.416.646.3308 Fax: +1.416.646.3305 -------------- next part -------------- A non-text attachment was scrubbed... Name: PGP.sig Type: application/pgp-signature Size: 194 bytes Desc: This is a digitally signed message part URL: From dknight at ca.afilias.info Tue Jun 2 22:25:12 2009 From: dknight at ca.afilias.info (Dave Knight) Date: Tue, 2 Jun 2009 16:25:12 -0400 Subject: [dns-wg] .ORG is signed Message-ID: <1ACA7ACC-6294-4DF1-A071-6A43C01259A9@ca.afilias.info> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Colleagues, On behalf of PIR Technical Support I would like to announce that as of today, 2009-06-02, at 16:00 UTC .ORG is DNSSEC signed. The following KSK is now valid for .ORG org. IN DNSKEY 257 3 7 ( AwEAAYpYfj3aaRzzkxWQqMdl7YExY81NdYSv+qayuZDo dnZ9IMh0bwMcYaVUdzNAbVeJ8gd6jq1sR3VvP/SR36mm GssbV4Udl5ORDtqiZP2TDNDHxEnKKTX+jWfytZeT7d3A bSzBKC0v7uZrM6M2eoJnl6id66rEUmQC2p9DrrDg9F6t XC9CD/zC7/y+BNNpiOdnM5DXk7HhZm7ra9E7ltL13h2m x7kEgU8e6npJlCoXjraIBgUDthYs48W/sdTDLu7N59rj CG+bpil+c8oZ9f7NR3qmSTpTP1m86RqUQnVErifrH8Kj DqL+3wzUdF5ACkYwt1XhPVPU+wSIlzbaAQN49PU= ) ; key id = 21366 Please note that due to the use of NSEC3 this key should not be used with BIND versions less than 9.6.0. Please refer to http://www.pir.org/dnssec/ for more information. As always, please report operational concerns with any Afilias-hosted zone to dave - -- Dave Knight Director, Resolution Services Afilias PIR Technical Support URL: http://www.pir.org E-mail: techsupport at pir.org Phone: +1.416.646.3308 Fax: +1.416.646.3305 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkoliqgACgkQVFeEx/p946bjvACg38xkLPx/oYTQ9NOzb6Oy3dwR 4/kAoNdmG3I/wgaGiMb9n2F94NbLEARZ =M7y/ -----END PGP SIGNATURE----- From wnagele at ripe.net Fri Jun 19 16:13:18 2009 From: wnagele at ripe.net (Wolfgang Nagele) Date: Fri, 19 Jun 2009 16:13:18 +0200 Subject: [dns-wg] Change of K-Root Instance in Frankfurt to a Global Node Message-ID: <4A3B9CFE.4050007@ripe.net> Dear Colleagues, The RIPE NCC (AS25152) upgraded the k.root-servers.net instance in Frankfurt, Germany to a global node on 18 June 2009. This means that we are now announcing the prefix without the BGP no- export attribute. If you have been operating a peering session with us at DE-CIX, you will now see the prefix 193.0.14.0/23 instead of 193.0.14.0/24. Please adjust your filters if necessary. Anybody interested in peering with us can either use the DE-CIX route servers or contact to set up a separate peering session. We also invite anybody who is willing to provide us with transit for this instance to contact us at . Regards, Wolfgang Nagele DNS System Engineer, RIPE NCC From fw at deneb.enyo.de Fri Jun 19 20:12:25 2009 From: fw at deneb.enyo.de (Florian Weimer) Date: Fri, 19 Jun 2009 20:12:25 +0200 Subject: [dns-wg] Change of K-Root Instance in Frankfurt to a Global Node In-Reply-To: <4A3B9CFE.4050007@ripe.net> (Wolfgang Nagele's message of "Fri, 19 Jun 2009 16:13:18 +0200") References: <4A3B9CFE.4050007@ripe.net> Message-ID: <877hz8xfcm.fsf@mid.deneb.enyo.de> * Wolfgang Nagele: > This means that we are now announcing the prefix without the BGP no- > export attribute. If you have been operating a peering session with us > at DE-CIX, you will now see the prefix 193.0.14.0/23 instead of > 193.0.14.0/24. Please adjust your filters if necessary. Doesn't mean that the traffic flows to some local node which leaks globally? Or is this the intent? From anandb at ripe.net Fri Jun 19 21:54:40 2009 From: anandb at ripe.net (Anand Buddhdev) Date: Fri, 19 Jun 2009 21:54:40 +0200 Subject: [dns-wg] Re: Change of K-Root Instance in Frankfurt to a Global Node In-Reply-To: <877hz8xfcm.fsf@mid.deneb.enyo.de> References: <4A3B9CFE.4050007@ripe.net> <877hz8xfcm.fsf@mid.deneb.enyo.de> Message-ID: <4A3BED00.4050309@ripe.net> On 19/6/09 20:12, Florian Weimer wrote: Hi Florian, >> This means that we are now announcing the prefix without the BGP no- >> export attribute. If you have been operating a peering session with us >> at DE-CIX, you will now see the prefix 193.0.14.0/23 instead of >> 193.0.14.0/24. Please adjust your filters if necessary. > > Doesn't mean that the traffic flows to some local node which leaks > globally? Or is this the intent? That's correct, and it is intentional. If a local node leaks the /24 prefix, the sudden surge in traffic should encourage them to quickly stop the leakage. -- Anand Buddhdev DNS Services Manager, RIPE NCC From rendek at ripe.net Mon Jun 22 16:18:46 2009 From: rendek at ripe.net (Paul Rendek) Date: Mon, 22 Jun 2009 16:18:46 +0200 Subject: [dns-wg] RIPE NCC and ICANN Commit to Ongoing DNS Root Name Service Coordination Message-ID: <139A5B26-A0F9-460E-97DE-0166E9E3E06A@ripe.net> [Apologies for duplicates] Dear Colleagues, Dr. Paul Twomey, CEO of ICANN, has posted an open letter to Axel Pawlik, Managing Director of the RIPE NCC, noting ICANN's appreciation of the role RIPE NCC plays as operator of k.root-servers.net, or simply K-root, one of the 13 Internet root name servers. The letter was sent in response to letters sent by the RIPE NCC, Autonomica, operator of I-root, and WIDE Project, operator of M-root, to ICANN in May 2009. The letter notes that both ICANN and the RIPE NCC acknowledge "that a single, unique DNS root is paramount to the stable operations of the Internet and to ensure global interoperability", and that "close ICANN coordination with the root-server operators provides a foundation for a secure, stable and resilient DNS." ICANN and the RIPE NCC have jointly committed to "coordinating their respective activities regarding the DNS root name service with each other and third parties". This includes "exchanging and maintaining the necessary operational and administrative contact information, notifying each other without undue delay of any (pending) operational changes or any (pending) changes in their respective activities". You can view the full text of the letter from ICANN to the RIPE NCC at: http://ripe.net/news/icann-kroot-reply.pdf The text of the May 2009 letter from the RIPE NCC to ICANN can be found here: http://ripe.net/news/root-server-statement-to-icann.html More information about RIPE NCC's operation of K-root is available at: http://k.root-servers.org/ Regards, Paul Rendek Head of External Relations and Communications RIPE NCC