Member support docs
Filters
How to request reverse delegation in AFRINIC region?
The following steps describe how you can set up reverse delegation for address space that has been allocated or assigned to you. It is assumed you understand how to set up zone files and how to administer a DNS server.
In short: you will have to set up your DNS servers and then tell AFRINIC about them by creating a domain object.
Please contact < This e-mail address is being protected from spambots. You need JavaScript enabled to view it > if you have further questions or suggestions for improving this documentation.
Step1: Modifying the inetnum Object
In order to be able to successfully proceed with Step 4, you should add a "mnt-domains:" attribute to your inetnum object.
The "mnt-domains:" attribute refers to a mntner object that contains information on who is able to create a domain object for the purposes of reverse delegation. In the absence of an "mnt-domains:" attribute the "mnt-lower:" attribute will be used for authorisation.
If you do not have a mntner object, you can create by sending an e-mail with the mantainer object to < This e-mail address is being protected from spambots. You need JavaScript enabled to view it >. You can get the mantainer (and any other template) by querrying the AFRINIC whois database with the "-t" flag, in the fashion below: whois -h whois.AFRINIC.net -t mntner
Details on how to create a mntner object and the authorisation model can be found at:
http://www.afrinic.net/en/library/membership-documents/196-afrinic-database-reference-manual#234
Step 2: Preparing the Reverse Delegation
Because of the nature of DNS, you will need to chop your address block into "chunks" that can be delegated. For an IPv4 address block you will have to create one or multiple /24 or /16 type address blocks mapped into in-addr.arpa domains. For IPv6, you will have to map a /32 address block into the ip6.arpa domain.
Step 3: Configuring Your DNS Servers
For each zone, you have prepared in Step 2 you will have to set up DNS service. Take into account the recommendations in RFC 1912 and RFC 2182. An automated test complying with these recommendations is made against your zones. Problems encountered during the tests are given a number of points. Delegation will be refused if a DNS set up scores more than 20 points. A summary of the problems will be returned. You can perform a test of your setup using any web-based delegation checker which implements most of these tests.
The following recommendations may help ensure a successful setup:
Name Servers:
Ensure you have at least two nameservers that are authoritative for the zone. The resolvable names of these NS servers should be in the NS resource records of the zone. The nameservers should be on different subnets.
SOA resource records:
The SOA resource record should have the same content, both serial number and other data, on all the nameservers. The SOA should contain a valid 'rname' (the contact address). The timing parameters should be reasonable.
Step 4: Submitting the domain Object
Once you've set up your DNS to serve the reverse zones you are ready to request reverse delegation. This request is made through the submission of a domain object. You may use the < This e-mail address is being protected from spambots. You need JavaScript enabled to view it > E-Mail Interface.
You need to create a domain object containing information about the zone you need reverse delegation for. For details on creation and authorisation please refer to the AFRINIC Database Reference Manual. Following are the basic steps:
Obtain a template using whois -t domain and fill in the details.
domain: [mandatory] [single] [primary/look-up key] (1)
descr: [mandatory] [multiple] [ ]
admin-c: [mandatory] [multiple] [inverse key]
tech-c: [mandatory] [multiple] [inverse key]
zone-c: [mandatory] [multiple] [inverse key]
nserver: [optional] [multiple] [inverse key] (2)
sub-dom: [optional] [multiple] [inverse key]
dom-net: [optional] [multiple] [ ]
remarks: [optional] [multiple] [ ]
notify: [optional] [multiple] [inverse key] (3)
mnt-by: [optional] [multiple] [inverse key]
mnt-lower: [optional] [multiple] [inverse key]
refer: [optional] [single] [ ]
changed: [mandatory] [multiple] [ ]
source: [mandatory] [single] [ ]
(1) Here you put the name of your domain.
(2) Enter the names of your nameservers which correspond to the nameservers as used in Step 3; use multiple lines, one nserver: nameservername per line.
(3) For the "mnt-by:" attribute you use the mntner you have prepared in Step 1
Send your domain object to < This e-mail address is being protected from spambots. You need JavaScript enabled to view it >.
Submitting Multiple domain Objects
This applies to all whois database interfaces.
If you want to submit a number of domains that all run on the same nameserver you can use a range notation such as 10-16.168.192.in-addr.arpa for the domain attribute. The database will then automatically create separate domain objects in that range (so seven in total for this particular example).
Step 5: Verifying the Set-up
Once you have submitted the domain object you will receive a notification from the database. You should then be able to query for your object in the database (e.g whois -h whois.AFRINIC.net 4.0.192.in-addr.arpa). After the object appears in the database, it may take between 15 to 60 minutes before the delegation information is available in the DNS. The ultimate test is to query a recursive nameserver that is not authoritative for your zone for a record from your zone.
Please contact < This e-mail address is being protected from spambots. You need JavaScript enabled to view it > if six hours after the appearance of your domain object in the whois database your delegation does not appear. Include the details such as nameserver addresses and the domain object in your request. Also include the full response, including headers, as received from the database.