From robertocarna36 at gmail.com  Wed Apr 18 16:31:48 2018
From: robertocarna36 at gmail.com (Roberto Carna)
Date: Wed, 18 Apr 2018 13:31:48 -0300
Subject: [as112-ops] DNS Blackhole servers requests question
Message-ID: <CAG2Qp6tcWBH9JjJmhUvs0=BzgBCsHeT3WUNRhvXhjf4KOn5dVA@mail.gmail.com>

Dear, I want to use and test the DNS BLACKHOLE servers for RFC 1918
network addresses:

BLACKHOLE-1.IANA.ORG (192.175.48.6)
BLACKHOLE-2.IANA.ORG (192.175.48.42)

But every time I query these servers, I can?t reach them.

Are they running? Or maybe they don?t work for every people from Internet?

In all my attempts to query these blackhole servers, just one time I
get a NXDOMAIN valid response.

Always I can?t reach them:

root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.6
;; connection timed out; no servers could be reached

root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.42
;; connection timed out; no servers could be reached

Please can you help me?

I know I can create local DNS zones for RFC 1918 networks in my BIND
server, but I want to understand the use of DNS Blackhole servers.

Thanks in advance, regards!!!


From ben+as112 at benjojo.co.uk  Wed Apr 18 17:31:28 2018
From: ben+as112 at benjojo.co.uk (Ben Cox)
Date: Wed, 18 Apr 2018 13:31:28 -0400
Subject: [as112-ops] DNS Blackhole servers requests question
In-Reply-To: <CAG2Qp6tcWBH9JjJmhUvs0=BzgBCsHeT3WUNRhvXhjf4KOn5dVA@mail.gmail.com>
References: <CAG2Qp6tcWBH9JjJmhUvs0=BzgBCsHeT3WUNRhvXhjf4KOn5dVA@mail.gmail.com>
Message-ID: <CAL=9YSWfQZ+iu1LXeoHBoZquNxkPM_UsFHVQWJhROXmkJgvYJA@mail.gmail.com>

Are you able to run a traceroute?

They respond to me. There is possibly a anycast server not responding that
you are hitting.

On Wed, Apr 18, 2018 at 12:31 PM, Roberto Carna <robertocarna36 at gmail.com>
wrote:

> Dear, I want to use and test the DNS BLACKHOLE servers for RFC 1918
> network addresses:
>
> BLACKHOLE-1.IANA.ORG (192.175.48.6)
> BLACKHOLE-2.IANA.ORG (192.175.48.42)
>
> But every time I query these servers, I can?t reach them.
>
> Are they running? Or maybe they don?t work for every people from Internet?
>
> In all my attempts to query these blackhole servers, just one time I
> get a NXDOMAIN valid response.
>
> Always I can?t reach them:
>
> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.6
> ;; connection timed out; no servers could be reached
>
> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.42
> ;; connection timed out; no servers could be reached
>
> Please can you help me?
>
> I know I can create local DNS zones for RFC 1918 networks in my BIND
> server, but I want to understand the use of DNS Blackhole servers.
>
> Thanks in advance, regards!!!
>
> _______________________________________________
> as112-ops mailing list
> as112-ops at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20180418/1f880fa7/attachment.html>

From gtaylor at tnetconsulting.net  Wed Apr 18 18:12:09 2018
From: gtaylor at tnetconsulting.net (Grant Taylor)
Date: Wed, 18 Apr 2018 12:12:09 -0600
Subject: [as112-ops] DNS Blackhole servers requests question
In-Reply-To: <CAG2Qp6tcWBH9JjJmhUvs0=BzgBCsHeT3WUNRhvXhjf4KOn5dVA@mail.gmail.com>
References: <CAG2Qp6tcWBH9JjJmhUvs0=BzgBCsHeT3WUNRhvXhjf4KOn5dVA@mail.gmail.com>
Message-ID: <3c4c077b-dbbc-c0d5-7053-a1e368c1ad27@spamtrap.tnetconsulting.net>

On 04/18/2018 10:31 AM, Roberto Carna wrote:
> Dear, I want to use and test the DNS BLACKHOLE servers for RFC 1918 
> network addresses:
> 
> BLACKHOLE-1.IANA.ORG (192.175.48.6)
> BLACKHOLE-2.IANA.ORG (192.175.48.42)
> 
> But every time I query these servers, I can?t reach them.

I'm somewhat surprised that you can't reach them.

> Are they running? Or maybe they don?t work for every people from 
> Internet?

It's my understanding that the two blackhole servers are anycasted and 
should be running all over the place.  However that does not mean that 
you can actually get to or are allowed to communicate with them.

> In all my attempts to query these blackhole servers, just one time I 
> get a NXDOMAIN valid response.

That sounds like you had one query go to a different anycast DNS server 
that did not have the domain names configured.  Or it at least responded 
incorrectly.

> Always I can?t reach them:
> 
> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.6
> ;; connection timed out; no servers could be reached
> 
> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.42
> ;; connection timed out; no servers could be reached
> 
> Please can you help me?

I'll share my understanding of how the AS 112 DNS servers are supposed 
to operate.  Hopefully that will help you.

> I know I can create local DNS zones for RFC 1918 networks in my BIND 
> server,

I think you will end up doing that (in a manner of speaking) if you 
configure your DNS server to function as an AS 112 DNS server.

> but I want to understand the use of DNS Blackhole servers.

Fair enough.

My understanding is that the blackhole DNS servers are meant to be run 
on widely anycasted IPs.  Further, the parent domain (192.in-addr.arpa.) 
delegates the zone to the blachole DNS servers.

The idea being that if multiple people run local instances of the 
blachole DNS servers, the traffic to said DNS servers will functionally 
be spread across the internet to the blackhole DNS server that is 
closest to the clients issuing queries to the delegated domains.

When I run the following command at home, the query ends up being 
hitting my persronal / private DNS server that is functioning as an AS 
112 blackhole DNS server.

dig +trace -x 192.168.1.1

1)  The above command causes dig to query the root DNS servers
2)  which delegates to servers authoritative for the in-addr.arpa. zone,
3)  which delegates to servers authoritative for the 192.in-addr.arpa. zone,
4)  which delegates to servers authoritative for the 
168.192.in-addr.arpa. zone.

Seeing as how my personal / private DNS server is functioning as an AS 
112 blachole DNS server, it has the IP addresses for blachole-1.iana.org 
and blachole-2.iana.org bound and is answering queries.

So, when the DNS servers authoritative for 192.in-adr.arpa. delegate to 
blachole-1.iana.org or blachole-2.iana.org, queriese for the 
168.192.in-addr.arpa. zone end up going to my local DNS server at the 
well known / established anycast IP addresses of 192.175.48.6 and 
192.175.48.42 (respectively).

Thus, queries for IP addresses in AS 112 zones (read: RFC 1918 address 
ranges) hit my local DNS server and do not transit the internet.

Ultimately my AS 112 DNS server is helping reduce the load on the 
internet by answering the queries locally.

> Thanks in advance, regards!!!

I hope that helps.  Feel free to ask follow up questions, or correct me 
if I'm wrong about something.

Aside:  It's also possible to slave the root DNS zone, there by helping 
reduce some additional load -and- (I believe) speed up some queries 
because the data is local.



-- 
Grant. . . .
unix || die

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3982 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20180418/5df63d37/attachment.bin>

From robertocarna36 at gmail.com  Fri Apr 20 12:27:42 2018
From: robertocarna36 at gmail.com (Roberto Carna)
Date: Fri, 20 Apr 2018 09:27:42 -0300
Subject: [as112-ops] DNS Blackhole servers requests question
In-Reply-To: <681EECB4-9E55-4027-97B7-B543F709C35A@opteamax.de>
References: <CAG2Qp6tcWBH9JjJmhUvs0=BzgBCsHeT3WUNRhvXhjf4KOn5dVA@mail.gmail.com>
 <681EECB4-9E55-4027-97B7-B543F709C35A@opteamax.de>
Message-ID: <CAG2Qp6vGzRcnqRh55r1h_e+-s8gfF9Mnfnsh9EgTdp8S1qMYhA@mail.gmail.com>

Dear, I've executed a traceroute and I see that the last hop is a node
from Hurricane Electric Internet Service, which is part of AS112
operators.

Do you know if Hurricane Electric have had any problem with its
blackhole service during last days ?

Thanks again, regards!!!

2018-04-18 16:36 GMT-03:00 Jens Ott - Opteamax GmbH <jo at opteamax.de>:
> Hi,
>
> as said by others, the blackhole servers are anycasted. Maybe you want to
> share a traceroute of "mtr --report" to the nodes which might help finding
> the operator maintaining the nodes you hit.
>
> Best regards
> Jens
>
> Am 18. April 2018 18:31:48 MESZ schrieb Roberto Carna
> <robertocarna36 at gmail.com>:
>>
>> Dear, I want to use and test the DNS BLACKHOLE servers for RFC 1918
>> network addresses:
>>
>> BLACKHOLE-1.IANA.ORG (192.175.48.6)
>> BLACKHOLE-2.IANA.ORG (192.175.48.42)
>>
>> But every time I query these servers, I can?t reach them.
>>
>> Are they running? Or maybe they don?t work for every people from Internet?
>>
>> In all my attempts to query these blackhole servers, just one time I
>> get a NXDOMAIN valid response.
>>
>> Always I can?t reach them:
>>
>> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.6
>> ;; connection timed out; no servers could be reached
>>
>> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.42
>> ;; connection timed out; no servers could be reached
>>
>> Please can you help me?
>>
>> I know I can create local DNS zones for RFC 1918 networks in my BIND
>> server, but I want to understand the use of DNS Blackhole servers.
>>
>> Thanks in advance, regards!!!
>>
>> ________________________________
>>
>> as112-ops mailing list
>> as112-ops at lists.dns-oarc.net
>> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>>
>> !DSPAM:1229,5ad779e520681192916468!
>>
>
> --
> Jens Ott
> Gesch?ftsf?hrer
>
> Opteamax GmbH
>
> Simrockstr. 4b
> 53619 Rheinbreitbach
>
> Tel.: +49 2224 969500
> Fax: +49 2224 97691059
> Email: jo at opteamax.de
>
> HRB: 23144, Amtsgericht Montabaur
> Gesch?ftsf?hrer: Jens Ott
> Umsatzsteuer-ID.: DE264133989


