Re: [DNSOP] Asking TLD's to perform checks.

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Dr Eberhard W Lisse writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> For smaller (cc)TLDs it's not only the enforceability that's
> difficult (or as mentioned counterproductive) it's also the real
> world (Open Source Tools)
> 
> If someone writes me a zonemaster based tool that can read a list of
> all domain names in the CoCCAtools PostgreSQL (or even a generic
> SQL) database and produce a skeleton of a report (per Registrar)
> I'll run it for .NA (and I am sure others using CoCCATools might
> too).

Well we have tools that can test every server in a zone.

They can start with a list of domains, domains and servers, or
domains, servers and addresses.  Adding in the registrar so the
output can be sorted by registrar is trivial.  Just another field
to process.

They produce lines like this for each <domain,server,address> tuple.

clinicaltrial.gov. @2607:f220:41e:252::53 (gslb03.nlm.nih.gov.) dns=ok edns=ok edns1=timeout edns@512=noopt ednsopt=ok edns1opt=timeout do=ok ednsflags=ok optlist=ok

Well we have tools that then turn the output into reports like:

* https://ednscomp.isc.org/compliance/gov-full-report.html
* https://ednscomp.isc.org/compliance/summary.html

All in all it is no more than a few shell and awk scripts.

Mark

> I do a lot of LaTeX so I can generate reasonably looking PDF
> reports.
> 
> We have allocated (staff) resources to a whois cleanup anyway and so
> this could be incorporated reducing manual labor.
> 
> And we have decided to devote some time at the next TechDay at ICANN
> Marrakesh to (algorithmic) data cleanup/verification including
> badness checks eg via Secure Domain Foundation and others(.
> 
> So whatever comes out of that could, eventually, also go in.
> 
> el
> 
> 
> On 2015-11-11 08:53, Patrik F=E4ltstr=F6m wrote:
> > On 11 Nov 2015, at 7:47, Viktor Dukhovni wrote:
> > =
> 
> >> It may not be possible for everyone to agree on a comprehensive =
> 
> >> set of 'wrongs' with no omissions, but it should be possible to =
> 
> >> get consensus on a core set of 'wrongs' that are not =
> 
> >> controversial.
> > =
> 
> > Yes and no.  I think going for a minimum will be a good goal, but =
> 
> > for example to have lame delegations must by definition be allowed,
> > as some registration policies do require delegation (i.e. NS
> > records).  So people add NS records in parent zone, but nothing =
> 
> > responds there.  Until policy allows registration without =
> 
> > delegation, you will see lame delegations.
> > =
> 
> > Patrik
> 
> - -- =
> 
> Dr. Eberhard W. Lisse  \        / Obstetrician & Gynaecologist (Saar)
> [e-mail]            / *     |   Telephone: [phone] (cell)
> PO Box 8421             \     /
> Bachbrecht, Namibia     ;____/
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
> 
> iQIVAwUBVkLqMZcFHaN5RT+rAQIzlw//SkiY/urbpw/KT0CmqBUKcrmY8R0rChut
> 05SaKNCjdvxgbu2I2ZP7e59xBKgyBJfWY+Dc2VKtl9q9aqygUXLKHPyV0kL5LTzJ
> TwZWE8y8ePJcneHbU0SyeU8TEMMDDcpX8VR4NoLbCmkZ+gKrAvtB4vrh4CQTLKAd
> gUiUmeuw8q8uZVW2pOWoCx4vcc+hcrXLAUC0OVoP7uud22h4fBcl4sRmgLlD79E9
> q7TvM3eXmPIBydW6YvzEc6mx+Jd449ASCBCDXjKqzPE2vGvu8fWui7qFYwrpKMIU
> OZDMGKCT6oM1g88BOctB2e+8hP0GVSCjYg6HGUTiKWiFsXjP5986AlkpWmX+mV2F
> rgN9B6dqxK5omMEQf/inQBAA8Irzrm8HrPy2+Uru7QYq9v7M0xBb05k+vljM5Qhr
> CbGZGbd67CqYROoqC8UvmSXRz8W5IbcHlG3rujB2g18q/LQGIosgXPKE56OWCZIz
> LanWM+n85pUocmUnQEnqG61nPx/+AadxY5Hp/BoWY7VvRzoI3ohsZPcMRp/uObzf
> f81D9RvhWARcmB3qyoT/RAhkx2dFIoz7iWUbgGlnPyyHthP8SL8W0YFKzSfcJAmO
> XAEAk/1At4t8jD4ZJpVEWruVsbL+7h9+E9ZS8xBnaT37XtjXkmV2eCx9PIRdR8rM
> Ih1jXfMw8KM=3D
> =3DKyjz
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]