Is this the right time to ask whether everyone who operates DNSSEC validating resolvers was required to click somewhere on the ARIN website that they agree to be bound by the Relying Party Agreement before their resolver can make DNSSEC lookups against the ARIN nameservers?

Or does that logic only apply for access to the RPKI TAL?

Best regards,
Martijn

On 1/11/19 3:34 PM, John Curran wrote:
Suresh -

We’re aware and working the problem.  It looks to me like expired RRSIG/DNSKEY’s for the zone, 
so if you’re using a DNSSEC validating resolver (e.g. Google, Cloudflare, Cogent) then ARIN.NET
is unreachable.   ARIN’s engineering team is working on resolution now.

/John

John Curran
President and CEO
American Registry for Internet Numbers


On 11 Jan 2019, at 9:27 AM, Suresh Ramasubramanian <ops.lists@gmail.com> wrote:

couldn't get address for 'ns1.arin.net': not found
couldn't get address for 'ns2.arin.net': not found
couldn't get address for 'u.arin.net': not found
couldn't get address for 'ns3.arin.net': not found
dig: couldn't get address for 'ns1.arin.net': no more

srs@Sureshs-MacBook-Pro-2 19:56:18 <~> $ dig +trace +norec whois.arin.net

; <<>> DiG 9.10.6 <<>> +trace +norec whois.arin.net
;; global options: +cmd
. 2230 IN NS m.root-servers.net.
. 2230 IN NS b.root-servers.net.
. 2230 IN NS c.root-servers.net.
. 2230 IN NS d.root-servers.net.
. 2230 IN NS e.root-servers.net.
. 2230 IN NS f.root-servers.net.
. 2230 IN NS g.root-servers.net.
. 2230 IN NS h.root-servers.net.
. 2230 IN NS i.root-servers.net.
. 2230 IN NS j.root-servers.net.
. 2230 IN NS a.root-servers.net.
. 2230 IN NS k.root-servers.net.
. 2230 IN NS l.root-servers.net.
. 2230 IN RRSIG NS 8 0 518400 20190121050000 20190108040000 16749 . JqXTRb0qik0Iy1zDpwKRfKr1iZjTeiJRTk1GCfIWh9dFFvhN0c7Fiz6H lbNfhgQbPsacG0b/1I3rguS13H2guX7apppK2w88h+z8mzym2Bw1C1HR ZR3ocj/jHLJbMqHdQ+DFyRdw/AxCXBdhnbX46C8+unhQ03D/MzS0M0t4 vgadYi7BN4sa+iZIilwFV56n2dOfpzyO+evVbcnTLRZ6D4bjCHZLCtO8 EDziAPUbVAPZWiflb7/Y2dECe5gbOuGYYU/xv/Pal5+v9cjgMjcf8buG S+iTIL/lnus0JJSRDmkM6yzfYMBXC2ZqhOp+Ls+EfvmqFjIZzi394XCi pdKRZw==
;; Received 525 bytes from 10.0.0.1#53(10.0.0.1) in 40 ms

net. 172800 IN NS g.gtld-servers.net.
net. 172800 IN NS c.gtld-servers.net.
net. 172800 IN NS j.gtld-servers.net.
net. 172800 IN NS e.gtld-servers.net.
net. 172800 IN NS h.gtld-servers.net.
net. 172800 IN NS k.gtld-servers.net.
net. 172800 IN NS m.gtld-servers.net.
net. 172800 IN NS i.gtld-servers.net.
net. 172800 IN NS f.gtld-servers.net.
net. 172800 IN NS b.gtld-servers.net.
net. 172800 IN NS a.gtld-servers.net.
net. 172800 IN NS d.gtld-servers.net.
net. 172800 IN NS l.gtld-servers.net.
net. 86400 IN DS 35886 8 2 7862B27F5F516EBE19680444D4CE5E762981931842C465F00236401D 8BD973EE
net. 86400 IN RRSIG DS 8 1 86400 20190124130000 20190111120000 16749 . uahpltN27UkKaFJRaAU1on+IpC2lpgZo84XEM7Pk7dQysKfSnqUkaVLY PXQf9kvgW5eOx/+BttQB2OWFLckJs8vv5ScOpz7dDhs8zR2FPLm93HTD 4F/XEKDNOQbFGSA3g4pZq3fatY7kFEkV9sFTH90WqJt0sXe64LYFcwr2 FtrJaS/yhEV4XDbsN3RLkBP58bf526LPpvonwSZsMUTDZcnXtUnc57ZI dlTHg2snNhVWu4qJfHDsEQPwOZagRXJhjlRT8Ox/7HwXvplmRfmeuhZb Vj5kdiY+3j0RTxpLRCG/SZRDIRcvdFKh9umdwQvAzuTS0xzO8OyPw9q8 8QCCYg==
;; Received 1171 bytes from 192.112.36.4#53(g.root-servers.net) in 207 ms

arin.net. 172800 IN NS ns1.arin.net.
arin.net. 172800 IN NS ns2.arin.net.
arin.net. 172800 IN NS u.arin.net.
arin.net. 172800 IN NS ns3.arin.net.
arin.net. 86400 IN DS 48281 5 2 6EB0CCF325A8101A768C93D10CE084303D3714D4E92FEE53D6E683D2 22291017
arin.net. 86400 IN DS 48281 5 1 FCBF93357C8FE3247CECB2CD277F45EB955EE4CE
arin.net. 86400 IN RRSIG DS 8 2 86400 20190117062448 20190110051448 6140 net. stuWyfC0PDuk2hNF/Bnz0lnypk+bA/slTa2KYznjmoLXDtq7v1obJq41 ZfloQKXuC7MnzpCQj70GU9ZESZq1/XU+u6wDmCqmEUbJ3kyrILxkVrln bTEySJWPmurpwUVzDVfvqFpXEOhWxOjDu6drZMcC3wG9EdPqBuFC6wlf FIQ=
couldn't get address for 'ns1.arin.net': not found
couldn't get address for 'ns2.arin.net': not found
couldn't get address for 'u.arin.net': not found
couldn't get address for 'ns3.arin.net': not found
dig: couldn't get address for 'ns1.arin.net': no more