<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<span class="Apple-style-span" style="border-collapse: separate;
color: rgb(0, 0, 0); font-family: Times; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing: normal;
line-height: normal; orphans: 2; text-indent: 0px; text-transform:
none; white-space: normal; widows: 2; word-spacing: 0px;
font-size: medium;"><span class="Apple-style-span"
style="border-collapse: collapse; color: rgb(51, 51, 51);
font-family: arial,FreeSans,Helvetica,sans-serif; font-size:
14px; line-height: 20px;">
<p style="margin: 0px 0px 1em; padding: 0px;">ARIN is proud to
announce that on 27 April, we will place Delegation Signer
(DS) records into in-addr.arpa and ip6.arpa. At that point,
DNSSEC validation will occur from the root down if you
properly set up your DNSSEC-aware recursive resolver. ARIN's
DNSSEC initiative will be considered complete once these DS
records are in place.</p>
<p style="margin: 0px 0px 1em; padding: 0px;">For most
DNSSEC-aware recursive resolver operators, nothing needs to be
done for this change to be in effect as long as you have
configured your DNSSEC-aware server to use ICANN’s Key Signing
Key (KSK) for the root zone. For those who have used ARIN’s
trust anchors (in place since 2 July 2009) to take advantage
of DNSSEC before the root or in-addr.arpa was signed, you MUST
remove them within the next two months of this date.
Otherwise, DNSSEC validation may fail due to a KSK change.
Additionally, ARIN will also coordinate with Internet Systems
Consortium, Inc. (ISC) to remove ARIN's delegations from their
DNSSEC Lookaside Validation (DLV) registry after setting up
these records in in-addr.arpa and ip6.arpa.</p>
<p style="margin: 0px 0px 1em; padding: 0px;">The DS records
will remain the same as the current trust anchor for the next
two months. After that time, ARIN will begin rolling a KSK for
its authoritative zones, which will cause any DNSSEC-enabled
resolvers that use ARIN’s statically configured trust anchors
to fail.<br>
</p>
<p style="margin: 0px 0px 1em; padding: 0px;">As always, ARIN
welcomes community feedback regarding DNSSEC. Subscribe and
participate on the <a class="moz-txt-link-abbreviated" href="mailto:arin-tech-discuss@arin.net">arin-tech-discuss@arin.net</a> mailing list if
you have questions or comments.</p>
<p style="margin: 0px 0px 1em; padding: 0px;">Regards,</p>
<p style="margin: 0px 0px 1em; padding: 0px;">Mark Kosters<br>
Chief Technical Officer<span class="Apple-converted-space"> </span><br>
American Registry for Internet Numbers (ARIN)</p>
</span></span>
</body>
</html>