<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>Just joined the list and I've searched back 12 month and see no
similar topic.</p>
<p>I've been DNSSEC Signing my domains for several years - probably
as I was teaching others how to do that.<br>
This includes my Reverse DNS too.<br>
I am in the AFRINIC Region.<br>
I have some Legacy IPv4 address space - originally from ARIN.<br>
192.96.24.0 - 192.96.24.31 (and others)<br>
</p>
<p>About six months ago - I started the process of changing
everything from Algorithm 8 (RSA/SHA-256) to Algorithm 13 (ECDSA
Curve P-256 with SHA-256). From my point of view, everything has
been working completely automatically - except for the Reverse DNS
- where I have to go to "my.afrinic.net" and manually update DS
Records (there is no automation for this at AFRINIC).</p>
<p>Please look at 24.96.192.in-addr.arpa. and
25.96.192.in-addr.arpa.<br>
24 is no longer signed (because of this problem), 25 is signed
(algo 13)<br>
</p>
<p>The Parent for the legacy block 24.96.192.in-addr.arpa is
192.in-addr.arpa - who's nameservers include z.arin.net.</p>
<p>In that zone file - there is a DS record for
25.96.192.in-addr.arpa:-</p>
<p>25.96.192.in-addr.arpa. 86289 IN DS 36223 13 2
5DA9B9AC1C9D9C72434BEC68E9C5CF36A10FA480E6551CC9F2538745 4932E14E<br>
(This is the correct DS record - you can ask for the CDS for this
from control.vweb.co.za)<br>
</p>
<p>...but asking a DNSSEC aware recursive resolver
gives....SERVFAIL.</p>
<p> dig @1.1.1.1 25.96.192.in-addr.arpa ns<br>
<br>
; <<>> DiG 9.14.8 <<>> @1.1.1.1
25.96.192.in-addr.arpa ns<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id:
39329<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL:
1<br>
...</p>
<p>This worked perfectly with Algorithm 8, before I moved to
Algorithm 13.</p>
<p><b>When will the DNS system at ARIN support Algorithm 13?</b></p>
<p>My IPv6 Reverse DNS signed with DNSSEC works perfectly with
Algorithm 13.<br>
</p>
<p>$ dig -x 2001:42a0::1 @1.1.1.1 +dnssec +multiline<br>
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0,
ADDITIONAL: 1<br>
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.2.4.1.0.0.2.ip6.arpa.
7200 IN PTR control.vweb.co.za.<br>
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.2.4.1.0.0.2.ip6.arpa.
7200 IN RRSIG PTR 13 34 7200 (...<br>
</p>
<p><br>
</p>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<p>Mark James ELKINS - Posix Systems - (South) Africa<br>
<a class="moz-txt-link-abbreviated" href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:+27826010496">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a
href="https://ftth.posix.co.za">https://ftth.posix.co.za</a><br>
<br>
<img moz-do-not-send="false"
src="cid:part3.A3FD6205.A3F80F95@posix.co.za" alt="Posix
Systems" width="250" height="165"><img moz-do-not-send="false"
src="cid:part4.1531297A.6234CFCA@posix.co.za" alt="VCARD for
MJ Elkins" title="VCARD, Scan me please!" width="164"
height="164"><br>
</p>
</div>
</body>
</html>