Implementation of ARIN's Lame DNS Delegation Policy

1. Implementation of ARIN's Lame DNS Delegation Policy Edward Lewis Research Engineer ARIN edlewis@arin.net

2. Abstract • The membership of ARIN has approved a policy to curb lame delegations • The staff is implementing it and has already seen a reduction • This presentation will outline the policy, results, and how ARIN is interacting with registrants and registries NANOG 28

3. Background • MAR 2002 – Proposed on ARIN ppml (list) • APR 2002 – Discussion at ARIN IX • JUN 2002 – Measured extent of problem • SUM 2002 – Discussion on email lists • OCT 2002 – Discussion at ARIN X • NOV 2002 – Policy adopted • DEC 2002 – Implementation activity begins NANOG 28

4. Policy Summary NANOG 28

5. Policy Summary Four Phases NANOG 28

6. Policy Summary • Four Phases • Test NANOG 28

7. Policy Summary • Four Phases • Test Identify Lame Delegation NANOG 28

8. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation NANOG 28

9. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC NANOG 28

10. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC If No Contact Proceed to Next Step NANOG 28

11. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC E-mail the ASN POC NANOG 28

12. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC E-mail the ASN POC If No Contact Proceed to Next Step NANOG 28

13. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC NANOG 28

14. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC If No Contact Proceed to Next Step NANOG 28

15. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC NANOG 28

16. Policy Summary • Four Phases • Test • Attempt Contact Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC If No Contact Proceed to Next Step NANOG 28

17. Policy Summary • Four Phases • Test • Attempt Contact • Evaluate Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC NANOG 28

18. Policy Summary • Four Phases • Test • Attempt Contact • Evaluate Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC Wait 30 Days NANOG 28

19. Policy Summary • Four Phases • Test • Attempt Contact • Evaluate Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC Wait 30 Days Delegation Declared Lame NANOG 28

20. Policy Summary • Four Phases • Test • Attempt Contact • Evaluate • Remove Delegation Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC Wait 30 Days Delegation Declared Lame NANOG 28

21. Policy Summary • Four Phases • Test • Attempt Contact • Evaluate • Remove Delegation Identify Lame Delegation E-mail the network POC E-mail the ASN POC Telephone the network or ASN POC Postal Mail the network or ASN POC • Remove NS Delegations • Update WHOIS Record • Delegation Determined to be Lame • Evaluation Date of the Lame Delegation • Contact has been Attempted Unsuccessfully • Date Record Updated Wait 30 Days Delegation Declared Lame Update Record NANOG 28

22. Lame Delegation Test • Query for SOA record of zone • Try all IP addresses for each server of zone • In response, flag as lame if: • No Authoritative Answer (AA) bit set • AA bit set, but an empty answer section • AA bit set, but answer is not an SOA record NANOG 28

23. What is Not Flagged • Not flagged as lame in this round of testing: • No IP address for name server • No answer from server • This will be flagged in the future NANOG 28

24. 2nd Notice 1st Notice Test Test Test 15 Feb 13 Mar 27 Mar 4-6 Mar 18-20 Mar Notice Test Test 12 May 30 May 15 May Timeline • Notify Network POC • Notify Autonomous System POC NANOG 28

25. Zone Results bounce! NANOG 28

26. Server Results • 13 Feb findings, percentage of servers • 77% not flagged as lame • (good OR no address/answer) • 19% Authoritative Answer bit set to 0 • 4% with empty answer section • <1% with a non-SOA answer (CNAME) NANOG 28

27. Notification Results • 3rd Notice - approx. 150 calls in first few days NANOG 28

28. Help Desk Actions • Determine the problem/exact question • Use “Lame” tool, BIND’s dig tool • Review results with registrant • Explain expected results • Walk through steps to correct ARIN DB entry • Refer registrant for further assistance: • Their local support • Vendor of their name server • BIND documentation (if using a BIND server) NANOG 28

29. Observations • People are interested • Want to correct problem • Want to know what this is about • Based on feedback from community: http://www.arin.net/registration/lame_delegations/index.html • This will be a deliberate process NANOG 28

30. Next Steps • Continue notification as per policy • Update database information • Continue testing for lameness • Identify engineering issues with testing • Identify implementation issues • Share experiences with other registries NANOG 28

31. Email Addresses • Discussions of lame delegations are happening in other regions too • APNIC SIG on DNS issues • <sig-dns.lists.apnic.net> • RIPE DNS Working Group • <dns-wg.ripe.net> • Tool-specific mailing lists • My address: edlewis@arin.net NANOG 28

32. Thank You