Subject: RFC-Editor Down

From: Glen <[email-masked]>
Date: Thu, 29 Nov 2018 08:47:20 -0800

All -

We are aware that the RFC Editor website is down.

It appears to be a domain registration issue.  We are working on it.

Please do not file tickets about the outage:  We are aware of it.

Thank you,
Glen
--
Glen Barney
IT Director
AMS (RFC-Editor Secretariat)

---

From: Glen <[email-masked]>
Date: Thu, 29 Nov 2018 09:37:53 -0800

> Please do not file tickets about the outage:  We are aware of it.

The problem indeed turned out to be an issue with the domain registrar
account.  We have resolved that issue.  Domain service has been
restored.  However, because the registry had suspended the domains by
changing the nameservers for the domains, it may take a number of
hours for the restoration to work its way through DNS caches
worldwide.  So, please be patient, service is restored, but it may
take some time for everyone to see it.

Thank you,
Glen

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 30 Nov 2018 04:51:38 +0000 (UTC)

So Bob's finally ascending to heaven?
these committee decisions to get out of limbo take time... Lloyd Wood [email-masked] http://about.me/lloydwood

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 30 Nov 2018 09:34:40 +0100

On Thu, Nov 29, 2018 at 09:37:53AM -0800,
 Glen <[email-masked]> wrote 
 a message of 19 lines which said:

> The problem indeed turned out to be an issue with the domain
> registrar account.

Duration of the incident, seen by DNSDB <https://www.farsightsecurity.com/solutions/dnsdb/>:

;; first seen: 2018-11-29 08:06:39 -0000
;;  last seen: 2018-11-29 17:11:11 -0000
rfc-editor.org. IN NS ns1641.ztomy.com.
rfc-editor.org. IN NS ns2641.ztomy.com.

ztomy.com was also seen in the LinkedIn incident
<https://www.isc.org/blogs/hijacking-dns-error-ddos-what-happened-and-what-you-can-do/>:

;; first seen   2013-06-20 00:17:09 -0000
;; last seen   2013-06-20 04:13:15 -0000
linkedin.com.   NS   ns1617.ztomy.com.
linkedin.com.   NS   ns2617.ztomy.com.

> We have resolved that issue.  Domain service has been restored.
> However, because the registry had suspended the domains by changing
> the nameservers for the domains, it may take a number of hours for
> the restoration to work its way through DNS caches worldwide.

You can see it through RIPE Atlas <https://atlas.ripe.net/>, here with
the Blaeu tool <https://framagit.org/bortzmeyer/blaeu>. More than 10 %
of the RIPE Atlas probes use a resolver which still see the old NS set:

% blaeu-resolve --type NS --requested 100 rfc-editor.org
[ns0.amsl.com. ns1.ams1.afilias-nst.info. ns1.hkg1.afilias-nst.info. ns1.mia1.afilias-nst.info. ns1.sea1.afilias-nst.info. ns1.yyz1.afilias-nst.info.] : 83 occurrences 
[ns1641.ztomy.com. ns2641.ztomy.com.] : 13 occurrences 
[ns0.ietf.org. ns1.ams1.afilias-nst.info. ns1.hkg1.afilias-nst.info. ns1.mia1.afilias-nst.info. ns1.sea1.afilias-nst.info. ns1.yyz1.afilias-nst.info.] : 1 occurrences 
[ (TRUNCATED - May have to use --ednssize)  ns0.amsl.com. ns1.ams1.afilias-nst.info. ns1.hkg1.afilias-nst.info. ns1.mia1.afilias-nst.info. ns1.sea1.afilias-nst.info. ns1.yyz1.afilias-nst.info.] : 1 occurrences 
Test #17691720 done at 2018-11-30T08:21:33Z

---

From: "Matthew A. Miller" <[email-masked]>
Date: Fri, 30 Nov 2018 11:04:51 -0700

Lloyd,

This missive is offensive and unprofessional, and inappropriate for this
-- and for any @ietf.org -- mailing list.

We urge you to refrain from sending such remarks in the future.

-  IETF Sergeant-at-Arms

On 18/11/29 21:51, Lloyd Wood wrote:
> these committee decisions to get out of limbo take time...
>  
> Lloyd Wood [email-masked] http://about.me/lloydwood
> 
> 
> ------------------------------------------------------------------------
> 
>