Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C71C1A00CD for ; Thu, 20 Nov 2014 00:29:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.5 X-Spam-Level: X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, RP_MATCHES_RCVD=-0.594, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1S8f8Y7UZ5mD for ; Thu, 20 Nov 2014 00:29:07 -0800 (PST) Received: from arn2-kamx.sidn.nl (kamx.sidn.nl [IPv6:2a00:d78:0:147:94:198:152:69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 113621A00C5 for ; Thu, 20 Nov 2014 00:29:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=sidn.nl; s=sidn_nl; c=relaxed/relaxed; h=message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:x-originating-ip; bh=G+ht2kmxJRWYOnOyFofrStU8jWOs1ZUWgM5FOflnVa4=; b=UUKMZXIvZMElo3zMbBfZVEjN0zYRWFSvRryUkDrB5GLxoL+lAhbREKDUARPslWZGCFuvypcCgws7AHyYxP2l6yMZWxTuSto5YMpu3qmMG+3TwSBXx4t1o4LHI3bGRhF9ULw4q9+2RM4Tnpk9z35xha8pBl1KUw52VGhYnTougnY= Received: from kahubcasn01.SIDN.local ([192.168.2.73]) by arn2-kamx.sidn.nl with ESMTP id sAK8T3Vo003460-sAK8T3Vq003460 (version=TLSv1.0 cipher=AES256-SHA bits=256 verify=CAFAIL) for ; Thu, 20 Nov 2014 09:29:03 +0100 Received: from rndhost215.sidn.nl (94.198.152.215) by kahubcasn01.SIDN.local (192.168.2.77) with Microsoft SMTP Server (TLS) id 14.3.174.1; Thu, 20 Nov 2014 09:29:02 +0100 Message-ID: <546DA64E.4010900@sidn.nl> Date: Thu, 20 Nov 2014 09:29:02 +0100 From: "Marco Davids (SIDN)" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Thunderbird/35.0a2 MIME-Version: 1.0 To: References: <20141027225310.29285.24437.idtracker@ietfa.amsl.com> <20141120062942.GL13179@mournblade.imrryr.org> <20141120073445.GM13179@mournblade.imrryr.org> In-Reply-To: <20141120073445.GM13179@mournblade.imrryr.org> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms070209010003030405030602" X-Originating-IP: [94.198.152.215] Archived-At: http://mailarchive.ietf.org/arch/msg/dane/CPbtJPc0oW3VzArkERe9RQlBihI Subject: Re: [dane] Please help to remediate broken DNSSEC hosting X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Nov 2014 08:29:09 -0000 --------------ms070209010003030405030602 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi, At SIDN (registry for .nl) we are aware of these problems and we are in touch with the registrars involved. In particular TransIP is a bit of a challenge, because they run their own DNS-software and feel no rush to fix this issue. But rest assured that we will keep on trying to have them improve things. -- Marco On 20/11/14 08:34, Viktor Dukhovni wrote: > On Thu, Nov 20, 2014 at 06:29:42AM +0000, Viktor Dukhovni wrote: >=20 >> A number of large DNS hosting providers have enabled DNSSEC support, >> but are using nameserver software that is not compatible with the >> specification with respect to authenticated denial of existence. >=20 > Note, by far the bulk of the problem is with transip. From their > website: >=20 > https://www.transip.co.uk/domain-name/transdns/ >=20 > DNSSEC >=20 > TransDNS is the foundation of our DNSSEC implementation, a DNS > protocol security extension. Signing more than 500.000 domain > names with DNSSEC was a challenge we gladly accepted. Because > of TransDNS we were one of the first domain providers in The > Netherlands that signed all our domain names. We are now the > largest DNSSEC provider in the world. We could not have done > this with third-party solutions. That is the reason why we > develop everything in-house. >=20 > Perhaps they have more problems that show up in interop tests > because they indeed signed so many more domains that anyone else. > In any case, they would be a good place to start remediation. >=20 > If anyone has contacts there and can reach out that would be great. >=20 --------------ms070209010003030405030602 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMZjCC BiowggUSoAMCAQICAwoD4zANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRl IFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlh dGUgQ2xpZW50IENBMB4XDTE0MDUyMDE3NTUyOFoXDTE1MDUyMjAwMTc1NlowRDEdMBsGA1UE AwwUbWFyY28uZGF2aWRzQHNpZG4ubmwxIzAhBgkqhkiG9w0BCQEWFG1hcmNvLmRhdmlkc0Bz aWRuLm5sMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0tDXTB0Q5LVXcdRfAg/x 7Baw83FDEtt566NEjxSG0Q6xnexJtiXUl4bfGSE9PHN2Y9tT7NOGxXPNPjddChUJbKwGhH27 zmWA6LK/4AnNyew8seFGKMp3UFOkfVUGBcNPvtHQPDSAZnZuds50vhpqLqyxa+EA8rjttC93 8/dZAjjV7etpk24W1s/Ith+c5oSP6rqIfl+tUPc4s2ZOudq8ov6jAV2OQ53S/G1OFR9s9ZEl uYZohI2gQB7Fz5Xfij20YqWnZ9619JndU4b5Cqs4NCxhnO3Pgoba85LhVdvkxAbKq/cIv8zP 4FrsKUhdkjWBmWK+r+vU/GtdcmZkM2YCtQIDAQABo4IC2jCCAtYwCQYDVR0TBAIwADALBgNV HQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBTVD7Di X5HtXqiaF+DhqGiH2ixl1TAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAfBgNV HREEGDAWgRRtYXJjby5kYXZpZHNAc2lkbi5ubDCCAUwGA1UdIASCAUMwggE/MIIBOwYLKwYB BAGBtTcBAgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xp Y3kucGRmMIH3BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTADAgEBGoG+VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0 aGUgQ2xhc3MgMSBWYWxpZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0Eg cG9saWN5LCByZWxpYW5jZSBvbmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21w bGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8ELzAtMCug KaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3JsMIGOBggrBgEFBQcB AQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20vc3ViL2NsYXNz MS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRz L3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS8wDQYJKoZIhvcNAQELBQADggEBAGjmOZpe/qYtBZy5VSP5JRKEKlwIpxGUDNQv YhvCp53aVXvALQmXO6X1v3Oia+hpMliCof9ymQXUCSfNaftKBYx4ROr6kgmVZUtTrb10f/eW xNDVV/5Jhy1mAyQ4ziMXoW7r8Mbji653p2ewbYLZd6mtXkzvM/SNdh4iG5+dD4x2ih9IzEl6 XO4WFTgNFu26/0YXSCzkyb3K3O2jAUzyHvYB4dMUjxryVNDcLPae1CxeAYgpZNNmUVZPiOyB Fr/NRKgC77X1Q2STwUbo8JTTXka/rZup1Huj2g2AMrBZ/fO8+HSWFF0OeioEWFvOpSc2c8hs cb8LAWbtf9XerJ/a1rgwggY0MIIEHKADAgECAgEeMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNV BAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRh bCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9u IEF1dGhvcml0eTAeFw0wNzEwMjQyMTAxNTVaFw0xNzEwMjQyMTAxNTVaMIGMMQswCQYDVQQG EwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwg Q2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5 IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP6uq/I0fhCu+cQhoUfE6ERKKnu8zP f1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu2yOMluLqwvsuz9/9f1+1PKHG /FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyUGHJbBpA8Q89lGxahNvur yGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmtxWMZwhZna//jdiSy rrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMBAAGjggGtMIIB qTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwZgYIKwYBBQUH AQEEWjBYMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5zdGFydHNzbC5jb20vY2EwLQYIKwYB BQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBbBgNVHR8EVDBSMCeg JaAjhiFodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwJ6AloCOGIWh0dHA6Ly9j cmwuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDCBgAYDVR0gBHkwdzB1BgsrBgEEAYG1NwECATBm MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMA0GCSqG SIb3DQEBBQUAA4ICAQAKgwh9eKssBly4Y4xerhy5I3dNoXHYfYa8PlVLL/qtXnkFgdtY1o95 CfegFJTwqBBmf8pyTUnFsukDFUI22zF5bVHzuJ+GxhnSqN2sD1qetbYwBYK2iyYA5Pg7Er1A +hKMIzEzcduRkIMmCeUTyMyikfbUFvIBivtvkR8ZFAk22BZy+pJfAoedO61HTz4qSfQoCRcL N5A0t4DkuVhTMXIzuQ8CnykhExD6x4e6ebIbrjZLb7L+ocR0y4YjCl/Pd4MXU91y0vTipgr/ O75CDUHDRHCCKBVmz/Rzkc/b970MEeHt5LC3NiWTgBSvrLEuVzBKM586YoRD9Dy3OHQgWI27 0g+5MYA8GfgI/EPT5G7xPbCDz+zjdH89PeR3U4So4lSXur6H6vp+m9TQXPF3a0LwZrp8MQ+Z 77U1uL7TelWO5lApsbAonrqASfTpaprFVkL4nyGH+NHST2ZJPWIBk81i6Vw0ny0qZW2Niy/Q vVNKbb43A43ny076khXO7cNbBIRdJ/6qQNq9Bqb5C0Q5nEsFcj75oxQRqlKf6TcvGbjxkJh8 BYtv9ePsXklAxtm8J7GCUBthHSQgepbkOexhJ0wP8imUkyiPHQ0GvEnd83129fZjoEhdGwXV 27ioRKbj/cIq7JRXun0NbeY+UdMYu9jGfIpDLtUUGSgsg2zMGs5R4jGCA90wggPZAgEBMIGU MIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2Vj dXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xh c3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwoD4zAJBgUrDgMCGgUAoIIC HTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNDExMjAwODI5 MDJaMCMGCSqGSIb3DQEJBDEWBBSj96hqn0QT8KJj24BbA8gRtNF8+zBsBgkqhkiG9w0BCQ8x XzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwIC AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGlBgkrBgEEAYI3 EAQxgZcwgZQwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYD VQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQIDCgPjMIGnBgsq hkiG9w0BCRACCzGBl6CBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0 ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV BAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgMK A+MwDQYJKoZIhvcNAQEBBQAEggEAN1k+AT5BApRbKfsiHjqdfQCrl/y7zHnlUXIDK4fKXSJE H4B7/sPED24FGx1nWr3a+uXuFBeHTYbHI2zZ+vamR/c2zcV5Zb4evCcKgXMTVyLvqH9hIApZ H4S9c1+7P4PempbBTsqWTR5IrbutDZCfLO+PqIanGfHJZjqdZ1clRA/wbEMorFfutIPuI93W iUURAaRthhzAHglisYIB6scMs48tHuCHyGUSNlTkmKLZsjZmOPLkbS9Hvh/n007C4KH8f01S 0lmjZe8VvdjfTXB73Rc4nrbLK4oFlsyQFePgoYCp0ZtQGDeJd0Mvpm/fTTUm7oj5z3gVZ8Af ATjx/8HiaQAAAAAAAA== --------------ms070209010003030405030602--