The root zone DNSSEC deployment team is pleased to announce a new web site with information about the project, http://www.root-dnssec.org. The site serves as a repository for documentation and information about deploying DNSSEC in the root zone, including technical status updates. The first status update is available on the site and is included below, as well. Additional documentation will be posted as it becomes available. Important announcements and future status updates will appear in the site's RSS feed, http://www.root-dnssec.org/rss. The design team welcomes your feedback: you can reach the entire team at rootsign@icann.org. On behalf of the root zone DNSSEC deployment team, Matt Larson -- Status Update, December, 2009 This is the first of a series of technical status updates intended to inform a technical audience on the progress of deploying DNSSEC in the root zone of the DNS. RESOURCES Details of the project, including documentation published to date, can be found at http://www.root-dnssec.org/. We'd like to hear from you. If you have feedback for us, please send it to rootsign@icann.org. DOCUMENTATION This project involves the creation of a large volume of documentation, individual components of which will be released as they have completed internal review. The following documents are expected to be released as drafts before the end of December 2009: * Root Zone DNSSEC Deployment Plan * Root Zone Trust Anchor Publication DEPLOYMENT STATUS Several root server operators have started testing a lightweight packet capture tool designed to provide a full record of priming queries received over the period covering DNSSEC deployment in the root zone. We hope this data collection will be in full production on all root servers before the end of December, providing baseline data which will allow the reaction of the system as a whole to deployment events to be observed. On 2009-12-01, the first pre-production KSR exchange between ICANN and VeriSign and the signing of the root zone within VeriSign's production infrastructure commenced. The signing, validation, measurement and monitoring infrastructure will now be subject to full internal testing. PLANNED DEPLOYMENT SCHEDULE 2009-12-01: KSR exchange, root zone signing begins, internal to VeriSign and ICANN; generation of DURZ Week of 2010-01-11: L starts to serve DURZ Week of 2010-02-08: A starts to serve DURZ Week of 2010-03-01: M, I start to serve DURZ Week of 2010-03-22: D, K, E start to serve DURZ Week of 2010-04-12: B, H, C, G, F start to serve DURZ Week of 2010-05-03: J starts to serve DURZ 2010-07-01: Distribution of validatable, production, signed root zone; publication of root zone trust anchor. (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.)