Subject: [DNSOP] Re: DNS servers (fwd)

From: Dean Anderson <[email-masked]>
Date: Wed, 7 Nov 2007 17:07:57 -0500 (EST)

The ICANN announcement doesn't seem to have come through on DNSOP as
Patrick indicated.  I can't find it in my archive.... Did anyone else
get it?

		--Dean

---------- Forwarded message ----------
Date: Tue, 6 Nov 2007 16:26:07 -0500
From: Patrick W. Gilmore <[email-masked]>
To: "Nanog@Merit. Edu" <[email-masked]>
Cc: Patrick W. Gilmore <[email-masked]>
Subject: Re: DNS servers

On Nov 6, 2007, at 3:24 PM, Patrick W. Gilmore wrote:
> On Nov 6, 2007, at 3:06 PM, J. Oquendo wrote:
>
>> Nice to get news third string...
>>
>> //
>> Last week, ICANN setup a new IP address for one of the thirteen "root
>> name servers" that oversee DNS queries across the net, and it plans  
>> on
>> retiring the old address as soon as the late spring.
>>
>> http://www.theregister.co.uk/2007/11/06/icann_rolls_out_new_root_name_server_address/
>
> It was posted to DNS-Operations.  Which is where, uh, DNS Operations  
> are discussed....

It was pointed out to me that the sarcasm in this post is not clear.   
I was not disagreeing, it should have been posted to NANOG (as well as  
other places).  I simply didn't notice it 'cause I saw it elsewhere.

Mostly I wanted to give out the info below, which somehow escaped my  
personal knowledgebase until a very nice person from VeriSign  
explained it to me at RIPE a couple weeks ago.

-- 
TTFN,
patrick

> Plus, as long as one of the IP addresses in your hints file is good,  
> it doesn't really matter after launch.  The SOA from one of the  
> roots will override the hints file.
>
> -- 
> TTFN,
> patrick

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Kim Davies <[email-masked]>
Date: Wed, 07 Nov 2007 14:21:47 -0800

> Patrick indicated.  I can't find it in my archive.... Did anyone else

The announcement was posted on 24 October to
[email-masked], [email-masked] and [email-masked],
as well as some other closed lists. I didn't send it to DNSOP as I
figured it was out of the group's charter of "developing guidelines",
but I will note that for the future. If there are any other appropriate
places for such announcements to be sent I'd be happy to include them
for the future.

Apologies to those who didn't get notice through the above.

Whilst I am dispensing the mea culpas, I'll also say it was an oversight
the original email dispatches weren't PGP signed. The root zone and
hints files on internic.net are PGP signed by VRSN if you wish to
cross-verify.

kim

---

From: Kim Davies <[email-masked]>
Date: Wed, 07 Nov 2007 14:21:47 -0800

kim

---

From: "Patrick W. Gilmore" <[email-masked]>
Date: Wed, 7 Nov 2007 17:24:11 -0500

>> Patrick indicated.  I can't find it in my archive.... Did anyone else

Actually, I said it went to "DNS Operations", which is [email-masked] 
, as Kim states below.

-- 
TTFN,
patrick

---

From: "Patrick W. Gilmore" <[email-masked]>
Date: Wed, 7 Nov 2007 17:24:11 -0500

-- 
TTFN,
patrick

---

From: Antonio Querubin <[email-masked]>
Date: Wed, 7 Nov 2007 12:31:14 -1000 (HST)

With all the on-going discussion in various circles going on about IPv6 
it's a pity the root hints is still missing IPv6 addresses.

Antonio Querubin
whois:  AQ7-ARIN

---

From: Antonio Querubin <[email-masked]>
Date: Wed, 7 Nov 2007 12:31:14 -1000 (HST)

Antonio Querubin
whois:  AQ7-ARIN

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 8 Nov 2007 10:07:46 +0100

On Wed, Nov 07, 2007 at 12:31:14PM -1000,
 Antonio Querubin <[email-masked]> wrote 
 a message of 11 lines which said:

> With all the on-going discussion in various circles going on about
> IPv6 it's a pity the root hints is still missing IPv6 addresses.

There is a process going on, at ICANN's usual speed:

http://www.icann.org/committees/security/sac017.htm
http://www.icann.org/committees/security/sac016.htm

After that, we'll have to wait the authorization from the real root
(in Washington, DC).

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 8 Nov 2007 10:07:46 +0100

---

From: Peter Koch <[email-masked]>
Date: Thu, 8 Nov 2007 15:33:15 +0100

Kim,

> figured it was out of the group's charter of "developing guidelines",

thanks for your careful consideration. I'd agree this is a reasonable judgement.

> places for such announcements to be sent I'd be happy to include them

To the extent that we are discussing resolver priming (now you could argue
_me_ should not make this assessment) and DNS software defaults, one
of these rare instances of an address change could have equally reasonable
be seen in-scope. I appreciate your extra effort and see it as a courtesy,
not an obligation.

-Peter
 {hat on, this time}

---

From: Peter Koch <[email-masked]>
Date: Thu, 8 Nov 2007 15:33:15 +0100

Kim,

-Peter
 {hat on, this time}

---

From: Dean Anderson <[email-masked]>
Date: Thu, 8 Nov 2007 23:13:01 -0500 (EST)

> [email-masked], [email-masked] and [email-masked],

[email-masked] list is closed/private to ISC.

[email-masked] list is specific to RIPE. 

[email-masked] purports to be open, but is in fact a private list not
open to the public.

But since you support private mailing lists, please add

	[email-masked] 

to you notification list.

> places for such announcements to be sent I'd be happy to include them

Actually, DNSOP is chartered to provide more than just guidelines. From
the DNSOP Charter:

1. Define the processes by which Domain Name System (DNS) software
      may be efficiently and correctly administered, configured, and
      operated on Internet networks. This will include root zone
      name servers, gTLD name servers, name servers for other DNS
      zones,

Changes to the processes should include notification to DNSOP.  
Significant changes in operation are of interest.

Thanks!

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Dean Anderson <[email-masked]>
Date: Thu, 8 Nov 2007 23:13:01 -0500 (EST)

[email-masked] 

Thanks!

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Thu, 8 Nov 2007 23:18:04 -0500 (EST)

> it's a pity the root hints is still missing IPv6 addresses.

There's no room for IPv6 hints. The 512 byte maximum size is full.  
Turning on ENDSO or requiring TCP connections entangles all sorts of
problems with DNS Root Anycast, because those services aren't stateless,
and Anycast isn't reliable with stateful services.

Of course, there really isn't any reason to have the same 13 IPv4
servers handle IPv6 addresses.  A different set of IPv6 root servers
(not anycasted) is what is needed for IPv6 operation.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Thu, 8 Nov 2007 23:18:04 -0500 (EST)

--Dean

---

From: Joe Abley <[email-masked]>
Date: Fri, 9 Nov 2007 11:56:18 -0500

On 8-Nov-2007, at 23:18, Dean Anderson wrote:

>> IPv6

A priming query response which includes a full set of IPv4 courtesy  
glue in the additional section is 436 bytes long (see below).

It's not clear that there is a requirement for the additional section  
to contain courtesy glue which is represents a complete set of all  
addresses of the thirteen root servers; the practical requirement is  
that it contains enough courtesy glue that an address for at least one  
reachable server is provided.

There is a massive installed base of DNS clients, some very old, and  
hence some degree of caution in adding AAAA glue seems prudent. Such  
caution seems evident in the testbed and associated testing that was  
described in those RSSAC/SSAC URLs that were mentioned earlier.

 From a protocol perspective, however, I think it's clear that a  
response to a priming query which includes AAAA courtesy glue will not  
necessary require EDNS0, or TCP transport.

> and Anycast isn't reliable with stateful services.

I will refrain on commenting on your assertions about the suitability  
of anycast for DNS services, since I have no points to make here that  
have not been made in public many times before.

> (not anycasted) is what is needed for IPv6 operation.

No, there is no requirement to use different servers for IPv6  
operation, and also no need for whichever servers are used not to be  
distributed using anycast.

Joe

[calamari:~]% dig . ns

; <<>> DiG 9.4.1-P1 <<>> . ns
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33203
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13

;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:
.			518400	IN	NS	A.ROOT-SERVERS.NET.
.			518400	IN	NS	B.ROOT-SERVERS.NET.
.			518400	IN	NS	C.ROOT-SERVERS.NET.
.			518400	IN	NS	D.ROOT-SERVERS.NET.
.			518400	IN	NS	E.ROOT-SERVERS.NET.
.			518400	IN	NS	F.ROOT-SERVERS.NET.
.			518400	IN	NS	G.ROOT-SERVERS.NET.
.			518400	IN	NS	H.ROOT-SERVERS.NET.
.			518400	IN	NS	I.ROOT-SERVERS.NET.
.			518400	IN	NS	J.ROOT-SERVERS.NET.
.			518400	IN	NS	K.ROOT-SERVERS.NET.
.			518400	IN	NS	L.ROOT-SERVERS.NET.
.			518400	IN	NS	M.ROOT-SERVERS.NET.

;; ADDITIONAL SECTION:
A.ROOT-SERVERS.NET.	19107	IN	A	198.41.0.4
B.ROOT-SERVERS.NET.	27214	IN	A	192.228.79.201
C.ROOT-SERVERS.NET.	27214	IN	A	192.33.4.12
D.ROOT-SERVERS.NET.	27214	IN	A	128.8.10.90
E.ROOT-SERVERS.NET.	27214	IN	A	192.203.230.10
F.ROOT-SERVERS.NET.	19107	IN	A	192.5.5.241
G.ROOT-SERVERS.NET.	27214	IN	A	192.112.36.4
H.ROOT-SERVERS.NET.	27214	IN	A	128.63.2.53
I.ROOT-SERVERS.NET.	27214	IN	A	192.36.148.17
J.ROOT-SERVERS.NET.	19107	IN	A	192.58.128.30
K.ROOT-SERVERS.NET.	19107	IN	A	193.0.14.129
L.ROOT-SERVERS.NET.	27214	IN	A	199.7.83.42
M.ROOT-SERVERS.NET.	27214	IN	A	202.12.27.33

;; Query time: 168 msec
;; SERVER: 199.212.90.6#53(199.212.90.6)
;; WHEN: Fri Nov  9 11:48:32 2007
;; MSG SIZE  rcvd: 436

[calamari:~]%

---

From: Joe Abley <[email-masked]>
Date: Fri, 9 Nov 2007 11:56:18 -0500

Joe

[calamari:~]% dig . ns

;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:

;; ADDITIONAL SECTION:

;; Query time: 168 msec

[calamari:~]%

---

From: Keith Mitchell <[email-masked]>
Date: Fri, 09 Nov 2007 13:49:42 -0500

> [email-masked] list is closed/private to ISC.

The correct address for this list is <[email-masked]>.
It is not an ISC closed or private list, it is an open list operated by
OARC which anyone may participate in. The public archives can be found at:

	http://lists.oarci.net/pipermail/dns-operations/

Keith Mitchell
OARC Programme Manager

---

From: Keith Mitchell <[email-masked]>
Date: Fri, 09 Nov 2007 13:49:42 -0500

Keith Mitchell
OARC Programme Manager

---

From: Mark Andrews <[email-masked]>
Date: Sat, 10 Nov 2007 16:21:08 +1100

> ;; WHEN: Fri Nov  9 11:48:32 2007

	Additionally the answer to a root priming query would look
	something like this once the AAAA are added.  No EDNS
	involved, no TCP involved.

; <<>> DiG 9.3.4-P1 <<>> ns .
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50718
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 15

;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:
.			437045	IN	NS	f.root-servers.net.
.			437045	IN	NS	i.root-servers.net.
.			437045	IN	NS	k.root-servers.net.
.			437045	IN	NS	l.root-servers.net.
.			437045	IN	NS	j.root-servers.net.
.			437045	IN	NS	g.root-servers.net.
.			437045	IN	NS	h.root-servers.net.
.			437045	IN	NS	m.root-servers.net.
.			437045	IN	NS	a.root-servers.net.
.			437045	IN	NS	d.root-servers.net.
.			437045	IN	NS	c.root-servers.net.
.			437045	IN	NS	b.root-servers.net.
.			437045	IN	NS	e.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net.	172751	IN	A	198.41.0.4
b.root-servers.net.	3600	IN	A	192.228.79.201
c.root-servers.net.	172751	IN	A	192.33.4.12
d.root-servers.net.	172751	IN	A	128.8.10.90
e.root-servers.net.	172752	IN	A	192.203.230.10
f.root-servers.net.	3600	IN	A	192.5.5.241
g.root-servers.net.	172752	IN	A	192.112.36.4
h.root-servers.net.	3600	IN	A	128.63.2.53
i.root-servers.net.	172752	IN	A	192.36.148.17
j.root-servers.net.	172753	IN	A	192.58.128.30
k.root-servers.net.	3600	IN	A	193.0.14.129
l.root-servers.net.	172753	IN	A	199.7.83.42
m.root-servers.net.	3600	IN	A	202.12.27.33
b.root-servers.net.	3600	IN	AAAA	2001:478:65::53
f.root-servers.net.	3600	IN	AAAA	2001:500::1035

;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Nov 10 16:14:55 2007
;; MSG SIZE  rcvd: 492

	Note "preferred-glue A;".  IPv6 clients are all supposed to
	support EDNS.  So their priming query would look like this
	which is less than the IPv6 network MTU.  Again this doesn't
	require TCP.

; <<>> DiG 9.3.4-P1 <<>> +bufsize=1400 ns .
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20864
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 19

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1460
;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:
.			436799	IN	NS	c.root-servers.net.
.			436799	IN	NS	e.root-servers.net.
.			436799	IN	NS	a.root-servers.net.
.			436799	IN	NS	j.root-servers.net.
.			436799	IN	NS	m.root-servers.net.
.			436799	IN	NS	k.root-servers.net.
.			436799	IN	NS	d.root-servers.net.
.			436799	IN	NS	b.root-servers.net.
.			436799	IN	NS	h.root-servers.net.
.			436799	IN	NS	i.root-servers.net.
.			436799	IN	NS	l.root-servers.net.
.			436799	IN	NS	g.root-servers.net.
.			436799	IN	NS	f.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net.	172505	IN	A	198.41.0.4
b.root-servers.net.	3600	IN	A	192.228.79.201
c.root-servers.net.	172505	IN	A	192.33.4.12
d.root-servers.net.	172505	IN	A	128.8.10.90
e.root-servers.net.	172506	IN	A	192.203.230.10
f.root-servers.net.	3600	IN	A	192.5.5.241
g.root-servers.net.	172506	IN	A	192.112.36.4
h.root-servers.net.	3600	IN	A	128.63.2.53
i.root-servers.net.	172506	IN	A	192.36.148.17
j.root-servers.net.	172507	IN	A	192.58.128.30
k.root-servers.net.	3600	IN	A	193.0.14.129
l.root-servers.net.	172507	IN	A	199.7.83.42
m.root-servers.net.	3600	IN	A	202.12.27.33
b.root-servers.net.	3600	IN	AAAA	2001:478:65::53
f.root-servers.net.	3600	IN	AAAA	2001:500::1035
h.root-servers.net.	3600	IN	AAAA	2001:500:1::803f:235
k.root-servers.net.	3600	IN	AAAA	2001:7fd::1
m.root-servers.net.	3600	IN	AAAA	2001:dc3::35

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Nov 10 16:19:01 2007
;; MSG SIZE  rcvd: 587

	Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Sat, 10 Nov 2007 16:21:08 +1100

;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:

;; ADDITIONAL SECTION:

;; Query time: 2 msec

;; OPT PSEUDOSECTION:

;; ANSWER SECTION:

;; ADDITIONAL SECTION:

;; Query time: 4 msec

	Mark