Extensible Delegation testbed

This website hosts information on the domains we have deployed for evaluating and testing the draft-homburg-deleg protocol proposal, as well as draft-wesplaap-deleg.

Zones and name servers

The ideleg.net zone has been provisioned with several IDELEG delegations (using 65280 as the value for the IDELEG RR type), and is served by two IDELEG supporting authoritative name servers (ideleg.net and ideleg.nlnetlabs.nl) and one legacy, non IDELEG supporting, authoritative name server (legacy.ideleg.net) as hidden secondary:

The deleg.org zone has been provisioned with several wesplaap-deleg delegations (using 65432 as the value for the DELEG RR type), and is served by two wesplaap-deleg supporting authoritative name servers (deleg.org and deleg.nlnetlabs.nl) and one legacy, non IDELEG supporting, authoritative name server (legacy.ideleg.net) as hidden secondary:

Querying the zones

These IP addresses can be queried directly to get a taste for the referral responses. If queried with a specially compiled version of drill, the IDELEG RRs will be displayed as intended. See this page for instructions how to compile LDNS and drill with IDELEG support.

For example, to get an IDELEG referral from ideleg.net`:

$ drill/drill -Dord @ www.customer1.ideleg.net.
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 40708
;; flags: qr ; QUERY: 1, ANSWER: 0, AUTHORITY: 5, ADDITIONAL: 4 
;; QUESTION SECTION:
;; www.customer1.ideleg.net.	IN	A

;; ANSWER SECTION:

;; AUTHORITY SECTION:
customer1.ideleg.net.	3600	IN	NS	supporting.ideleg.net.
customer1._deleg.ideleg.net.	3600	IN	IDELEG	10 (
		supporting.ideleg.net.
		ipv4hint=188.245.247.219
		ipv6hint=2a01:4f8:c2c:99d7::1 )
customer1._deleg.ideleg.net.	3600	IN	RRSIG	IDELEG 13 4 3600 (
		20250403135716 20250306135716 60397 ideleg.net. 4UuzgvStSu... )
customer1.ideleg.net.	3600	IN	NSEC	customer2.ideleg.net. NS (
		RRSIG NSEC )
customer1.ideleg.net.	3600	IN	RRSIG	NSEC 13 3 3600 (
		20250403135716 ( 20250306135716 60397 ideleg.net. TeMDps2J... )

;; ADDITIONAL SECTION:
supporting.ideleg.net.	3600	IN	A	188.245.247.219
supporting.ideleg.net.	3600	IN	RRSIG	A 13 3 3600 (
		20250403135716 20250306135716 60397 ideleg.net. RNWvNn/HsO... )
supporting.ideleg.net.	3600	IN	AAAA	2a01:4f8:c2c:99d7::1
supporting.ideleg.net.	3600	IN	RRSIG	AAAA 13 3 3600 (
		20250403135716 20250306135716 60397 ideleg.net. QxDs43bLqX... )

;; Query time: 25 msec
;; EDNS: version 0; flags: do ; udp: 1232
;; SERVER: 
;; WHEN: Thu Mar  6 16:49:55 2025
;; MSG SIZE  rcvd: 670

(This drill output has been edited for readability)

The NSEC3 signed zone

There is also a version with the same kinds of delegations, but NSEC3 signed, in the nsec3.ideleg.net zone, served by an ideleg supporting authoritative name server (supporting.ideleg.net) and also at one legacy, non IDELEG supporting, authoritative name server (legacy.ideleg.net) as hidden secondary:

Zone transfers

All the name servers in the testbed allow anyone to transfer all the zones that are being served by them. For example to transfer the ideleg.net zone:

$ drill -Dord @ ideleg.net AXFR
ideleg.net.	3600	IN	SOA	ideleg.net. wouter.petri.os3.nl. ...
ideleg.net.	3600	IN	RRSIG	SOA 13 2 3600 20250403135716 ...
ideleg.net.	3600	IN	RRSIG	A 13 2 3600 20250403135716 ...
etc.

(The transfer is cut-off and edited for readability)

IDELEG Resolver

A resolver implementing the minimal implementation is provided at resolver.ideleg.net with IP addresses 5.223.55.200 and 2a01:4ff:2f0:2233::1. The addresses are accessable over TCP or TLS, or over UDP with a valid server cookie.

The resolver is running a special version of Unbound. It does not anticipate optimized and extra optimized responses, and it does not (yet) follow AliasMode IDELEG RRs, but it can be used to test our own IDELEG (only) delegations.

Zones at name servers table

footnotes