Re: [DNSOP] DNS privacy and AS 112: the case of home.arpa

[Mark Andrews <[e-mail]>]

Looks like we need to open a ticket for those.  But the ones people actually have internal zones in are correct.  Check the RFC 1918 delegations.  I know these started out being delegated to blackhole servers before the parent zones were signed by this isn’t rocket science.

[rock:bin/tests/system] marka% dig 10.in-addr.arpa @f.in-addr-servers.arpa +dnssec

; <<>> DiG 9.12.0rc1+hotspot+add-prefetch+marka <<>> 10.in-addr.arpa @f.in-addr-servers.arpa +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15498
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 1a755958649b4ee4edf6fe055a31cb4dc97ce57a3c818987 (good)
;; QUESTION SECTION:
;10.in-addr.arpa.		IN	A

;; AUTHORITY SECTION:
10.in-addr.arpa.	86400	IN	NS	blackhole-2.iana.org.
10.in-addr.arpa.	86400	IN	NS	blackhole-1.iana.org.
10.in-addr.arpa.	3600	IN	NSEC	100.in-addr.arpa. NS RRSIG NSEC
10.in-addr.arpa.	3600	IN	RRSIG	NSEC 8 3 3600 20171229130507 20171208140001 51846 in-addr.arpa. WcpA1d1GIL2vC22QrTf6V3wni22+aD8XlTgSR3K8WAvf7vWfz1NcUIeW 8fiRVj2tTq7rJlnxdoTtTheM1COZrZCdxhBa2wHHnte8k4MlD+p5Wiza 5NjitvL/ASp2VPAdOfEofsJSgWHyQ1C4obCsYGMxux3dgv7ePdYiPzgr 9hE=

;; Query time: 411 msec
;; SERVER: 2001:67c:e0::1#53(2001:67c:e0::1)
;; WHEN: Thu Dec 14 11:52:29 AEDT 2017
;; MSG SIZE  rcvd: 342

[rock:bin/tests/system] marka% 

[rock:~/git/bind9x] marka% dig 17.172.in-addr.arpa +dnssec @r.arin.net

; <<>> DiG 9.12.0rc1+hotspot+add-prefetch+marka <<>> 17.172.in-addr.arpa +dnssec @r.arin.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1672
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;17.172.in-addr.arpa.		IN	A

;; AUTHORITY SECTION:
17.172.in-addr.arpa.	86400	IN	NS	blackhole-1.iana.org.
17.172.in-addr.arpa.	86400	IN	NS	blackhole-2.iana.org.
17.172.in-addr.arpa.	10800	IN	NSEC	170.172.in-addr.arpa. NS RRSIG NSEC
17.172.in-addr.arpa.	10800	IN	RRSIG	NSEC 5 4 10800 20171227213540 20171213203540 40857 172.in-addr.arpa. kLq3ev/dBxW/4NEDxBJlksmE6nXI7CZC84D17ZLsLzo4jThantJea5fw UTdtR/YFt0kFAYtNv3gTkHn8E48wQV/50rExb5Kg4iKTSCol84S6o6p0 Lt6lKslVCt8qPIjonScKmJhly9WlO/mPqsFu7xNoK4wFGs2p+hOMcvkQ oN8=

;; Query time: 320 msec
;; SERVER: 2001:500:f0::63#53(2001:500:f0::63)
;; WHEN: Thu Dec 14 12:17:37 AEDT 2017
;; MSG SIZE  rcvd: 326

[rock:~/git/bind9x] marka% 

[rock:bin/tests/system] marka% dig 168.192.in-addr.arpa +dnssec @r.arin.net

; <<>> DiG 9.12.0rc1+hotspot+add-prefetch+marka <<>> 168.192.in-addr.arpa +dnssec @r.arin.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3764
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;168.192.in-addr.arpa.		IN	A

;; AUTHORITY SECTION:
168.192.in-addr.arpa.	86400	IN	NS	blackhole-1.iana.org.
168.192.in-addr.arpa.	86400	IN	NS	blackhole-2.iana.org.
168.192.in-addr.arpa.	10800	IN	NSEC	0.169.192.in-addr.arpa. NS RRSIG NSEC
168.192.in-addr.arpa.	10800	IN	RRSIG	NSEC 5 4 10800 20171227213323 20171213203323 57162 192.in-addr.arpa. Pg7l5KbT8lU7pbZJf/W1CeKM68b9gp8Nck0e+IsiJ08kcjHPXyVg6juu 1f5eLDbbq7SeqR8yMxu9BKf4FqXhgzsqTxXB5AdwCNIBLEHwbWSIurqy nFiTD1upf3PbiSmheqLGz2n3kCqgMS+/dVapW4y2JQsDMEBp1Q/Y5ux/ UpY=

;; Query time: 293 msec
;; SERVER: 2001:500:f0::63#53(2001:500:f0::63)
;; WHEN: Thu Dec 14 12:03:18 AEDT 2017
;; MSG SIZE  rcvd: 329

[rock:bin/tests/system] marka% 


> On 14 Dec 2017, at 11:40 am, Joe Abley <[e-mail]> wrote:
> 
> Hi Mark,
> 
>> On Dec 13, 2017, at 17:09, Mark Andrews <[e-mail]> wrote:
>> 
>> Section 7 says:
> 
> Yes, I know. I read it.
> 
>> RFC 6303 has similar requirements and IANA was able to co-ordinate those delegation.
> 
> Apart from the zones originally delegated to the AS112 project, I couldn't find a zone specified in 6303 that is delegated at all, actually.
> 
> Admittedly I didn't check all of them (I got bored after 0.in-addr.arpa, 127.in-addr.arpa, 2.0.192.in-addr.arpa and d.f.ip6.arpa). Here's an example:
> 
> monster:~]% dig @b.in-addr-servers.arpa 0.in-addr.arpa soa +norec +dnssec
> 
> ; <<>> DiG 9.11.2 <<>> @b.in-addr-servers.arpa 0.in-addr.arpa soa +norec +dnssec
> ; (2 servers found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64980
> ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ;; QUESTION SECTION:
> ;0.in-addr.arpa.                        IN      SOA
> 
> ;; AUTHORITY SECTION:
> in-addr.arpa.           3600    IN      NSEC    1.in-addr.arpa. NS SOA RRSIG NSEC DNSKEY
> in-addr.arpa.           3600    IN      RRSIG   NSEC 8 2 3600 20171228213500 20171208080001 51846 in-addr.arpa. D167CxX3WV8Cygq3JHJ8Ik4VUo5qGbEqxGq68vyil2QMhf9O7DjyU3sn q3S9kR+TJ7yQJPsfzy6Qqygft2Jnr0pujDspruYyKcFfx5WbO2X7pTxQ zFSjjHspZPCJ5ZVNoML/3aFYcqvBeYZWViZB8zCuyYZWF6YXtDppXukz 3GQ=
> in-addr.arpa.           3600    IN      SOA     b.in-addr-servers.arpa. nstld.iana.org. 2017102477 1800 900 604800 3600
> in-addr.arpa.           3600    IN      RRSIG   SOA 8 2 3600 20171231104329 20171210060001 51846 in-addr.arpa. a7/wJ7RcUM9MOV3M0+0i9MUgOF4Yw6VqUIuR7ItN70CuM8qoCYGi+0/F bRiiHPeRFgFD92Shgb7pwRsM2lYh53jheWAZSOg8wOdNMaF+eiEolErv wpBuDoZM/m1mlAZ26BiN2BKDDh22AXj/76KA+pgIa+J3y2kQHYsNKEmB pvg=
> 
> ;; Query time: 22 msec
> ;; SERVER: 2001:500:87::87#53(2001:500:87::87)
> ;; WHEN: Thu Dec 14 00:39:19 UTC 2017
> ;; MSG SIZE  rcvd: 492
> 
> [monster:~]% 
> 
> 
> Joe

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]              INTERNET: [e-mail]