Re: Dnssec still inoperable on the internet ?— was ARIN NS down?

Fri Jan 11 16:36:44 UTC 2019

It's because you see problems it causes, and do not see problems it
solves ;)

11.01.19 17:58, Ca By пише:
> Thanks for the update that dnssec STILL causes more real world problems
> than it solves. 
> 
> .....
> 
> That said, arin is a pro outfit. If they can screw it up, like nasa, so
> can you. No your threats and deploy wisely
> 
> ---------- Forwarded message ---------
> From: *John Curran* <jcurran at istaff.org <mailto:jcurran at istaff.org>>
> Date: Fri, Jan 11, 2019 at 6:36 AM
> Subject: Re: ARIN NS down?
> To: Suresh Ramasubramanian <ops.lists at gmail.com
> <mailto:ops.lists at gmail.com>>
> CC: NANOG <nanog at nanog.org <mailto:nanog at nanog.org>>
> 
> 
> Suresh -
> 
> We’re aware and working the problem.  It looks to me like expired
> RRSIG/DNSKEY’s for the zone, 
> so if you’re using a DNSSEC validating resolver (e.g. Google,
> Cloudflare, Cogent) then ARIN.NET <http://arin.net/>
> is unreachable.   ARIN’s engineering team is working on resolution now.
> 
> /John
> 
> John Curran
> President and CEO
> American Registry for Internet Numbers
> 
> 
>> On 11 Jan 2019, at 9:27 AM, Suresh Ramasubramanian
>> <ops.lists at gmail.com <mailto:ops.lists at gmail.com>> wrote:
>>
>> couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>': not found
>> couldn't get address for 'ns2.arin.net <http://ns2.arin.net/>': not found
>> couldn't get address for 'u.arin.net <http://u.arin.net/>': not found
>> couldn't get address for 'ns3.arin.net <http://ns3.arin.net/>': not found
>> dig: couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>':
>> no more
>>
>> srs at Sureshs-MacBook-Pro-2 19:56:18 <~> $ dig +trace +norec
>> whois.arin.net <http://whois.arin.net/>
>>
>> ; <<>> DiG 9.10.6 <<>> +trace +norec whois.arin.net
>> <http://whois.arin.net/>
>> ;; global options: +cmd
>> .2230INNSm.root-servers.net <http://m.root-servers.net/>.
>> .2230INNSb.root-servers.net <http://b.root-servers.net/>.
>> .2230INNSc.root-servers.net <http://c.root-servers.net/>.
>> .2230INNSd.root-servers.net <http://d.root-servers.net/>.
>> .2230INNSe.root-servers.net <http://e.root-servers.net/>.
>> .2230INNSf.root-servers.net <http://f.root-servers.net/>.
>> .2230INNSg.root-servers.net <http://g.root-servers.net/>.
>> .2230INNSh.root-servers.net <http://h.root-servers.net/>.
>> .2230INNSi.root-servers.net <http://i.root-servers.net/>.
>> .2230INNSj.root-servers.net <http://j.root-servers.net/>.
>> .2230INNSa.root-servers.net <http://a.root-servers.net/>.
>> .2230INNSk.root-servers.net <http://k.root-servers.net/>.
>> .2230INNSl.root-servers.net <http://l.root-servers.net/>.
>> .2230INRRSIGNS 8 0 518400 20190121050000 20190108040000 16749 .
>> JqXTRb0qik0Iy1zDpwKRfKr1iZjTeiJRTk1GCfIWh9dFFvhN0c7Fiz6H
>> lbNfhgQbPsacG0b/1I3rguS13H2guX7apppK2w88h+z8mzym2Bw1C1HR
>> ZR3ocj/jHLJbMqHdQ+DFyRdw/AxCXBdhnbX46C8+unhQ03D/MzS0M0t4
>> vgadYi7BN4sa+iZIilwFV56n2dOfpzyO+evVbcnTLRZ6D4bjCHZLCtO8
>> EDziAPUbVAPZWiflb7/Y2dECe5gbOuGYYU/xv/Pal5+v9cjgMjcf8buG
>> S+iTIL/lnus0JJSRDmkM6yzfYMBXC2ZqhOp+Ls+EfvmqFjIZzi394XCi pdKRZw==
>> ;; Received 525 bytes from 10.0.0.1#53(10.0.0.1) in 40 ms
>>
>> net.172800INNSg.gtld-servers.net <http://g.gtld-servers.net/>.
>> net.172800INNSc.gtld-servers.net <http://c.gtld-servers.net/>.
>> net.172800INNSj.gtld-servers.net <http://j.gtld-servers.net/>.
>> net.172800INNSe.gtld-servers.net <http://e.gtld-servers.net/>.
>> net.172800INNSh.gtld-servers.net <http://h.gtld-servers.net/>.
>> net.172800INNSk.gtld-servers.net <http://k.gtld-servers.net/>.
>> net.172800INNSm.gtld-servers.net <http://m.gtld-servers.net/>.
>> net.172800INNSi.gtld-servers.net <http://i.gtld-servers.net/>.
>> net.172800INNSf.gtld-servers.net <http://f.gtld-servers.net/>.
>> net.172800INNSb.gtld-servers.net <http://b.gtld-servers.net/>.
>> net.172800INNSa.gtld-servers.net <http://a.gtld-servers.net/>.
>> net.172800INNSd.gtld-servers.net <http://d.gtld-servers.net/>.
>> net.172800INNSl.gtld-servers.net <http://l.gtld-servers.net/>.
>> net.86400INDS35886 8 2
>> 7862B27F5F516EBE19680444D4CE5E762981931842C465F00236401D 8BD973EE
>> net.86400INRRSIGDS 8 1 86400 20190124130000 20190111120000 16749 .
>> uahpltN27UkKaFJRaAU1on+IpC2lpgZo84XEM7Pk7dQysKfSnqUkaVLY
>> PXQf9kvgW5eOx/+BttQB2OWFLckJs8vv5ScOpz7dDhs8zR2FPLm93HTD
>> 4F/XEKDNOQbFGSA3g4pZq3fatY7kFEkV9sFTH90WqJt0sXe64LYFcwr2
>> FtrJaS/yhEV4XDbsN3RLkBP58bf526LPpvonwSZsMUTDZcnXtUnc57ZI
>> dlTHg2snNhVWu4qJfHDsEQPwOZagRXJhjlRT8Ox/7HwXvplmRfmeuhZb
>> Vj5kdiY+3j0RTxpLRCG/SZRDIRcvdFKh9umdwQvAzuTS0xzO8OyPw9q8 8QCCYg==
>> ;; Received 1171 bytes from 192.112.36.4#53(g.root-servers.net
>> <http://g.root-servers.net/>) in 207 ms
>>
>> arin.net <http://arin.net/>.172800INNSns1.arin.net <http://ns1.arin.net/>.
>> arin.net <http://arin.net/>.172800INNSns2.arin.net <http://ns2.arin.net/>.
>> arin.net <http://arin.net/>.172800INNSu.arin.net <http://u.arin.net/>.
>> arin.net <http://arin.net/>.172800INNSns3.arin.net <http://ns3.arin.net/>.
>> arin.net <http://arin.net/>.86400INDS48281 5 2
>> 6EB0CCF325A8101A768C93D10CE084303D3714D4E92FEE53D6E683D2 22291017
>> arin.net <http://arin.net/>.86400INDS48281 5 1
>> FCBF93357C8FE3247CECB2CD277F45EB955EE4CE
>> arin.net <http://arin.net/>.86400INRRSIGDS 8 2 86400 20190117062448
>> 20190110051448 6140 net.
>> stuWyfC0PDuk2hNF/Bnz0lnypk+bA/slTa2KYznjmoLXDtq7v1obJq41
>> ZfloQKXuC7MnzpCQj70GU9ZESZq1/XU+u6wDmCqmEUbJ3kyrILxkVrln
>> bTEySJWPmurpwUVzDVfvqFpXEOhWxOjDu6drZMcC3wG9EdPqBuFC6wlf FIQ=
>> couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>': not found
>> couldn't get address for 'ns2.arin.net <http://ns2.arin.net/>': not found
>> couldn't get address for 'u.arin.net <http://u.arin.net/>': not found
>> couldn't get address for 'ns3.arin.net <http://ns3.arin.net/>': not found
>> dig: couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>':
>> no more
>>
>>
>