Your IP address is 54.242.231.109

AFRINIC DNSSEC Service

Deployment Plan

Once the testing phase is completed, AFRINIC will integrate the Signer into the provisioning system in 3 phases. In this phase, the provisioning system continues to work as it is. When new zones are generated, copies of the distributed unsigned zones are passed to the signer to produce a signed zone.

 

Deployment Test Phases

  • Install the tools (Opendnssec, NSD, BIND, DSC, etc.)
  • Generate keys for the zones - KSK RSA 2048 / ZSK RSA 1024
  • Get Unsigned zone into OpenDNSSEC and sign
  • Publish the signed zones under the local DNS servers
  • Query and analyse response sizes over UDP and TCP
  • Validation using keys as trusted keys
  • Test Keys rollover: ZSK and KSK
  • Scheduled key rollovers and emergency key rollover
  • Conclusions and lessons learnt

 

Phase 1Published Unsigned Zones

The signed zone is checked and loaded on a public DNS server. All tests are conducted around the public DNS server. AFRINIC will evaluate here the operation of the signer and the updated provisioning system. 

  • The new provisioning system: consistent signed zones generation
  • Consistency check for zones content: non DNSSEC queries on both (unsigned and signed)
  • DNSSEC queries to the signed zones
  • Conclusions and lessons learnt

 


 

Phase 2

Publish Signed Zones

With a successful previous stage, the next step will be to start publishing signed zones instead of unsigned zones. In this phase, the Reverse DNS provisioning system will start publishing signed zones with adequate notification and a rollback plan. Only zones produced by the signer are distributed to the NS servers.

Test

  • Zones transfer master/slaves consistency
  • Non dnssec queries on all NS
  • DNSsec queries on all NS
  • Conclusions and lessons learnt

Rollback Plan

Rollback from the phase where AfriNIC is publishing signed zones without DS in parent zones is as follows:

  1. A maintenance window for the rollback is open.
  2. Notice of the impending maintenance, with a technical description of the change, will be sent to the community.
  3. During the maintenance window, AfriNIC will begin to serve an unsigned zones, stripped of all DNSSEC information. SOA serial increases in order to trigger the distribution of the unsigned zone.
  4. A detailed technical report of the circumstances leading to the rollback, and the execution of the rollback itself are sent to the community.

 

Phase 3

DS publication in parent zones

With the publishing of signed zones completed, AFRINIC RDNS zones are not yet DNSSEC secured. DS records of KSKs have to be published in the parent zones. DS records will be generated and sent to IANA through their RDNS management system. 

The provisioning will be configured to process DS records for sub-domains. The signer and the zones publication are not modified. With a full DNSSEC system tested and launched with measures in place to operate as per the DPS, the project will move to the normal AFRINIC operations. Monitoring and performance measurement will be constant activities.

Tests

  • Query for the DS record on all ip6.arpa and in-addr.arpa servers
  • DNSSEC validation of signed RRs in AFRINIC signed zones with root key as trusted key
  • Conclusions and lessons learnt

Rollback Plan

Rollback from the phase where AfriNIC is publishing signed zones with DS in parent zones is as follows:

  1. A maintenance window for the rollback is open.
  2. Notice of the circumstances and the remedial action intended, with technical detail, will be sent to the community.
  3. AfriNIC will execute an emergency KSK rollover to remove the DS records from parent zones.
  4. Public communication with the community will continue, with the goal of ensuring that news of the situation and the actions being taken are communicated to as wide a public audience as possible.
  5. Following the appropriate publication delay, as specified by the DPS, AfriNIC will execute a transition to an unsigned zones as described in the phase where AfriNIC is publishing signed zones without DS in parent zones.

 


 

Members DS records publication

Tests

  • DS processing and DS RRs signing
  • Chain of trust validation from root to child zone (with DS records published)
  • Conclusions and lessons learnt

 

(Page 2 of 5)