-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdraft-ietf-dnsop-rfc6304bis-02.txt
1624 lines (839 loc) · 45.5 KB
/
draft-ietf-dnsop-rfc6304bis-02.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Network Working Group J. Abley
Internet-Draft Dyn, Inc.
Obsoletes: 6304 (if approved) W. Maton
Intended status: Informational OttIX
Expires: December 22, 2014 June 20, 2014
AS112 Nameserver Operations
draft-ietf-dnsop-rfc6304bis-02
Abstract
Many sites connected to the Internet make use of IPv4 addresses that
are not globally-unique. Examples are the addresses designated in
RFC 1918 for private use within individual sites.
Devices in such environments may occasionally originate Domain Name
System (DNS) queries (so-called "reverse lookups") corresponding to
those private-use addresses. Since the addresses concerned have only
local significance, it is good practice for site administrators to
ensure that such queries are answered locally. However, it is not
uncommon for such queries to follow the normal delegation path in the
public DNS instead of being answered within the site.
It is not possible for public DNS servers to give useful answers to
such queries. In addition, due to the wide deployment of private-use
addresses and the continuing growth of the Internet, the volume of
such queries is large and growing. The AS112 project aims to provide
a distributed sink for such queries in order to reduce the load on
the corresponding authoritative servers. The AS112 project is named
after the Autonomous System Number (ASN) that was assigned to it.
RFC6304 described the steps required to install a new AS112 node, and
offered advice relating to such a node's operation. This document
updates that advice to facilitate the addition and removal of zones
for which query traffic will be sunk at AS112 nodes, using DNAME,
whilst still supporting direct delegations to AS112 name servers.
This document obsoletes RFC6304.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Abley & Maton Expires December 22, 2014 [Page 1]
Internet-Draft AS112 Nameserver Operations June 2014
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 22, 2014.
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Abley & Maton Expires December 22, 2014 [Page 2]
Internet-Draft AS112 Nameserver Operations June 2014
Table of Contents
1. NOTE TO RFC EDITOR AND REVIEWERS . . . . . . . . . . . . . . . 4
2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5
3. AS112 DNS Service . . . . . . . . . . . . . . . . . . . . . . 6
3.1. Approach . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.1. Direct Delegation . . . . . . . . . . . . . . . . . . 6
3.1.2. DNAME Redirection . . . . . . . . . . . . . . . . . . 6
3.2. Zones . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.3. Nameservers . . . . . . . . . . . . . . . . . . . . . . . 7
4. Installation of a New Node . . . . . . . . . . . . . . . . . . 8
4.1. Useful Background Knowledge . . . . . . . . . . . . . . . 8
4.2. Topological Location . . . . . . . . . . . . . . . . . . . 8
4.3. Operating System and Host Considerations . . . . . . . . . 8
4.4. Routing Software . . . . . . . . . . . . . . . . . . . . . 9
4.5. DNS Software . . . . . . . . . . . . . . . . . . . . . . . 11
4.6. Testing a Newly-Installed Node . . . . . . . . . . . . . . 16
5. Operations . . . . . . . . . . . . . . . . . . . . . . . . . . 17
5.1. Monitoring . . . . . . . . . . . . . . . . . . . . . . . . 17
5.2. Downtime . . . . . . . . . . . . . . . . . . . . . . . . . 17
5.3. Statistics and Measurement . . . . . . . . . . . . . . . . 17
6. Communications . . . . . . . . . . . . . . . . . . . . . . . . 18
7. On the Future of AS112 Nodes . . . . . . . . . . . . . . . . . 19
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 20
8.1. General . . . . . . . . . . . . . . . . . . . . . . . . . 20
8.2. IANA Actions . . . . . . . . . . . . . . . . . . . . . . . 20
8.2.1. IPv6 Transport for Direct Delegation AS112 Servers . . 20
8.2.2. Registration in the Special-Purpose AS Numbers
Registry . . . . . . . . . . . . . . . . . . . . . . . 20
9. Security Considerations . . . . . . . . . . . . . . . . . . . 22
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 23
11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 24
11.1. Normative References . . . . . . . . . . . . . . . . . . . 24
11.2. Informative References . . . . . . . . . . . . . . . . . . 24
Appendix A. History . . . . . . . . . . . . . . . . . . . . . . . 27
Appendix B. Revision History and Venue . . . . . . . . . . . . . 28
B.1. draft-jabley-dnsop-rfc6304bis-00 . . . . . . . . . . . . . 28
B.2. draft-ietf-dnsop-rfc6304bis-00 . . . . . . . . . . . . . . 28
B.3. draft-ietf-dnsop-rfc6304bis-01 . . . . . . . . . . . . . . 28
B.4. draft-ietf-dnsop-rfc6304bis-02 . . . . . . . . . . . . . . 28
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 29
Abley & Maton Expires December 22, 2014 [Page 3]
Internet-Draft AS112 Nameserver Operations June 2014
1. NOTE TO RFC EDITOR AND REVIEWERS
This document uses the phrases "TBA-prefix-v4" and "TBA-prefix-v6" in
anticipation of the address assignments requested in the IANA
Considerations section of [I-D.ietf-dnsop-as112-dname].
"TBA-address-v4" refers to the address within TBA-prefix-v4 assigned
to the name server BLACKHOLE.AS112.ARPA. Similarly, "TBA-address-v6"
refers to the corresponding address within TBA-prefix-v6.
All of "TBA-prefix-v4", "TBA-address-v4", "TBA-prefix-v6" and "TBA-
address-v6" in this document should be replaced with their assigned
values prior to publication.
The delegation of the AS112.ARPA zone is specified (and requested) in
[I-D.ietf-dnsop-as112-dname].
See Appendix B for an abridged revision history, and discussion of an
appropriate venue for discussion.
This section should be removed prior to publication.
Abley & Maton Expires December 22, 2014 [Page 4]
Internet-Draft AS112 Nameserver Operations June 2014
2. Introduction
Many sites connected to the Internet make use of IPv4 addresses that
are not globally unique. Examples are the addresses designated in
[RFC1918] for private use within individual sites.
Devices in such environments may occasionally originate Domain Name
System (DNS) [RFC1034] queries (so-called "reverse lookups")
corresponding to those private-use addresses. Since the addresses
concerned have only local significance, it is good practice for site
administrators to ensure that such queries are answered locally
[RFC6303]. However, it is not uncommon for such queries to follow
the normal delegation path in the public DNS instead of being
answered within the site.
It is not possible for public DNS servers to give useful answers to
such queries. In addition, due to the wide deployment of private-use
addresses and the continuing growth of the Internet, the volume of
such queries is large and growing. The AS112 project aims to provide
a distributed sink for such queries in order to reduce the load on
the IN-ADDR.ARPA authoritative servers [RFC5855].
The AS112 project encompasses a loosely coordinated collection of
independently operated name servers. Each name server functions as a
single node in an AS112 anycast cloud [RFC4786], and is configured to
answer authoritatively for a particular set of nominated zones.
The AS112 project is named after the Autonomous System Number (ASN)
that was assigned to it (see Appendix A).
Abley & Maton Expires December 22, 2014 [Page 5]
Internet-Draft AS112 Nameserver Operations June 2014
3. AS112 DNS Service
3.1. Approach
3.1.1. Direct Delegation
[RFC6304] describes an approach whereby zones whose traffic should be
directed towards an AS112 sink should be directly delegated to AS112
name servers. Correspondingly, each AS112 node is manually
configured to answer appropriately for those zones.
The guidance in this document preserves this capability for the zones
that were originally delegated in this fashion. AS112 nodes that
were implemented in accordance with the guidance in [RFC6304] will
continue to provide service for those zones.
3.1.2. DNAME Redirection
[I-D.ietf-dnsop-as112-dname] describes a different approach whereby
queries towards specific zones are redirected to an empty zone also
hosted on AS112 servers, using DNAME [RFC6672].
The guidance in this document introduces this capability, allowing
any zone administrator to sink query traffic in AS112 infrastructure
without requiring changes to any AS112 node.
3.2. Zones
To support Direct Delegation AS112 service, AS112 name servers answer
authoritatively for the following zones, corresponding to [RFC1918]
private-use netblocks:
o 10.IN-ADDR.ARPA
o 16.172.IN-ADDR.ARPA, 17.172.IN-ADDR.ARPA, ..., 31.172.IN-ADDR.ARPA
o 168.192.IN-ADDR.ARPA
and the following zone, corresponding to the "link local" netblock
169.254.0.0/16 described in [RFC5735]:
o 254.169.IN-ADDR.ARPA
To support DNAME Redirection AS112 service, AS112 name servers answer
authoritatively for the following zone, as specified in
[I-D.ietf-dnsop-as112-dname]:
Abley & Maton Expires December 22, 2014 [Page 6]
Internet-Draft AS112 Nameserver Operations June 2014
o EMPTY.AS112.ARPA
To aid identification of AS112 anycast nodes, each node also answers
authoritatively for the following zones:
o HOSTNAME.AS112.NET
o HOSTNAME.AS112.ARPA
See Section 4.5 for the recommended contents of all these zones.
3.3. Nameservers
To support Direct Delegation AS112 service, the relevant zones listed
in Section 3.2 are delegated to the two name servers BLACKHOLE-
1.IANA.ORG (192.175.48.6, 2620:4f:8000::6) and BLACKHOLE-2.IANA.ORG
(192.175.48.42, 2620:4f:8000::42).
Additionally, the server PRISONER.IANA.ORG (192.175.48.1, 2620:4f:
8000::1) is listed in the MNAME field of the SOA records of the IN-
ADDR.ARPA zones served by AS112 name servers. PRISONER.IANA.ORG
receives mainly dynamic update queries.
The addresses of all these name servers are covered by the single
IPv4 prefix 192.175.48.0/24 and the IPv6 prefix 2620:4f:8000::/48.
To date, IPv6 transport for these nameservers has only been available
for pre-production testing. Direction to the IANA to add AAAA RRSets
for the owner names of these name servers can be found in Section 8.
To support DNAME Redirection AS112 service, the single zone
EMPTY.AS112.ARPA is delegated to the single name server
BLACKHOLE.AS112.ARPA (TBA-address-v4, TBA-address-v6). The addresses
of that name server are covered by the single IPv4 prefix
TBA-prefix-v4, and the single IPv6 prefix TBA-prefix-v6.
Abley & Maton Expires December 22, 2014 [Page 7]
Internet-Draft AS112 Nameserver Operations June 2014
4. Installation of a New Node
4.1. Useful Background Knowledge
Installation of an AS112 node is relatively straightforward.
However, experience in the following general areas may prove useful:
o inter-domain routing with BGP [RFC4271];
o DNS authoritative server operations;
o anycast [RFC4786] distribution of DNS services.
4.2. Topological Location
AS112 nodes may be located anywhere on the Internet. For nodes that
are intended to provide a public service to the Internet community
(as opposed to private use), it may well be advantageous to choose a
location that is easily (and cheaply) reachable by multiple
providers, such as an Internet exchange point.
AS112 nodes may advertise their service prefix to BGP peers for local
use (analogous to a conventional peering relationship between two
providers) or for global use (analogous to a customer relationship
with one or more providers).
It is good operational practice to notify the community of users that
may fall within the reach of a new AS112 node before it is installed.
At an Internet Exchange, local mailing lists usually exist to
facilitate such announcements. For nodes that are intended to be
globally reachable, coordination with other AS112 operators is highly
recommended. See also Section 6.
4.3. Operating System and Host Considerations
Examples in this document are based on UNIX and UNIX-like operating
systems, but other operating systems exist which are suitable for use
in construction of an AS112 node.
The chosen platform should include support for either cloned loopback
interfaces, or the capability to bind multiple addresses to a single
loopback interface. The addresses of the name servers listed in
Section 3.3 will be configured on these interfaces in order that the
DNS software can respond to queries properly.
A host that is configured to act as an AS112 anycast node should be
dedicated to that purpose, and should not be used to simultaneously
provide other services. This guidance is provided due to the
Abley & Maton Expires December 22, 2014 [Page 8]
Internet-Draft AS112 Nameserver Operations June 2014
unpredictable (and occasionally high) traffic levels that AS112 nodes
have been seen to attract.
System startup scripts should be arranged such that the various
AS112-related components start automatically following a system
reboot. The order in which interfaces are configured and software
components started should be arranged such that routing software
startup follows DNS software startup, and DNS software startup
follows loopback interface configuration.
Wrapper scripts or other arrangements should be employed to ensure
that the anycast service prefix for AS112 is not advertised while
either the anycast addresses are not configured, or while the DNS
software is not running.
4.4. Routing Software
AS112 nodes signal the availability of AS112 name servers to the
Internet using BGP [RFC4271]: each AS112 node is a BGP speaker, and
announces the prefixes 192.175.48.0/24 and 2620:4f:8000::/48 to the
Internet with origin AS 112 (see also Section 3.3).
The examples in this document are based on the Quagga Routing
Suite [1] running on Linux, but other software packages exist which
also provide suitable BGP support for AS112 nodes.
The "bgpd.conf" file is used by Quagga's bgpd daemon, which provides
BGP protocol support. The router id in this example is 203.0.113.1;
the AS112 node peers with external peers 192.0.2.1, 192.0.2.2, 2001:
db8::1 and 2001:db8::2. Note the local AS number 112, and the
origination of the prefixes 192.175.48.0/24 and 2620:4f:8000::/48 to
support Direct Delegation AS112 service; the IPv4 prefix
TBA-prefix-v4 and the IPv6 prefix TBA-prefix-v6 support DNAME
Redirection.
For clarity, an IPv4-only AS112 node need not configure any of the
IPv6 elements that follow; similarly, an IPv6-only AS112 node need
not configure any of the IPv4 elements. Such single-stack hosts can
still contribute usefully to IPv4 and IPv6 AS112 services, however,
and single-stack operation is not discouraged.
! bgpd.conf
!
hostname as112-bgpd
password <something>
enable password <supersomething>
!
! Note that all AS112 nodes use the local Autonomous System Number
Abley & Maton Expires December 22, 2014 [Page 9]
Internet-Draft AS112 Nameserver Operations June 2014
! 112, and originate the IPv4 prefixes 192.175.48.0/24 and
! TBA-prefix-v4 and the IPv6 prefixes 2620:4f:8000::/48 and
! TBA-prefix-v6.
!
! All other addresses shown below are illustrative, and
! actual numbers will depend on local circumstances.
!
! IPv4-only or IPv6-only AS112 nodes should omit advertisements
! for address families they do not support.
!
router bgp 112
bgp router-id 203.0.113.1
neighbor 192.0.2.1 remote-as 64496
neighbor 192.0.2.1 next-hop-self
neighbor 192.0.2.1 prefix-list AS112-v4 out
neighbor 192.0.2.1 filter-list 1 out
!
neighbor 192.0.2.2 remote-as 64497
neighbor 192.0.2.2 next-hop-self
neighbor 192.0.2.2 prefix-list AS112-v4 out
neighbor 192.0.2.2 filter-list 1 out
!
neighbor 2001:db8::1 remote-as 64498
neighbor 2001:db8::1 next-hop-self
neighbor 2001:db8::1 prefix-list AS112-v6 out
neighbor 2001:db8::1 filter-list 1 out
!
neighbor 2001:db8::2 remote-as 64499
neighbor 2001:db8::2 next-hop-self
neighbor 2001:db8::2 prefix-list AS112-v6 out
neighbor 2001:db8::2 filter-list 1 out
!
network 192.175.48.0/24
network TBA-prefix-v4
!
address-family ipv6 unicast
network 2620:4f:8000::/48
network TBA-prefix-v6
exit-address-family
!
ip prefix-list AS112-v4 permit 192.175.48.0/24
ip prefix-list AS112-v4 permit TBA-prefix-v4
!
ipv6 prefix-list AS112-v6 permit 2620:4f:8000::/48
ipv6 prefix-list AS112-v6 permit TBA-prefix-v6
!
ip as-path access-list 1 permit ^$
Abley & Maton Expires December 22, 2014 [Page 10]
Internet-Draft AS112 Nameserver Operations June 2014
The configuration above includes two restrictions on what the AS112
should advertise to its BGP neighbours: a prefix filter that permits
only the service prefixes, and an AS_PATH filter that matches only
locally-originated routes. Together, these measures prevent the node
from becoming a transit point for its adjacent ASes.
The "zebra.conf" file is required to provide integration between
protocol daemons (bgpd, in this case) and the kernel.
! zebra.conf
!
hostname as112
password <something>
enable password <supersomething>
!
interface lo
!
interface eth0
!
4.5. DNS Software
Although the queries received by AS112 nodes are definitively
misdirected, it is important that they be answered in a manner that
is accurate and consistent. For this reason AS112 nodes operate as
fully-functional and standards-compliant DNS authoritative servers
[RFC1034], and hence require appropriate DNS software.
Examples in this document are based on ISC BIND9 [2], but other DNS
software exists which is suitable for use in construction of an AS112
node.
The following is a sample BIND9 "named.conf" file for a dedicated
AS112 server. Note that the name server is configured to act as an
authoritative-only server (i.e. recursion is disabled). The name
server is also configured to listen on the various AS112 anycast name
server addresses, as well as its local addresses.
// named.conf
// global options
options {
listen-on {
127.0.0.1; // localhost
// the following address is node-dependent, and should be set to
// something appropriate for the new AS112 node
Abley & Maton Expires December 22, 2014 [Page 11]
Internet-Draft AS112 Nameserver Operations June 2014
203.0.113.1; // local address (globally-unique, unicast)
// the following addresses are used to support Direct Delegation
// AS112 service, and are the same for all AS112 nodes
192.175.48.1; // PRISONER.IANA.ORG (anycast)
192.175.48.6; // BLACKHOLE-1.IANA.ORG (anycast)
192.175.48.42; // BLACKHOLE-2.IANA.ORG (anycast)
// the following address is used to support DNAME Redirection
// AS112 service, and is the same for all AS112 nodes
TBA-address-v4; // BLACKHOLE.AS112.ARPA (anycast)
};
listen-on-v6 {
::1; // localhost
// the following addresses are used to support Direct Delegation
// AS112 service, and are the same for all AS112 nodes
2620:4f:8000::1; // PRISONER.IANA.ORG (anycast)
2620:4f:8000::6; // BLACKHOLE-1.IANA.ORG (anycast)
2620:4f:8000::42; // BLACKHOLE-2.IANA.ORG (anycast)
// the following address is used to support DNAME Redirection
// AS112 service, and is the same for all AS112 nodes
TBA-address-v6; // BLACKHOLE.AS112.ARPA (anycast)
};
directory "/var/named";
recursion no; // authoritative-only server
};
// log queries, so that when people call us about unexpected
// answers to queries they didn't realise they had sent, we
// have something to talk about. Note that activating this
// naively has the potential to create high CPU load and consume
// enormous amounts of disk space.
logging {
channel "querylog" {
file "/var/log/query.log" versions 2 size 500m;
print-time yes;
};
category queries { querylog; };
};
Abley & Maton Expires December 22, 2014 [Page 12]
Internet-Draft AS112 Nameserver Operations June 2014
// Direct Delegation AS112 Service
// RFC 1918
zone "10.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "16.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "17.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "18.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "19.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "20.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "21.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "22.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "23.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "24.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "25.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "26.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "27.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "28.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "29.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "30.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "31.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "168.192.in-addr.arpa" { type master; file "db.dd-empty"; };
// RFC 5735
zone "254.169.in-addr.arpa" { type master; file "db.dd-empty"; };
// DNAME Redirection AS112 Service
zone "empty.as112.arpa" { type master; file "db.dr-empty"; };
// also answer authoritatively for the HOSTNAME.AS112.NET and
// HOSTNAME.AS112.ARPA zones, which contain data of operational
// relevance
zone "hostname.as112.net" {
type master;
file "db.hostname.as112.net";
};
zone "hostname.as112.arpa" {
type master;
file "db.hostname.as112.arpa";
};
The "db.dd-empty" file follows, below. This is the source data used
to populate all the IN-ADDR.ARPA zones listed in Section 3.2 that
support Direct Delegation AS112 service. Note that the RNAME
Abley & Maton Expires December 22, 2014 [Page 13]
Internet-Draft AS112 Nameserver Operations June 2014
specified in the SOA record corresponds to
[email protected], a suitable e-mail address for technical
queries about these zones.
; db.dd-empty
;
; Empty zone for Direct Delegation AS112 service.
;
$TTL 1W
@ IN SOA PRISONER.IANA.ORG. HOSTMASTER.ROOT-SERVERS.ORG. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS BLACKHOLE-1.IANA.ORG.
NS BLACKHOLE-2.IANA.ORG.
;
; There should be no other resource records included in this zone.
;
; Records that relate to RFC 1918-numbered resources within the
; site hosting this AS112 node should not be hosted on this
; name server.
The "db.dr-empty" file follows, below. This is the source data used
to populate the EMPTY.AS112.ARPA zone that supports DNAME Redirection
AS112 service. Note that the RNAME specified in the SOA record
corresponds to [email protected], a suitable e-mail address for
technical queries about this zone.
Abley & Maton Expires December 22, 2014 [Page 14]
Internet-Draft AS112 Nameserver Operations June 2014
; db.dr-empty
;
; Empty zone for Direct Delegation AS112 service.
;
$TTL 1W
@ IN SOA BLACKHOLE.AS112.ARPA. NOC.DNS.ICANN.ORG. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS BLACKHOLE.AS112.ARPA.
;
; There should be no other resource records included in this zone.
;
; Records that relate to RFC 1918-numbered resources within the
; site hosting this AS112 node should not be hosted on this
; name server.
The "db.hostname.as112.net" and "db.hostname.as112.arpa" files
follow, below. These zones contain various resource records that
provide operational data to users for troubleshooting or measurement
purposes, and should be edited to suit local circumstances. Note
that the responses to the queries "HOSTNAME.AS112.NET IN TXT" and
"HOSTNAME.AS112.ARPA IN TXT" should fit within a 512 octet DNS/UDP
datagram: i.e. it should be available over UDP transport without
requiring EDNS0 support by the client.
The optional LOC record [RFC1876] included in each zone apex provides
information about the geospatial location of the node.
; db.hostname.as112.net
;
$TTL 1W
@ SOA SERVER.EXAMPLE.NET. ADMIN.EXAMPLE.NET. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS BLACKHOLE-1.IANA.ORG.
NS BLACKHOLE-2.IANA.ORG.
;
TXT "Name of Facility or similar" "City, Country"
TXT "See http://www.as112.net/ for more information."
;
Abley & Maton Expires December 22, 2014 [Page 15]
Internet-Draft AS112 Nameserver Operations June 2014
LOC 45 25 0.000 N 75 42 0.000 W 80.00m 1m 10000m 10m
; db.hostname.as112.arpa
;
$TTL 1W
@ SOA SERVER.EXAMPLE.NET. ADMIN.EXAMPLE.NET. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS BLACKHOLE.AS112.ARPA.
;
TXT "Name of Facility or similar" "City, Country"
TXT "See http://www.as112.net/ for more information."
;
LOC 45 25 0.000 N 75 42 0.000 W 80.00m 1m 10000m 10m
4.6. Testing a Newly-Installed Node
The BIND9 tool "dig" can be used to retrieve the TXT resource records
associated with the names "HOSTNAME.AS112.NET" and
"HOSTNAME.AS112.ARPA", directed at one of the AS112 anycast name
server addresses. Continuing the example from above, the response
received should indicate the identity of the AS112 node that
responded to the query. See Section 4.5 for more details about the
resource records associated with "HOSTNAME.AS112.NET".
% dig @PRISONER.IANA.ORG HOSTNAME.AS112.NET txt +short +norec
"Name of Facility or similar" "City, Country"
"See http://www.as112.net/ for more information."
%
If the response received indicates a different node is being used,
then there is probably a routing problem to solve. If there is no
response received at all, there might be host or name server problem.
Judicious use of tools such as traceroute, and consultation of BGP
looking glasses might be useful in troubleshooting.
Note that an appropriate set of tests for a new server will include
queries sent from many different places within the expected service
area of the node, using both UDP and TCP transport, and exercising
all three AS112 anycast name server addresses.
Abley & Maton Expires December 22, 2014 [Page 16]
Internet-Draft AS112 Nameserver Operations June 2014
5. Operations
5.1. Monitoring
AS112 nodes should be monitored to ensure they are functioning
correctly, just as with any other production service. An AS112 node
that stops answering queries correctly can cause failures and
timeouts in unexpected places and can lead to failures in dependent
systems that can be difficult to troubleshoot.
5.2. Downtime
An AS112 node that needs to go off-line (e.g. for planned maintenance
or as part of the diagnosis of some problem) should stop advertising
the AS112 service prefixes to its BGP peers. This can be done by
shutting down the routing software on the node altogether or by
causing the routing system to withdraw the route.
Withdrawal of the service prefixes is important in order to avoid
blackholing query traffic in the event that the DNS software on the
node is not functioning normally.
5.3. Statistics and Measurement
Use of the AS112 node should be measured in order to track long-term
trends, identify anomalous conditions, and to ensure that the
configuration of the AS112 node is sufficient to handle the query
load.
Examples of free monitoring tools that might be useful to operators
of AS112 nodes include:
o bindgraph [3]
o dnstop [4]
o DSC [5]
Abley & Maton Expires December 22, 2014 [Page 17]
Internet-Draft AS112 Nameserver Operations June 2014
6. Communications
It is good operational practice to notify the community of users that
may fall within the reach of a new AS112 node before it is installed.
At Internet Exchanges, local mailing lists usually exist to
facilitate such announcements.
For nodes that are intended to be globally reachable, coordination
with other AS112 operators is especially recommended. The mailing
list <mailto:[email protected]> is operated for this
purpose.
Information pertinent to AS112 operations is maintained at
<http://www.as112.net/>.
Information about an AS112 node should also be published within the
DNS, within the "HOSTNAME.AS112.NET" and "HOSTNAME.AS112.ARPA" zones.
See Section 4.5 for more details.