{"id":2437,"date":"2014-11-19T17:26:15","date_gmt":"2014-11-19T17:26:15","guid":{"rendered":"http:\/\/www.dns.icann.org\/?page_id=2437"},"modified":"2018-04-21T03:12:27","modified_gmt":"2018-04-21T03:12:27","slug":"rssac001-response","status":"publish","type":"page","link":"https:\/\/www.dns.icann.org\/rssac\/rssac001-response\/","title":{"rendered":"RSSAC001 Response"},"content":{"rendered":"

This document<\/h4>\n

The\u00a0Root Server System Advisory Committee<\/a>\u00a0has developed\u00a0RSSAC001<\/a> to document the service expectations for Root Server Operators<\/a>. This page describes how ICANN<\/a> meets the service expectations for the ICANN Managed Root Server service<\/a> it operates. This is a living web page and it is reviewed and updated as and when ICANN reviews and improves the processes and tools it uses to provide the\u00a0ICANN Managed Root Server service and at least twice a year.<\/p>\n

How we meet the RSSAC001 requirements<\/h4>\n

3.1 Infrastructure<\/h4>\n\n\n\n\n
E.3.1-A<\/b><\/td>\nIndividual Root Server Operators are to publish or continue to publish operationally relevant details of their infrastructure, including service-delivery locations, addressing information and routing (e.g., origin autonomous system) information.<\/td>\n<\/tr>\n
E.3.1-B<\/b><\/td>\nIndividual Root Servers will deliver the service in conformance to IETF standards and requirements as described in\u00a0RFC 7220<\/a>\u00a0and any other IETF standards-defined Internet Protocol as deemed appropriate.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN Managed Root Server publishes its service-delivery locations, addressing and AS Number details on the\u00a0Root Server Technical Operation Association website<\/a>, on a dedicated\u00a0ICANN Managed Root Server Internet Number Resources page<\/a>, and in the DNS, as described in\u00a0RFC 7108<\/a>. ICANN Managed Root Server service delivers TCP and UDP DNS service over IPv4 and IPv6. A statistical report of the service provided is published on ICANN\u2019s\u00a0DNS statistics<\/a>\u00a0server.<\/p>\n

3.2 Service Accuracy<\/h4>\n\n\n\n\n\n\n
E.3.2-A<\/b><\/td>\nIndividual Root Servers will adopt or continue to implement the current DNS protocol and associated best practices through appropriate software and infrastructure choices.<\/td>\n<\/tr>\n
E.3.2-B<\/b><\/td>\nIndividual Root Servers will serve accurate and current revisions of the root zone.<\/td>\n<\/tr>\n
E.3.2-C<\/b><\/td>\nIndividual Root Servers will continue to provide \u201cloosely coherent\u201d service across their infrastructure.<\/td>\n<\/tr>\n
E.3.2-D<\/b><\/td>\nAll Root Servers will continue to serve precise, accurate zones as distributed from the Root Zone Maintainer.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN implements the current DNS protocol for ICANN Managed Root Server and uses current operating systems and industry proven DNS software distributed using\u00a0Anycast<\/a> routing to provide a loosely coherent service. ICANN will continue to serve the unmodified version of root zone as obtained from the Root Zone Maintainer. ICANN collects measurements and analyzes them for how long it takes new versions of the root DNS zone to propagate to all ICANN Managed Root Server instances. These measurements are currently available as\u00a0raw data in YAML format<\/a>\u00a0and will be integrated into the Hedgehog reporting service when it is upgraded to the next major version.<\/p>\n

3.3 Service Availability<\/h4>\n\n\n\n\n\n
E.3.3-A<\/b><\/td>\nIndividual Root Servers are to be deployed such that planned maintenance on individual infrastructure elements is possible without any measurable loss of service availability.<\/td>\n<\/tr>\n
E.3.3-B<\/b><\/td>\nInfrastructure used to deploy individual Root Servers is to be significantly redundant, such that unplanned failures in individual components must not cause the corresponding service to become generally unavailable to the Internet.<\/td>\n<\/tr>\n
E.3.3-C<\/b><\/td>\nEach Root Server Operator shall publish documentation that describes the operator\u2019s commitment to service availability through maintenance scheduling and its commitment to the notification of relevant operational events to the Internet community.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

When this document was last updated, ICANN Managed Root Server had instances in over 150 geographical locations<\/a> making use of diverse set of upstream carriers.\u00a0ICANN is confident that sufficient capacity exists in its deployed infrastructure to allow for substantial flash crowds or Denial of Service attacks. The service is significantly redundant, such that unplanned failures in individual components do not make ICANN Managed Root Server service generally unavailable to the Internet. ICANN publishes details of maintenance windows on its DNS website<\/a>. ICANN plans and executes scheduled maintenance<\/a> in a way that avoids disruptions to the ICANN Managed Root Server service.<\/p>\n

3.4 Service Capability<\/h4>\n\n\n\n\n
E.3.4-A<\/b><\/td>\nIndividual Root Server Operators will make all reasonable efforts to ensure that sufficient capacity exists in their deployed infrastructure to allow for substantial flash crowds or denial of service (DoS) attacks.<\/td>\n<\/tr>\n
E.3.4-B<\/b><\/td>\nEach Root Server Operator shall publish documentation on the capacity of their infrastructure, including details of current steady-state load and the maximum estimated capacity available.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN Managed Root Server has instances deployed in all populated continental areas, distributed as described in this map<\/a>. Some locations have multiple ICANN Managed Root Server instances situated in different networks and each ICANN Managed Root Server instance is designed and tested to be able to meet at least 10 times its normal peak load.<\/p>\n

3.5 Operational Security<\/h4>\n\n\n\n\n
E.3.5-A<\/b><\/td>\nIndividual Root Server Operators will adopt or continue to follow best practices with regard to operational security in the operation of their infrastructure.<\/td>\n<\/tr>\n
E.3.5-B<\/b><\/td>\nRoot Server Operators shall publish high-level business continuity plans with respect to their Root Server infrastructure.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN implements industry best practice processes for the operational security of the ICANN Managed Root Server system and has plans to support continuity of operation for the ICANN Managed Root Server service in the event of a disaster. Plans support the continuity of key business and technical operations during an event requiring them and reconstitution plans for the period after that event.<\/p>\n

3.6 Diversity of Implementation<\/h4>\n\n\n\n
E.3.6-A<\/b><\/td>\nEach Root Server Operator shall publish documentation that describes key implementation choices (such as the type of DNS software used) to allow interested members of the Internet community to assess the diversity of implementation choices across the system as a whole.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN uses two well-vetted operating systems (FreeBSD<\/a> and Linux<\/a>) and two industry proven DNS server implementations (Knot<\/a> and NSD<\/a>). Before deploying changes to the ICANN Managed Root Server services, ICANN executes a structured change management process that includes appropriate testing and compliance checks to assure management that changes will not impair\u00a0ICANN Managed Root Server operations. Additionally, ICANN has support contracts with the entities from whom we obtain software to make sure that we have the highest level of support in the event that it is required.<\/p>\n

3.7 Monitoring and Measurement<\/h4>\n\n\n\n\n
E.3.7-A<\/b><\/td>\nEach Root Server Operator will adopt or continue to follow best current practices with respect to operational monitoring of elements within their infrastructure.<\/td>\n<\/tr>\n
E.3.7-B<\/b><\/td>\nEach Root Server Operator will adopt or continue to perform measurements of query traffic received and shall publish statistics based on those measurements.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN has led the development of best current practices for DNS infrastructure monitoring and has deployed systems to monitor elements within its infrastructure. ICANN systematically reviews load, performance, and other metrics to identify scope for future service improvements. These are all published on ICANN\u2019s DNS Statistics<\/a> server.<\/p>\n

3.8 Communication<\/h4>\n\n\n\n\n
E.3.8.1-A<\/b><\/td>\nIndividual Root Server Operators will continue to maintain functional communication channels between each other in order to facilitate coordination and maintain functional working relationships between technical staff.<\/td>\n<\/tr>\n
E.3.8.1-B<\/b><\/td>\nAll communications channels are to be tested regularly.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN participates in regular face-to-face meetings with other Root Server Operators (RSOs). These meetings are supplemented with industry standard discussion forums. ICANN cooperates with the other RSOs to regularly test common communication channels.<\/p>\n\n\n\n
E.3.8.2-A<\/b><\/td>\nIndividual Root Server Operators shall publish administrative and operational contact information to allow users and other interested parties to escalate technical service concerns.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ICANN publishes e-mail and telephone contact information for\u00a0ICANN Managed Root Server operations on its web page.<\/a> The contact e-mail address is published on the Root Server Technical Operation Association<\/a> as well as in the SOA RNAME element for l.root-servers.org<\/em>. The contact information for ICANN\u2019s hub and engagement offices is also available on its main website<\/a>. ICANN\u2019s global presence means that it has offices in most populated time zones.<\/p>\n","protected":false},"excerpt":{"rendered":"

This document <\/p>\n

The\u00a0Root Server System Advisory Committee<\/a>\u00a0has developed\u00a0RSSAC001<\/a> to document the service expectations for Root Server Operators<\/a>. This page describes how ICANN<\/a> meets the service expectations for the ICANN Managed Root Server service<\/a> it operates. This is a living web page and it is reviewed and updated as and when […]<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":2686,"menu_order":1,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/pages\/2437"}],"collection":[{"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/comments?post=2437"}],"version-history":[{"count":65,"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/pages\/2437\/revisions"}],"predecessor-version":[{"id":2998,"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/pages\/2437\/revisions\/2998"}],"up":[{"embeddable":true,"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/pages\/2686"}],"wp:attachment":[{"href":"https:\/\/www.dns.icann.org\/wp-json\/wp\/v2\/media?parent=2437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}