Subject: DNSSEC change on IETF web pages

From: IETF Chair <[email-masked]>
Date: Wed, 25 Feb 2015 15:08:46 -0800

Some time ago we moved the static parts of the IETF web page to
a CDN service. While this provided a significant improvements for
page load times and retained our ability to serve the pages over
IPv6, we were unable to provide DNSSEC for the web pages 
that were being served by the CDN.

Our CDN vendor, Cloudfare, however, has worked in the 
background to enable DNSSEC for their customers. They 
have now come back with a system that we have enabled 
for the IETF web pages. (Thank you Cloudfare, this was
important!)

We plan to keep the new arrangement on at
http://dnssec.ietf.org for a while before finally moving
to this arrangement on http://www.ietf.org. Testing the
new arrangement on dnssec.ietf.org would be
appreciated!

Jari Arkko, IETF Chair

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 26 Feb 2015 08:45:46 +0100

On Wed, Feb 25, 2015 at 03:08:46PM -0800,
 IETF Chair <[email-masked]> wrote 
 a message of 19 lines which said:

> Our CDN vendor, Cloudfare, however, has worked in the background to
> enable DNSSEC for their customers. They have now come back with a
> system that we have enabled for the IETF web pages.

I don't know if it's related but several instances of the ietf.org
name servers reply SERVFAIL (reported as ticket [www.ietf.org/rt
#73651]):

% dig +nsid @65.22.8.1 SOA ietf.org

; <<>> DiG 9.9.5-8-Debian <<>> +nsid @65.22.8.1 SOA ietf.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 32035
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; NSID: 6e 73 30 30 31 62 2e 61 70 70 32 37 2e 61 6d 73 32 2e 61 66 69
; 6c 69 61 73 2d 6e 73 74 2e 69 6e 66 6f  (n) (s) (0) (0) (1) (b) (.)
; (a) (p) (p) (2) (7) (.) (a) (m) (s) (2) (.) (a) (f) (i) (l) (i) (a)
; (s) (-) (n) (s) (t) (.) (i) (n) (f) (o)
;; QUESTION SECTION:
;ietf.org.	IN SOA

;; Query time: 78 msec
;; SERVER: 65.22.8.1#53(65.22.8.1)
;; WHEN: Thu Feb 26 08:41:05 CET 2015
;; MSG SIZE  rcvd: 75

---

From: Jari Arkko <[email-masked]>
Date: Thu, 26 Feb 2015 03:24:53 -0800

> name servers reply SERVFAIL (reported as ticket [www.ietf.org/rt

Thanks. We will investigate.

Jari

---

From: Paul Wouters <[email-masked]>
Date: Thu, 26 Feb 2015 09:57:31 -0500 (EST)

> new arrangement on dnssec.ietf.org would be

Can a TLSA record be added for dnssec.ietf.org ?

Paul

---

From: Russ Housley <[email-masked]>
Date: Thu, 26 Feb 2015 10:32:16 -0500

> Can a TLSA record be added for dnssec.ietf.org ?

That is planned.  Let's make sure the zone signature is solid, and then take this step.

Russ