On May 20, 2014, at 5:32 PM, jamie <2600hz@gmail.com> wrote:

I have access; my last success was today at 12:27am est

Wait; Do you have a userid or are you trying to log in anonymous? I'm pretty sure this is a closed system..

I have a username/pass. Got it by signing the agreement years ago. I just started getting errors in the past few days: --2014-05-20 17:39:28-- ftp://user:*password*@rz.verisign-grs.com/ => `/tmp/verisign-root-zones/rz.verisign-grs.com/.listing' Resolving rz.verisign-grs.com (rz.verisign-grs.com)... 69.58.178.63 Connecting to rz.verisign-grs.com (rz.verisign-grs.com)|69.58.178.63|:21... connected. Logging in as user ... Login incorrect.

In article <537C1F17.6070307@digital-z.com> you write:

...

Is anyone using this and having failed login for a few days now ? I�ve been mirroring the root zone(s) for years and I just started getting failures in my logs. I emailed an address I found on

On 5/20/14, 4:21 PM, Brandon Applegate wrote: the Verisign website but so far dead air. If anyone knows of a more pointed email POC that would actually have clue about this that would be awesome.

I have been experiencing this problem as well but have not had a chance to look into it. It stopped working some time between May 15th and May 16th. If you find out anything, please let me know!

When I had problems like this a while ago, I found their support people to be quite responsive. Try writing them at tldzone@verisign-grs.com or call the support number on the web site 703-925-6999. If you're not using your password to download the .COM or .NET zones, it is my impression that they will eventually turn off your password because they think you're not using it. R's, John

Pretty annoying (esp. to my databases) that com.zone.gz alone is >2.3 GB ... >.< On Tue, May 27, 2014 at 6:21 PM, Blaine Fleming <groups@digital-z.com> wrote:

On 5/20/14, 11:53 PM, John Levine wrote:

...

In article <537C1F17.6070307@digital-z.com> you write:

...

...

Is anyone using this and having failed login for a few days now ? I�ve been mirroring the root zone(s) for years and I just started getting failures in my logs. I emailed an address I found on

On 5/20/14, 4:21 PM, Brandon Applegate wrote: the Verisign website but so far dead air. If anyone knows of a more pointed email POC that would actually have clue about this that would be awesome.

I have been experiencing this problem as well but have not had a chance to look into it. It stopped working some time between May 15th and May 16th. If you find out anything, please let me know!

When I had problems like this a while ago, I found their support people to be quite responsive. Try writing them at tldzone@verisign-grs.com or call the support number on the web site 703-925-6999.

If you're not using your password to download the .COM or .NET zones, it is my impression that they will eventually turn off your password because they think you're not using it.

R's, John

Just wanted to follow-up on this issue. I was actively using it every day to fetch the .COM and .NET TLD zone files. Sent multiple emails to tldzone@verisign-grs.com with no response. Finally reached out to them via chat and was informed that I needed to execute a new zone file access agreement because they needed updated information for me. New agreement has been submitted so we will see what they say this time. If anyone else is still having problems then you probably need to do the same.

--Blaine

-- jamie rishaw // .com.arpa@j <- reverse it. ish. "...let's consider this world like a family and care about each other..." -Malala Yousafzai

F-root also allows you to axfr root-zone ( dig @f.root-servers.net . axfr ) On May 20, 2014, at 10:32 PM, Doug Barton <dougb@dougbarton.us> wrote:

Signed PGP part On 05/20/2014 02:21 PM, Brandon Applegate wrote: | Is anyone using this and having failed login for a few days now ? I?ve been mirroring the root zone(s) for years and I just started getting failures in my logs. I emailed an address I found on the Verisign website but so far dead air. If anyone knows of a more pointed email POC that would actually have clue about this that would be awesome.

You can slave the root and more directly from ICANN:

http://www.dns.icann.org/services/axfr/

Yeah, I was just suggesting alternatives just incase. I have setup ICANN's axfr servers :) mehmet On May 20, 2014, at 10:50 PM, Doug Barton <dougb@dougbarton.us> wrote:

The last time I asked them, F-root had a "we allow it because it's the right thing to do but we don't like it" policy. Given that ICANN operates an infrastructure purposely built for doing zone transfers, and given that they offer more zones than are on the roots, that's the way I recommend people go. YMMV.

Doug

On 05/20/2014 10:42 PM, Mehmet Akcin wrote:

...

F-root also allows you to axfr root-zone ( dig @f.root-servers.net . axfr )

On May 20, 2014, at 10:32 PM, Doug Barton <dougb@dougbarton.us> wrote:

...

Signed PGP part On 05/20/2014 02:21 PM, Brandon Applegate wrote: | Is anyone using this and having failed login for a few days now ? I?ve been mirroring the root zone(s) for years and I just started getting failures in my logs. I emailed an address I found on the Verisign website but so far dead air. If anyone knows of a more pointed email POC that would actually have clue about this that would be awesome.

You can slave the root and more directly from ICANN:

http://www.dns.icann.org/services/axfr/

On 28 May 2014, at 3:21, Martin Hannigan <hannigan@gmail.com> wrote:

IIRC you can ftp to rs.internic.net (the IANA) and download zones to your hearts content. At least until "transition", I'd think this one is authoritative.

I don't exactly remember where you can pull it from, but I believe they offer it in XML too.

[ Paging Joe Abley ]

*twitch* Half of this thread seems to be talking about the COM/NET zones, not the root zone, but since you asked... <ftp://ftp.internic.net/domain/root.zone> is a service provided by ICANN. <ftp://rs.internic.net/domain/root.zone> is a service provided by Verisign. I think both services are provided under their respective agreements with NTIA (the IANA Functions Contract and the Cooperative Agreement) and hence those URLs can be expected to be somewhat stable. (We live in interesting times, but I don't sense a desire by anybody to change the IANA Functions as part of the management transition currently under discussion). I don't remember the details of how the two sites above are provisioned, but I have a feeling that one is mirrored from the other. Right now, from here, B-Root, C-Root, F-Root, G-Root, and K-Root respond positively to AXFR requests. Sending AXFR requests to instances of root servers is a bit unfriendly, in my opinion, since you're occupying TCP slots on nameservers that arguably would be better used for non-AXFR queries using TCP transport. As Mehmet mentioned, xfr.cjr.dns.icann.org and xfr.lax.dns.icann.org are both dedicated AXFR servers from which the root zone (and other zones served by ICANN's DNS Operations department) can be retrieved. I am not aware of any commitment or requirement to provide those services, but I can't imagine the good people currently in that ICANN department would make them unavailable gratuitously. Lastly, the root zone is signed with NSEC, which means you can walk the NSEC chain and recover the complete zone (see below, thanks Jelte). It occurs to me that this is actually a plausible way to prime your resolver with the full contents of the root zone, as an alternative to slaving the root zone, for people who think this kind of obsessive behaviour is useful. But maybe that's just the malarone talking. I am not aware of anybody providing the contents of the root zone in XML format (and I'm not sure what value that would have to anybody). You may have been remembering the root zone trust anchor distribution format, as seen at <http://data.iana.org/root-anchors/root-anchors.xml>. Joe [walrus:~]% ldns-walk -f . | head -40 . 218447 IN NS i.root-servers.net. . 218447 IN NS h.root-servers.net. . 218447 IN NS m.root-servers.net. . 218447 IN NS l.root-servers.net. . 218447 IN NS j.root-servers.net. . 218447 IN NS e.root-servers.net. . 218447 IN NS d.root-servers.net. . 218447 IN NS b.root-servers.net. . 218447 IN NS f.root-servers.net. . 218447 IN NS k.root-servers.net. . 218447 IN NS g.root-servers.net. . 218447 IN NS c.root-servers.net. . 218447 IN NS a.root-servers.net. . 487056 IN RRSIG NS 8 0 518400 20140603000000 20140526230000 40926 . gsG1xrmc32HKMscG4pEQjgTNg2UOKgXTEZEGjg5lY9X14ADCwNleAwfNXkeAS2cEEJI+Sj8P4gWvKCpgCi7rKSMVPapfelN8huMZHiplWsl0JyaHxkU6WwAa2ciBIayGuY7vsPY2LGudosN4th+5eXnB0gfIJFCuQjhaK3dI5iM= . 86309 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2014052701 1800 900 604800 86400 . 86309 IN RRSIG SOA 8 0 86400 20140603000000 20140526230000 40926 . JZPdfvMZq/+k+ScgnPVp02j6PSYnA5ntR4TGiLHoeeLTWty7OY3ATas48mCxRZja8D/44VKV5COiXb3dNJNRnXtGqI1nuTWwGXmK/J52satKzLilkk/NtHjy1MxT1NQmgnPYFKNP4liE3vr0deTUYCPRkjDwveTCJ/NowB1OyWs= . 45819 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b} . 45819 IN DNSKEY 256 3 8 AwEAAZvJd8ORk+jmZ41QMYbQ1XCpf60l6YJuHtnxn0VSh5a5vqwEjTST3/PZ4xhUFu2YcTfRNWxs9WTiGZl3MY/UlBIvzpLhKgKnf9Vk8sEU3q0nmOGFgE6jTi/cU95ATU/2dTQovMDv9XyWvrmj8KIG2brj6mF4S8GTae6G2GwbMF5v ;{id = 40926 (zsk), size = 1024b} . 45819 IN RRSIG DNSKEY 8 0 172800 20140604235959 20140521000000 19036 . H6fUqoXYqDtYeDOZxBxBEXWsQ1APR6+MMboI74uSgdIkcm5B2zBQOwD+lYid1j3JJ1vhzONwk4PP31o1RG24P0iMqhwwaGXtoWLDeH3FSQxuVUdLA3DxIM0c8NdEzgCW36iH8zzcy/uzFwgPvw6/ksbd6Np+nu/bIw38XhGH61fkidahj1lTAUDIMXi4TM7igJ9bZgUtLViXN8sLeD4G+hrPZbydcksvZpVB8XFCvgKrHHMq3Ha7AO6cl2XDrn6/DodibcVBpMK07kL24NEVFre/jeqjiQWCms6GDuGkqRKaUf8Hdwl12rsmptIuDa70qNh3Pz+pbjNXXGuWlkyYdA== . 10709 IN NSEC ac. NS SOA RRSIG NSEC DNSKEY . 10709 IN RRSIG NSEC 8 0 86400 20140603000000 20140526230000 40926 . DfkP4WFtbeus1jPx7viKJ9GAPlRvgJfgJzvRTA8zoAbteZyOD3zDOs64YcBoDt/0kQxpfa5RYKbEHTzquV8FiPyAZ91a5Syh0ml5tOoWIgxArLKAYpdW5sTKSOwYsrvZ3zb8Bwt9DTjrv7z7fPy8byVKyAJcN1vGB7odFOagHro= ac. 172708 IN NS b.nic.ac. ac. 172708 IN NS b.ns13.net. ac. 172708 IN NS a.ns13.net. ac. 172708 IN NS ns1.communitydns.net. ac. 172708 IN NS a.nic.ac. ac. 172708 IN NS b.nic.io. ac. 172708 IN NS ns3.icb.co.uk. ac. 86400 IN RRSIG NS 8 1 86400 20140630163458 20140526153043 15896 ac. VZHivI5edUvEwYka2WNX7/A0ud5u+vGObZ54Aw/RpJuCMv3Q4VrLP3HFVmQCWdALxldamnYnUPiLnnhjWL/xaYrKHbvmIViws5nsDLMWy5jHzLxCBUtm4BudRq7sLcWNKwZi08eP9Gq2G4/aOhnGmhjQs6its+slrAhbXDc/n7I= ac. 8622 IN DS 23014 8 2 9f135b4b4c69c92383b997632e821e3c8ab9699658674cc96fde5405acb68b65 ac. 8622 IN RRSIG DS 8 1 86400 20140603000000 20140526230000 40926 . EsZz1A8kWMAzsg9+mrsLfdH78qOFd4HTKErJT7LuL20uOId6SvWT7br8hyK6XP7w3USSXsH4miYhH+oh8spxEH11KMgTOT0Lm2LE7W16asO0cHfN4SantZ8aeubDlDWbYj+DioqUuDUgqbMqeOxV3E42ROo0mINDOo+QxWj7GuU= ac. 10709 IN NSEC academy. NS DS RRSIG NSEC ac. 10709 IN RRSIG NSEC 8 1 86400 20140603000000 20140526230000 40926 . TtCsZLK3YtFXiRHi4ZGKreWbrf1+97tA973i64k7RTT2GujHPv3MhpDP+IWlqcwvH1XcX5CBkleDbIBVGzxgenzewl31wF+ufw9DCbPlbli38y2S7Z5QK50Q+Sa3cJvFm0CagkM5s0owZxyZKdAdZbohWAy74ohb5gf+rjWOrR8= academy. 172709 IN NS demand.beta.aridns.net.au. academy. 172709 IN NS demand.alpha.aridns.net.au. academy. 172709 IN NS demand.gamma.aridns.net.au. academy. 172709 IN NS demand.delta.aridns.net.au. academy. 86400 IN RRSIG NS 8 1 86400 20140609042557 20140510040258 9414 academy. dBGJK1r2Ay31FYTLFEfjXTdgQTQVOWlSsKWHu9hoC7fOwySFOhRtBh/Me/dpuHz2TqtCQ4pKBpu+CsAbWWrdrJz727CCRdmmhfClI+c70eO7oNoE5/zwchLOqmyLERaoInYi2Ra3PQYQpZc23PYy15jr8hblvKOx7cSW/RR4fZIaZFbVB3rGJtiDxSoTpCTA4evlUvcLVTIGfD4MJBLbXg== academy. 86309 IN DS 47032 8 2 e2a2dae3cc55e8ce27e9aea6217bda4a835bf2270c40749ad278e9a9b4aba132 academy. 86309 IN RRSIG DS 8 1 86400 20140603000000 20140526230000 40926 . AwaaZrLUSAiSaKw0NMkXRtvsUjH0rajpHGHwTaZ4ROf+4DYD3vpXqYIT7DQ6s/LMmZSPEhjzpH7OS8/gpomZZVyadfjQQ3/aLDej3vwImI5ZYHNr8Y6dJyFZ81ihyk+Xxu7l3cmt5mPlGIAQ87CYh8bz7tF6raor8hkqk0bNNls= [walrus:~]%