Is this the right time to ask whether everyone who operates DNSSEC validating resolvers was required to click somewhere on the ARIN website that they agree to be bound by the Relying Party Agreement before their resolver can make DNSSEC lookups against the ARIN nameservers? Or does that logic only apply for access to the RPKI TAL? Best regards, Martijn On 1/11/19 3:34 PM, John Curran wrote:
Suresh -
We’re aware and working the problem. It looks to me like expired RRSIG/DNSKEY’s for the zone, so if you’re using a DNSSEC validating resolver (e.g. Google, Cloudflare, Cogent) then ARIN.NET <http://arin.net/> is unreachable. ARIN’s engineering team is working on resolution now.
/John
John Curran President and CEO American Registry for Internet Numbers
On 11 Jan 2019, at 9:27 AM, Suresh Ramasubramanian <ops.lists@gmail.com <mailto:ops.lists@gmail.com>> wrote:
couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>': not found couldn't get address for 'ns2.arin.net <http://ns2.arin.net/>': not found couldn't get address for 'u.arin.net <http://u.arin.net/>': not found couldn't get address for 'ns3.arin.net <http://ns3.arin.net/>': not found dig: couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>': no more
srs@Sureshs-MacBook-Pro-2 19:56:18 <~> $ dig +trace +norec whois.arin.net <http://whois.arin.net/>
; <<>> DiG 9.10.6 <<>> +trace +norec whois.arin.net <http://whois.arin.net/> ;; global options: +cmd .2230INNSm.root-servers.net <http://m.root-servers.net/>. .2230INNSb.root-servers.net <http://b.root-servers.net/>. .2230INNSc.root-servers.net <http://c.root-servers.net/>. .2230INNSd.root-servers.net <http://d.root-servers.net/>. .2230INNSe.root-servers.net <http://e.root-servers.net/>. .2230INNSf.root-servers.net <http://f.root-servers.net/>. .2230INNSg.root-servers.net <http://g.root-servers.net/>. .2230INNSh.root-servers.net <http://h.root-servers.net/>. .2230INNSi.root-servers.net <http://i.root-servers.net/>. .2230INNSj.root-servers.net <http://j.root-servers.net/>. .2230INNSa.root-servers.net <http://a.root-servers.net/>. .2230INNSk.root-servers.net <http://k.root-servers.net/>. .2230INNSl.root-servers.net <http://l.root-servers.net/>. .2230INRRSIGNS 8 0 518400 20190121050000 20190108040000 16749 . JqXTRb0qik0Iy1zDpwKRfKr1iZjTeiJRTk1GCfIWh9dFFvhN0c7Fiz6H lbNfhgQbPsacG0b/1I3rguS13H2guX7apppK2w88h+z8mzym2Bw1C1HR ZR3ocj/jHLJbMqHdQ+DFyRdw/AxCXBdhnbX46C8+unhQ03D/MzS0M0t4 vgadYi7BN4sa+iZIilwFV56n2dOfpzyO+evVbcnTLRZ6D4bjCHZLCtO8 EDziAPUbVAPZWiflb7/Y2dECe5gbOuGYYU/xv/Pal5+v9cjgMjcf8buG S+iTIL/lnus0JJSRDmkM6yzfYMBXC2ZqhOp+Ls+EfvmqFjIZzi394XCi pdKRZw== ;; Received 525 bytes from 10.0.0.1#53(10.0.0.1) in 40 ms
net.172800INNSg.gtld-servers.net <http://g.gtld-servers.net/>. net.172800INNSc.gtld-servers.net <http://c.gtld-servers.net/>. net.172800INNSj.gtld-servers.net <http://j.gtld-servers.net/>. net.172800INNSe.gtld-servers.net <http://e.gtld-servers.net/>. net.172800INNSh.gtld-servers.net <http://h.gtld-servers.net/>. net.172800INNSk.gtld-servers.net <http://k.gtld-servers.net/>. net.172800INNSm.gtld-servers.net <http://m.gtld-servers.net/>. net.172800INNSi.gtld-servers.net <http://i.gtld-servers.net/>. net.172800INNSf.gtld-servers.net <http://f.gtld-servers.net/>. net.172800INNSb.gtld-servers.net <http://b.gtld-servers.net/>. net.172800INNSa.gtld-servers.net <http://a.gtld-servers.net/>. net.172800INNSd.gtld-servers.net <http://d.gtld-servers.net/>. net.172800INNSl.gtld-servers.net <http://l.gtld-servers.net/>. net.86400INDS35886 8 2 7862B27F5F516EBE19680444D4CE5E762981931842C465F00236401D 8BD973EE net.86400INRRSIGDS 8 1 86400 20190124130000 20190111120000 16749 . uahpltN27UkKaFJRaAU1on+IpC2lpgZo84XEM7Pk7dQysKfSnqUkaVLY PXQf9kvgW5eOx/+BttQB2OWFLckJs8vv5ScOpz7dDhs8zR2FPLm93HTD 4F/XEKDNOQbFGSA3g4pZq3fatY7kFEkV9sFTH90WqJt0sXe64LYFcwr2 FtrJaS/yhEV4XDbsN3RLkBP58bf526LPpvonwSZsMUTDZcnXtUnc57ZI dlTHg2snNhVWu4qJfHDsEQPwOZagRXJhjlRT8Ox/7HwXvplmRfmeuhZb Vj5kdiY+3j0RTxpLRCG/SZRDIRcvdFKh9umdwQvAzuTS0xzO8OyPw9q8 8QCCYg== ;; Received 1171 bytes from 192.112.36.4#53(g.root-servers.net <http://g.root-servers.net/>) in 207 ms
arin.net <http://arin.net/>.172800INNSns1.arin.net <http://ns1.arin.net/>. arin.net <http://arin.net/>.172800INNSns2.arin.net <http://ns2.arin.net/>. arin.net <http://arin.net/>.172800INNSu.arin.net <http://u.arin.net/>. arin.net <http://arin.net/>.172800INNSns3.arin.net <http://ns3.arin.net/>. arin.net <http://arin.net/>.86400INDS48281 5 2 6EB0CCF325A8101A768C93D10CE084303D3714D4E92FEE53D6E683D2 22291017 arin.net <http://arin.net/>.86400INDS48281 5 1 FCBF93357C8FE3247CECB2CD277F45EB955EE4CE arin.net <http://arin.net/>.86400INRRSIGDS 8 2 86400 20190117062448 20190110051448 6140 net. stuWyfC0PDuk2hNF/Bnz0lnypk+bA/slTa2KYznjmoLXDtq7v1obJq41 ZfloQKXuC7MnzpCQj70GU9ZESZq1/XU+u6wDmCqmEUbJ3kyrILxkVrln bTEySJWPmurpwUVzDVfvqFpXEOhWxOjDu6drZMcC3wG9EdPqBuFC6wlf FIQ= couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>': not found couldn't get address for 'ns2.arin.net <http://ns2.arin.net/>': not found couldn't get address for 'u.arin.net <http://u.arin.net/>': not found couldn't get address for 'ns3.arin.net <http://ns3.arin.net/>': not found dig: couldn't get address for 'ns1.arin.net <http://ns1.arin.net/>': no more