April 2024 - Test - lists.nanog.org

Netskrt - ISP-colo CDN
by Aaron Gould 07 Apr '24

07 Apr '24

Anyone out there using Netskrt CDN? I mean, installed in your network for content delivery to your customers. I understand Netskrt provides caching for some well known online video streaming services... just wondering if there are any network operators that have worked with Netskrt and deployed their caching servers in your networks and what have you thought about it? What Internet uplink savings are you seeing? Netskrt - https://www.netskrt.io/ -- -Aaron

10 15

TFTP over anycast
by Javier Gutierrez 07 Apr '24

07 Apr '24

Hi, I'm working on some DR design and we want to not only have this site as a DR but also performing some active/active for some of the services we hosts and I was wondering if someone had some experience with using anycast for TFTP or DHCP services? What are some of the pains/challenges you experienced and things we should lookout for? Any input is greatly appreciated. Kind regards, Javier Gutierrez

9 13

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 05 Apr '24

05 Apr '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 06 Apr, 2024 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 942084 Prefixes after maximum aggregation (per Origin AS): 360114 Deaggregation factor: 2.62 Unique aggregates announced (without unneeded subnets): 459596 Total ASes present in the Internet Routing Table: 75654 Prefixes per ASN: 12.45 Origin-only ASes present in the Internet Routing Table: 64860 Origin ASes announcing only one prefix: 26602 Transit ASes present in the Internet Routing Table: 10794 Transit-only ASes present in the Internet Routing Table: 512 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 121 Max AS path prepend of ASN (150315) 116 Prefixes from unregistered ASNs in the Routing Table: 1086 Number of instances of unregistered ASNs: 1088 Number of 32-bit ASNs allocated by the RIRs: 44026 Number of 32-bit ASNs visible in the Routing Table: 36188 Prefixes from 32-bit ASNs in the Routing Table: 184039 Number of bogon 32-bit ASNs visible in the Routing Table: 18 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 619 Number of addresses announced to Internet: 3027941504 Equivalent to 180 /8s, 122 /16s and 184 /24s Percentage of available address space announced: 81.8 Percentage of allocated address space announced: 81.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310836 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 249656 Total APNIC prefixes after maximum aggregation: 73375 APNIC Deaggregation factor: 3.40 Prefixes being announced from the APNIC address blocks: 242199 Unique aggregates announced from the APNIC address blocks: 100126 APNIC Region origin ASes present in the Internet Routing Table: 14077 APNIC Prefixes per ASN: 17.21 APNIC Region origin ASes announcing only one prefix: 4259 APNIC Region transit ASes present in the Internet Routing Table: 1876 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 121 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9461 Number of APNIC addresses announced to Internet: 760500096 Equivalent to 45 /8s, 84 /16s and 79 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 274690 Total ARIN prefixes after maximum aggregation: 124280 ARIN Deaggregation factor: 2.21 Prefixes being announced from the ARIN address blocks: 279512 Unique aggregates announced from the ARIN address blocks: 133350 ARIN Region origin ASes present in the Internet Routing Table: 19131 ARIN Prefixes per ASN: 14.61 ARIN Region origin ASes announcing only one prefix: 6957 ARIN Region transit ASes present in the Internet Routing Table: 1988 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4874 Number of ARIN addresses announced to Internet: 1269403904 Equivalent to 75 /8s, 169 /16s and 145 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 264323 Total RIPE prefixes after maximum aggregation: 126686 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 259065 Unique aggregates announced from the RIPE address blocks: 163033 RIPE Region origin ASes present in the Internet Routing Table: 28624 RIPE Prefixes per ASN: 9.05 RIPE Region origin ASes announcing only one prefix: 12140 RIPE Region transit ASes present in the Internet Routing Table: 3986 Average RIPE Region AS path length visible: 4.5 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11729 Number of RIPE addresses announced to Internet: 714691328 Equivalent to 42 /8s, 153 /16s and 83 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 121581 Total LACNIC prefixes after maximum aggregation: 28909 LACNIC Deaggregation factor: 4.21 Prefixes being announced from the LACNIC address blocks: 119873 Unique aggregates announced from the LACNIC address blocks: 49537 LACNIC Region origin ASes present in the Internet Routing Table: 11074 LACNIC Prefixes per ASN: 10.82 LACNIC Region origin ASes announcing only one prefix: 2599 LACNIC Region transit ASes present in the Internet Routing Table: 2389 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8933 Number of LACNIC addresses announced to Internet: 177207552 Equivalent to 10 /8s, 143 /16s and 249 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 30748 Total AfriNIC prefixes after maximum aggregation: 6155 AfriNIC Deaggregation factor: 5.00 Prefixes being announced from the AfriNIC address blocks: 40816 Unique aggregates announced from the AfriNIC address blocks: 13064 AfriNIC Region origin ASes present in the Internet Routing Table: 1823 AfriNIC Prefixes per ASN: 22.39 AfriNIC Region origin ASes announcing only one prefix: 647 AfriNIC Region transit ASes present in the Internet Routing Table: 357 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 29 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1191 Number of AfriNIC addresses announced to Internet: 105811968 Equivalent to 6 /8s, 78 /16s and 144 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9842 8742 66 CHINAMOBILE-CN China Mobile Communicati 7545 5655 777 674 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4934 4192 76 ERX-CERNET-BKB China Education and Rese 7552 3862 1330 20 VIETEL-AS-AP Viettel Group, VN 7713 3623 1043 64 TELKOMNET-AS-AP PT Telekomunikasi Indon 9498 3563 497 257 BBIL-AP BHARTI Airtel Ltd., IN 45899 3289 1872 98 VNPT-AS-VN VNPT Corp, VN 24560 2772 864 363 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 4766 2309 11259 575 KIXS-AS-KR Korea Telecom, KR 4755 2199 434 196 TATACOMM-AS TATA Communications formerl Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9818 11370 3396 AMAZON-02, US 11492 4600 305 612 CABLEONE, US 7155 4170 287 89 VIASAT-SP-BACKBONE, US 6327 3605 1320 75 SHAW, CA 22773 3525 3046 240 ASN-CXA-ALL-CCI-22773-RDC, US 174 3320 6631 827 COGENT-174, US 749 3202 54912 2454 DNIC-AS-00749, US 16625 3099 1322 2215 AKAMAI-AS, US 367 2876 3553 1366 DNIC-ASBLK-00306-00371, US 396982 2765 3641 413 GOOGLE-CLOUD-PLATFORM, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7664 1709 144 UNI2-AS, ES 39891 4758 286 60 ALJAWWALSTC-AS, SA 20940 3858 3396 128 AKAMAI-ASN1, NL 9009 3268 283 1597 M247, RO 12389 2979 2303 903 ROSTELECOM-AS, RU 8551 2637 368 35 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 34984 2349 364 583 TELLCOM-AS, TR 13188 1607 100 26 TRIOLAN, UA 8452 1528 1852 14 TE-AS TE-AS, EG 44477 1512 99 719 STARK-INDUSTRIES, GB Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12352 3314 487 UNINET, MX 10620 3526 496 887 Telmex Colombia S.A., CO 13999 2522 346 654 Mega Cable, S.A. de C.V., MX 11830 2004 369 64 Instituto Costarricense de Electricidad 28573 1342 2317 245 Claro NXT Telecomunicacoes Ltda, BR 3816 1312 788 199 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 1147 177 424 Techtel LMDS Comunicaciones Interactiva 6503 1103 346 480 Axtel, S.A.B. de C.V., MX 6147 1081 369 22 Telefonica del Peru S.A.A., PE 22884 1072 114 377 TOTAL PLAY TELECOMUNICACIONES SA DE CV, Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1549 545 28 RAYA-AS, EG 24863 1502 389 20 LINKdotNET-AS, EG 36992 1367 1519 283 ETISALAT-MISR, EG 36903 1249 554 96 MT-MPLS, MA 29571 1159 75 74 ORANGE-COTE-IVOIRE, CI 36935 935 521 42 Vodafone-, EG 6713 553 1861 34 IAM-AS, MA 15399 534 56 56 WANANCHI-, KE 36914 484 82 3 KENET-AS, KE 24757 429 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12352 3314 487 UNINET, MX 9808 9842 8742 66 CHINAMOBILE-CN China Mobile Communicati 16509 9818 11370 3396 AMAZON-02, US 12479 7664 1709 144 UNI2-AS, ES 7545 5655 777 674 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4934 4192 76 ERX-CERNET-BKB China Education and Rese 39891 4758 286 60 ALJAWWALSTC-AS, SA 11492 4600 305 612 CABLEONE, US 7155 4170 287 89 VIASAT-SP-BACKBONE, US 7552 3862 1330 20 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9842 9776 CHINAMOBILE-CN China Mobile Communications Grou 12479 7664 7520 UNI2-AS, ES 16509 9818 6422 AMAZON-02, US 7545 5655 4981 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4934 4858 ERX-CERNET-BKB China Education and Research Net 39891 4758 4698 ALJAWWALSTC-AS, SA 7155 4170 4081 VIASAT-SP-BACKBONE, US 11492 4600 3988 CABLEONE, US 7552 3862 3842 VIETEL-AS-AP Viettel Group, VN 20940 3858 3730 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 65536 DOCUMENT 5.102.30.0/24 65512 -Private Use AS-, ZZ 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 27.0.192.0/22 Origin: 138415 HENGDA-HK HENGDA NETWORK LIMITED, HK 27.0.192.0/22 Transit: 51847 NEAROUTE, HK 27.0.192.0/24 Origin: 138195 MOACKCOLTD-AS-AP MOACK.Co.LTD, KR 27.0.192.0/24 Transit: 3786 LGDACOM LG DACOM Corporation, KR 27.0.193.0/24 Origin: 138195 MOACKCOLTD-AS-AP MOACK.Co.LTD, KR 27.0.193.0/24 Transit: 3786 LGDACOM LG DACOM Corporation, KR Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:37 /11:95 /12:297 /13:583 /14:1195 /15:2072 /16:13290 /17:8241 /18:13732 /19:24837 /20:43930 /21:51558 /22:111110 /23:98490 /24:571852 /25:735 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6782 7664 UNI2-AS, ES 8151 6377 12352 UNINET, MX 11492 3513 4600 CABLEONE, US 39891 3440 4758 ALJAWWALSTC-AS, SA 6327 3402 3605 SHAW, CA 7155 3114 4170 VIASAT-SP-BACKBONE, US 22773 2614 3525 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2142 2487 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2132 3526 Telmex Colombia S.A., CO 8551 2113 2637 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1637 2:1488 3:321 4:6 5:4522 6:162 7:6 8:1512 9:1 11:172 12:1463 13:377 14:2397 15:318 16:209 17:368 18:758 20:358 21:4 22:188 23:6662 24:2718 25:2 27:2558 29:19 31:2681 32:49 34:60 35:126 36:2272 37:4460 38:7146 39:892 40:125 41:4078 42:982 43:2355 44:318 45:17011 46:4392 47:302 49:1945 50:1918 51:573 52:1586 54:307 55:996 56:5 57:167 58:1888 59:1245 60:1029 61:2589 62:2675 63:1892 64:5508 65:2314 66:4705 67:3064 68:1334 69:4103 70:1192 71:572 72:2903 74:2585 75:1548 76:630 77:2425 78:1845 79:2486 80:2188 81:1957 82:1547 83:1310 84:1650 85:3130 86:836 87:2271 88:1246 89:4025 90:680 91:8077 92:2197 93:2654 94:3670 95:4142 96:1307 97:314 98:1030 99:744 100:94 101:1180 102:3116 103:32536 104:4853 105:636 106:940 107:2739 108:1118 109:4069 110:2139 111:3273 112:2073 113:1592 114:1792 115:2013 116:1886 117:2618 118:2383 119:1964 120:1813 121:1326 122:2683 123:2230 124:1621 125:2884 126:32 128:1477 129:937 130:1105 131:1855 132:801 133:410 134:1720 135:316 136:941 137:1060 138:2838 139:1563 140:1387 141:1361 142:1592 143:1500 144:998 145:348 146:2049 147:1752 148:2473 149:2583 150:1034 151:1337 152:2006 153:523 154:6284 155:1427 156:2237 157:1696 158:1080 159:2322 160:2627 161:1637 162:3593 163:1718 164:1642 165:2131 166:1129 167:1779 168:3925 169:793 170:4760 171:1026 172:3823 173:3040 174:905 175:1202 176:3628 177:4720 178:3586 179:2264 180:2358 181:3662 182:3432 183:1803 184:2275 185:20694 186:4974 187:4499 188:4041 189:4130 190:9326 191:1504 192:10978 193:9048 194:7458 195:5270 196:3149 197:2344 198:6009 199:7552 200:8055 201:6292 202:10469 203:10186 204:4564 205:3759 206:4501 207:3490 208:4142 209:5044 210:4656 211:2582 212:4322 213:3385 214:1085 215:50 216:6778 217:2820 218:1362 219:581 220:2047 221:1034 222:881 223:2239 End of report

1 0

Microsoft missing public DNS TXT entry for DKIM records (msn.com)
by Adam Brenner 04 Apr '24

04 Apr '24

Apologies if this message is the wrong listserv to ask this question but we are scratching are heads here. We run our own exim mail server and are receiving reports of end users getting bounce back messages when they send email from msn.com to our mail server. Our mail server checks if DKIM email headers are present and if they are, tries to validate them. If the check fails, we reject the message. We are noticing that Microsoft, specifically, msn.com, does *not* publish DKIM DNS text records but sends email with the DKIM email headers. Is this normal or correct? Anyone have information or a contact at Microsoft that can fix this -- publish their DKIM records? It seems to me that if msn.com is going to include DKIM headers in their outgoing email, they should also publish their DKIM public key. If they are not going to publish their DKIM public key, then they should not include DKIM headers in their outgoing email. Other Microsoft email accounts and services such as hotmail.com and outlook.com publish their DKIM records. Again, it seems msn.com should as well. If we look at a bounce back messages we see the following snippet: Generating server: PH7PR84MB1704.NAMPRD84.PROD.OUTLOOK.COM ... Remote server returned '550 5.0.350 Remote server returned an error -> 550 DKIM: encountered the following problem validating msn.com:;pubkey_unavailable' Original message headers: ... DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=msn.com; s=selector1; ... When we try and perform a TXT DNS query to fetch the DKIM record: selector1._domainkey.msn.com we see that Microsoft does *not* publish their DKIM records: adam@defiant ~ $ dig selector1._domainkey.msn.com TXT ; <<>> DiG 9.18.25 <<>> selector1._domainkey.msn.com TXT ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13050 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;selector1._domainkey.msn.com. IN TXT ;; ANSWER SECTION: selector1._domainkey.msn.com. 21170 IN CNAME www-msn-com.a-0003.a-msedge.net. www-msn-com.a-0003.a-msedge.net. 240 IN CNAME a-0003.a-msedge.net. ;; AUTHORITY SECTION: a-msedge.net. 184 IN SOA ns1.a-msedge.net. msnhst.microsoft.com. 2016092901 1800 900 2419200 240 ;; Query time: 20 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP) ;; WHEN: Wed Apr 03 23:04:31 PDT 2024 ;; MSG SIZE rcvd: 173 Again, this problem does *not* exist when we perform the same query to hotmail.com and outlook.com as those domains publish their DKIM TXT records: selector1._domainkey.outlook.com and selector1._domainkey.hotmail.com -- Adam Brenner https://aeb.io/

5 5

Talk of the Week, Peering Forum, Socials + More
by Nanog News 04 Apr '24

04 Apr '24

*NANOG Talk of the Week* *Go Lang for Engineers with Arista Networks' Daniel Hertzberg * *Why it's worth your time:* At 820 views and counting since our last meeting in February, this talk is a gateway for network engineers into the world of Go, demystifying its core concepts and illustrating its unparalleled potential for building efficient, concurrent, and performant network automation tasks. <https://www.youtube.com/watch?v=cKx1VU4yMHI> *WATCH NOW * <https://www.youtube.com/watch?v=cKx1VU4yMHI> *N91 Peering Coordination Forum Applications are Open! * *Open Until 24 May or 20 Applications Received* The forum allows attendees to meet and network with others in the peering community present at NANOG. *MORE INFO * <https://nanog.org/events/nanog-91/peering/> *Check out the NANOG 91 Socials Schedule * *Make your Travel Arrangements Now * NANOG Socials are an incredible opportunity to get to know your peers in the industry + foster important relationships in a relaxed, casual environment. *N91 SOCIALS * <https://nanog.org/events/nanog-91/socials/> *VIDEO - Experience a NANOG Meeting * *Watch the Recap of Our Most Recent Meeting — N90 in Charlotte, NC * Our last meeting may have come and gone— but the memories will last forever! Check out some familiar faces + learn what makes a NANOG meeting special. *WATCH NOW * <https://nanog.org/stories/nanog-tv/nanog-90-recap/>

1 0

Unimus as NCM (Network Configuration Management) Tool
by Shahid Shafi 04 Apr '24

04 Apr '24

Hi Network Experts, Is anyone using Unimus as your main NCM tool in production? I am looking at an NCM tool that can scale upto 10,000 to 15,000 Network Devices. Do you recommend any other solution? The solution should atleast able to support network config backups, diffs, and basic network auditing features. https://unimus.net/ thanks Shahid

11 10

WhatsApp a bit flakey
by Dovid Bender 03 Apr '24

03 Apr '24

FYI: It seems there are global issues with WhatsApp. Calls do not seem to be working and messaging is sporadic up and down.

1 0

DNSSEC & WIldcards
by Dennis Burgess 03 Apr '24

03 Apr '24

So have *.app.linktechs.net that I have been trying to get to work, we have DNSSEC on this, and its failing, but cannot for the life of me understand why. I think it may have something to do with proving it exists as a wildcard, but any DNSSEC experts want to take a stab at it ? Dennis Burgess

8 13

SRI's Dan Lynch dies
by Jay R. Ashworth 02 Apr '24

02 Apr '24

>From Lauren Weinstein @ PRIVACY Digest: """ Dan Lynch, one of the key people involved in building the Internet and ARPANET before it, has died. Dan was director of computing facilities at SRI International, where ARPANET node #2 was located and he worked on development of TCP/IP, and where the first packets were received from our site at UCLA node #1 to SRI, and later at USC-ISI led the team that made the transition from the original ARPANET NCP protocols to TCP/IP for the Internet. And much more. Peace. -L """ He was well written up across the web, but here's a 2021 piece for those who aren't as familiar with his background: https://www.internethalloffame.org/2021/04/19/dan-lynchs-love-brilliant-com… And his IHoF induction speech: http://opentranscripts.org/transcript/dan-lynch-ihof-2019-speech/ I would note his age here, as obits usually do, but it seems unusually difficult to learn. Happy landings, Mr Lynch. Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

8 7

Call for Participation -- ICANN81 DNSSEC and Security Workshop for ICANN Policy Forum
by Jacques Latour 02 Apr '24

02 Apr '24

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN Policy Forum In cooperation with the ICANN Security and Stability Advisory Committee (SSAC), we are planning a DNSSEC and Security Workshop for the ICANN80 Policy Forum being held as a hybrid meeting from 10-13 June 2024 Kigali, Rwanda in the Central Africa Time - CAT (UTC +2). This workshop date will be determined once ICANN creates a block schedule for us to follow; then we will be able to request a day and time. The DNSSEC and Security Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN79 The Community Forum on Wednesday, 06 March 2024. The presentations and transcripts are available at: https://icann79.sched.com/. The DNSSEC Workshop Program Committee is developing a program for the upcoming meeting. Proposals will be considered for the following topic areas and included if space permits. In addition, we welcome suggestions for additional topics either for inclusion in the ICANN78 workshop, or for consideration for future workshops. 1. Global DNSSEC Activities Panel For this panel, we are seeking participation from those who have been involved in DNSSEC deployment as well as from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment, including Root Key Signing Key (KSK) Rollover activities and plans. 2. DNSSEC Best Practice Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? * Do you still submit/accept DS records with Digest Type 1? * What is the best practice around key roll-overs? * What about Algorithm roll-overs? * Do you use and support DNSKEY Algorithms 13-16? * How often do you review your disaster recovery procedures? * Is there operational familiarity within your customer support teams? * What operational statistics have been gathered about DNSSEC? * Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? Activities and issues related to DNSSEC in the DNS Root Zone are also desired. 3. DNSSEC Deployment Challenges The program committee is seeking input from those that are interested in implementation of DNSSEC but have general or concerns with DNSSEC. We are seeking input from individuals that would be willing to participate in a panel that would discuss questions of the following nature: * Are there any policies directly or indirectly impeding your DNSSEC deployment? (RRR model, CDS/CDNSKEY automation) * What are your most significant concerns with DNSSEC, e.g., complexity, training, implementation, operation, or something else? * What do you expect DNSSEC to do for you and what doesn't it do? * What do you see as the most important trade-offs with respect to doing or not doing DNSSEC? 4. Security Panel The program committee is looking for presentations on DNS, DNSSEC, routing and other topics that could impact the security and/or stability of the Internet. We are looking for presentations that cover implementation issues, challenges, opportunities, and best practices for: * Emerging threats that could impact the security and/or stability of the Internet * DoH and DoT * RPKI (Resource Public Key Infrastructure) * BGP routing & secure implementations * MANRS ( Mutually Agreed Norms for Routing Security) * Browser security – DNS, DNSSEC, DoH * EMAIL & DNS related security – DMARC, DKIM, TLSA, etc… If you are interested in participating, please send a brief (1-3 sentence) description of your proposed presentation to dnssec-security-workshop(a)icann.org<mailto:dnssec-security-workshop@icann.org> by COB Friday, 10 May 2024. Thank you, Jacques On behalf of the DNSSEC Workshop Program Committee: Steve Crocker, Edgemoor Research Institute Mark Elkins, DNS/ZARC Jacques Latour, .CA Russ Mundy, Tislabs Yoshiro Yoneya Dan York, Internet Society

1 0