Articles
Likes on articles
• 10 min read
The RIPE NCC operates two independent anycast DNS services. One is K-root, a well-known service essential to DNS resolution. The other is the less well-known service, AuthDNS. We examine how queries reach AuthDNS from several regions and call for new hosts to help shorten the journey.
• 8 min read
Since 1992, the RIPE NCC has been the only Regional Internet Registry to offer a secondary DNS server to its members, called ns.ripe.net. LIRs with a /16-sized IPv4 allocation or a /32-sized IPv6 allocation have been able to use this service to ensure the stability of the DNS service for these larg…
• 3 min read
Expanding the RIPE NCC Authoritative DNS Service means cooperating with the community to find organisations out there willing to host AuthDNS instances on their networks. In this article, find out exactly what's required from hosts and how to apply.
• 6 min read
We're steadily expanding the capacity of our Authoritative DNS (AuthDNS) cluster to ensure it keeps providing resilient and speedy service. Here's a look at what the cluster does and the steps we're taking towards its expansion.
• 7 min read
In this article we describe the evaluation and selection of a new DNSSEC signer solution, along with a plan of how we intend to perform the migration.
• 3 min read
This is an experiment to see if we can increase the capacity and resiliency of the RIPE NCC's authoritative DNS service (AS197000). This service hosts all the reverse DNS zones, ripe.net and provides secondary service for various ccTLDs.
• 5 min read
DNSSEC signing solutions and products have evolved greatly since we first began signing our zones. We are now exploring ways of doing it better and smarter.
• 4 min read
On Thursday 16 March 2017, at around 20:00 UTC, a bug in a script caused an outage for some reverse DNS delegations registered in the RIPE Database. The effects of the bug were not immediate, but began a cascading failure, that persisted until 18:00 UTC on Friday 17 March. In the following article,…
• 8 min read
Rolling over the algorithm (usually to a stronger variant) used to sign a DNS zone isn't as easy as regular key roll-overs. This is because some DNSSEC validators are less forgiving than others, and fail validation unless the right combination of keys and signatures is present in a zone. This ar…
• 1 min read
This graph shows TCP queries coming to K-root during 4 hours on 3 June 2010.
Hi Roland. We don't have plans for CDS/CDNSKEY at the moment. However, if we hear otherwise from the community, and more people would like the RIPE NCC to support it, then we would certainly look at implementing it for the reverse DNS zones.
Showing 1 comment(s)