[dns-operations] Root Zone DNSSEC Deployment Technical Status Update

[Joe Abley]

Root Zone DNSSEC Deployment
Technical Status Update 2010-05-17

This is the seventh of a series of technical status updates intended
to inform a technical audience on progress in signing the root zone
of the DNS.


CHANGE IN DEPLOYMENT SCHEDULE

The date for the publication of the root zone trust anchor and the
distribution of a validatable, signed root zone originally planned
for 2010-07-01 has been changed.

This final stage of root DNSSEC deployment is now scheduled to take
place on 2010-07-15.

The schedule change is intended to allow ICANN and VeriSign an
additional two weeks for further analysis of the DURZ rollout, to
finalise testing and best ensure the secure, stable and resilient
implementation of the root DNSSEC production processes and systems.

Prior to 2010-07-15 the U.S. Department of Commerce (DoC) will issue
a public notice announcing the publication of the joint ICANN-VeriSign
testing and evaluation report as well as the intent to proceed with
the final stage of DNSSEC deployment. As part of this notice the
DoC will include a public review and comment period prior to taking
any action.

This change has been reflected in the deployment plan and other
documentation, and updated documents will be published at
<http://www.root-dnssec.org/>.


PLANNED DEPLOYMENT SCHEDULE

Already completed:

 2010-01-27: L starts to serve DURZ

 2010-02-10: A starts to serve DURZ

 2010-03-03: M, I start to serve DURZ

 2010-03-24: D, K, E start to serve DURZ

 2010-04-14: B, H, C, G, F start to serve DURZ

 2010-05-05: J starts to serve DURZ

To come:

 2010-06-16: First Key Signing Key (KSK) Ceremony

 2010-07-15: Distribution of validatable, production, signed root
   zone; publication of root zone trust anchor

 (Please note that this schedule is tentative and subject to change
 based on testing results or other unforeseen factors.)