<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi ,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">About a week or so ago I got a notification email from Infoblox that they do not support RFC5011. They are referring to a Knowledge base article on their site on how to enable the new key in the products, see below. I know that Infoblox
is a common product in the marketplace. It worries me that some of their customers will not get/read/take action on the notification resulting in that resolution will start to fail on Oct 11<sup>th</sup>. Especially the US Govt. sector worries me as they
have various mandates to implement DNSSEC but (based on my own experience and some speculation) sometimes lacks the skills and long term vision to maintain it properly. Is there any additional outreach or action that can be taken to make sure that the KSK
rollover don’t break Infoblox customers? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#333333">Dear Customer,<br>
<br>
In 2016 the Internet Corporation for Assigned Names and Numbers (ICANN) <a href="http://app.e.infoblox.com/e/er?s=953&lid=5086&elqTrackId=EDFAFB40787A8022D6B38CB9D62FEDEE&elq=f359f85170894eb28fe78ec6c1d4d824&elqaid=13120&elqat=1">
announced</a> a two-year execution plan for rolling the Root Zone Domain Name System Security Extensions (DNSSEC) KSK key.<br>
<br>
According to that plan, on October 11, 2017, a new KSK key will be used to sign the Root Zone DNSKEY resource record set (the actual rollover event).
<b>This requires an action on your part.</b><br>
<br>
Rolling the KSK key means generating a new cryptographic public and private key pair and distributing the new public component to parties who operate validating resolvers, including: Internet Service Providers; enterprise network administrators and other Domain
Name System (DNS) resolver operators; DNS resolver software developers; system integrators; and hardware and software distributors who install or ship the root's "trust anchor." The KSK is used to cryptographically sign the Zone Signing Key (ZSK), which is
used by the Root Zone Maintainer to DNSSEC-sign the root zone of the Internet's DNS.<br>
<br>
Maintaining an up-to-date KSK is essential to ensuring DNSSEC-validating DNS resolvers continue to function following the rollover. Failure to have the current root zone KSK will mean that DNSSEC-validating DNS resolvers will be unable to resolve any DNS queries
which would lead to an outage. <br>
<br>
Currently Infoblox NIOS does not support “Automated Updates of DNS Security (DNSSEC) Trust Anchors” feature (RFC-5011) that automatically updates the key. Therefore, the new Root Zone KSK key must be manually updated on all DNSSEC validation enabled servers.
<br>
<br>
<b>Please refer to Infoblox Support KB # <a href="https://support.infoblox.com/app/utils/login_form/redirect/answers%252Fdetail%252Fa_id%252F5672%252Fkw%252FICANN?elqTrackId=67C1F69D23B24D2B3F64EE38F0F79CE0&elq=f359f85170894eb28fe78ec6c1d4d824&elqaid=13120&elqat=1&elqCampaignId=10969" title="null">
5729</a> for the ICANN plan details and steps to update the new Root Zone KSK key to prevent potential DNS resolution issues.</b><br>
<br>
Sincerely,<br>
<br>
Infoblox Support Team</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>