31:Te06,md`# How do the five RIR manage their nameservers The five Regional Internet Registries, or RIR, namely [AFRINIC](https://afrinic.net), [APNIC](https://apnic.net), [ARIN](https://arin.net), [LACNIC](https://lacnic.net) and [RIPE-NCC](https://ripe.net) are in charge of the allocation and registration of two types of Internet numbers: IP addresses and autonomous systems, each one in its own region. The countries of the world are distributed among the five RIR as follows:

As they are technically-capable entities, worried by the good health and robustness of the Internet, I thought it would be insightful to look at how they manage their nameservers. Moreover, it's a way to understand their relationship, as special non-incorporated, non-profit, non-governmental entities of the Internet. *Note: it's worth highlighting that the RIR do not play any special role inside the domain names world, that the main problems if a zone like ripe.net goes down might be the inavailability of the whois/rdap services, and that the DNS in a given country does not depend on how the RIR manages its own domains. It's unrelated: for example, the country code top-level domains (ccTLD) are under the responsability of every country, relate to the [IANA](https://iana.org) for their registry, and do not have special links with their local RIR.* ## Preliminary: DNS nameservers The nameservers are the authoritative servers that give access to the data of a given zone (we might call the zone the "main domain" for the sake of simplicity). For example, the nameservers of the zone "observablehq.com" are:

;; ANSWER SECTION:
observablehq.com.       86400   IN      NS      cortney.ns.cloudflare.com.
observablehq.com.       86400   IN      NS      hans.ns.cloudflare.com.

It means that we have to send a query to any of these nameservers to know, for example, the IPv6 of a subdomain such as beta.observablehq.com:

$ dig AAAA @hans.ns.cloudflare.com. beta.observablehq.com.

(...)

;; ANSWER SECTION:
beta.observablehq.com.  300     IN      AAAA    2606:4700:30::6818:72af
beta.observablehq.com.  300     IN      AAAA    2606:4700:30::6818:73af

It's a good practice for a zone to rely on various synchronized nameservers, looking for a higher robustness. Especially, if you can afford it, a good idea is to locate the nameservers in different providers networks. In the case of observablehq.com, we may observe that both nameservers are located in the same autonomous system of CloudFlare (AS13335), which means that in the (unlikely) case that this provider went down, the DNS queries related to observablehq.com would never get replies.

$ whois -h whois.cymru.com " -v 173.245.58.87"
AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
13335   | 173.245.58.87    | 173.245.58.0/24     | US | arin     | 2010-12-28 | CLOUDFLARENET - Cloudflare, Inc., US

$ whois -h whois.cymru.com " -v 173.245.59.175"
AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
13335   | 173.245.59.175   | 173.245.59.0/24     | US | arin     | 2010-12-28 | CLOUDFLARENET - Cloudflare, Inc., US

`32:T7eb,md`## Some insights **ARIN:** All its nameservers are located in an autonomous system allocated by ARIN itself (3 are inside ARIN AS, and 1 is hosted by PCH). **APNIC:** it is the only RIR that do not depend on any ARIN-allocated AS (2 of its nameservers are located in its own AS, 1 is hosted by RIPE-NCC, and the last one by NetNod, an European company). **RIPE-NCC:** beyond its self-hosted nameserver and the two hosted by APINC and ARIN, four of its nameservers are managed by two organizations based in ARIN's region (1 by the non-for-profit ISC, and 3 by the Verisign company) **LACNIC:** it has 3 nameservers hosted in its own region (two self-hosted, and one by the Brazilian ccTLD, that is in fact also in charge of the LACNIC technical operations), one by ARIN and by APINC, and none by RIPE-NCC or AFRINIC. Like AFRINIC, maybe due to their "recent" creation (2002 for LACNIC, 2005 for AFRINIC), none of the three main RIR (ARIN, APINC, RIPE-NCC) host nameservers in these regions. **AFRINIC:** it has a nameserver in every other RIR, and it's the only region where none of the other RIR's nameservers are hosted. ## Hmmm, and? ARIN only depends on resources in its service region, and AFRINIC and LACNIC are the only ones depending on AFRINIC and LACNIC resources. APINC is special due to the existence of NIR (National Internet Registries), and seems to only relates to RIPE-NCC. I'm no insider of the RIR circles, so I don't know if these small findings correspond to strong geopolitical definitions, or are only the remainders of history. If you have anecdotes and explainations, please come to discuss at [Twitter](https://twitter.com/mapsinbolivia/status/1054226226473324545) or [Mastodon](https://mamot.fr/@severo_bo/100937399325869488). Final note: I want to thank Stéphane Bortzmeyer for his comments and his [~~encyclopedia~~ blog](http://www.bortzmeyer.org/). Edit: Thanks a lot to [Emile Aben](https://labs.ripe.net/Members/emileaben) for helping me to improve the content and wording. `33:T9d2,nameservers = [ { name: "ns1.afrinic.net.", ipv4: "196.216.2.1", ipv6: "2001:42d0::200:2:1", asn: "33764" }, { name: "ns2.afrinic.net.", ipv4: "196.216.168.10", ipv6: "2001:43f8:120::10", asn: "37177" }, { name: "ns2.apnic.net.", ipv4: "203.119.95.53", ipv6: "2001:ddd::53", asn: "18369" }, { name: "ns4.apnic.net.", ipv4: "202.12.31.53", ipv6: "2001:dd8:12::53", asn: "18366" }, { name: "netnod.apnic.net.", ipv4: "194.146.106.106", ipv6: "2001:67c:1010:27::53", asn: "8674" }, { name: "sec3.apnic.net.", ipv4: "202.12.28.140", ipv6: "2001:dc0:1:0:4777::140", asn: "4777" }, { name: "ns1.arin.net.", ipv4: "199.212.0.108", ipv6: "2001:500:13::108", asn: "393225" }, { name: "ns2.arin.net.", ipv4: "199.71.0.108", ipv6: "2001:500:31::108", asn: "393220" }, { name: "ns3.arin.net.", ipv4: "199.5.26.108", ipv6: "2001:500:a9::108", asn: "394018" }, { name: "u.arin.net.", ipv4: "204.61.216.50", ipv6: "2001:500:14:6050:ad::1", asn: "42" }, { name: "tinnie.arin.net.", ipv4: "199.212.0.53", ipv6: "2001:500:13::c7d4:35", asn: "393225" }, { name: "ns.lacnic.net.", ipv4: "200.3.13.10", ipv6: "2001:13c7:7002:3000::10", asn: "28001" }, { name: "ns2.lacnic.net.", ipv4: "200.3.13.11", ipv6: "2001:13c7:7002:3000::11", asn: "28001" }, { name: "ns3.lacnic.net.", ipv4: "200.3.13.14", ipv6: "2001:13c7:7002:3000::14", asn: "28001" }, { name: "manus.authdns.ripe.net.", ipv4: "193.0.9.7", ipv6: "2001:67c:e0::7", asn: "197000" }, { name: "afrinic.authdns.ripe.net.", ipv4: "193.0.9.8", ipv6: "2001:67c:e0::8", asn: "197000" }, { name: "apnic.authdns.ripe.net.", ipv4: "193.0.9.9", ipv6: "2001:67c:e0::9", asn: "197000" }, { name: "ns2.dns.br.", ipv4: "200.192.232.53", ipv6: "none", asn: "11284" }, { name: "sns-pb.isc.org.", ipv4: "192.5.4.1", ipv6: "2001:500:2e::1", asn: "3557" }, { name: "a1.verisigndns.com.", ipv4: "209.112.113.33", ipv6: "2001:500:7967::2:33", asn: "Per-Node" }, { name: "a2.verisigndns.com.", ipv4: "209.112.114.33", ipv6: "2620:74:19::33", asn: "Per-Node" }, { name: "a3.verisigndns.com.", ipv4: "69.36.145.33", ipv6: "2001:502:cbe4::33", asn: "Per-Node" } ]34:T966,as = [ { name: "33764", holder: "AFRINIC-ZA-JNB-AS, MU", shortHolder: "AFRINIC", type: "AFRINIC", rir: "AFRINIC" }, { name: "37177", holder: "AFRINIC-ANYCAST, MU", shortHolder: "AFRINIC", type: "AFRINIC", rir: "AFRINIC" }, { name: "18366", holder: "APNIC-ANYCAST-AP ANYCAST AS, AU", shortHolder: "APNIC", type: "APNIC", rir: "APNIC" }, { name: "393225", holder: "ARIN-PFS-IAD - ARIN Operations, US", shortHolder: "ARIN", type: "ARIN", rir: "ARIN" }, { name: "28001", holder: "LACNIC - Latin American and Caribbean IP address, UY", shortHolder: "LACNIC", type: "LACNIC", rir: "LACNIC" }, { name: "197000", holder: "RIPE-NCC-AUTHDNS-AS Reseaux IP Europeens Network Coordination Centre (RIPE NCC), NL", shortHolder: "RIPE-NCC", type: "RIPE-NCC", rir: "RIPE-NCC" }, { name: "18369", holder: "APNIC-ANYCAST2 APNIC ANYCAST, AU", shortHolder: "APNIC", type: "APNIC", rir: "APNIC" }, { name: "8674", holder: "NETNOD-IX Netnod Internet Exchange Sverige AB, SE", shortHolder: "NETNOD", type: "ForProfit", rir: "RIPE-NCC" }, { name: "393225", holder: "ARIN-PFS-IAD - ARIN Operations, US", shortHolder: "ARIN", type: "ARIN", rir: "ARIN" }, { name: "393220", holder: "ARIN-PFS-SJC - ARIN Operations, US", shortHolder: "ARIN", type: "ARIN", rir: "ARIN" }, { name: "394018", holder: "ARIN-PFS-SEA - ARIN Operations, US", shortHolder: "ARIN", type: "ARIN", rir: "ARIN" }, { name: "42", holder: "WOODYNET-1 - WoodyNet, US", shortHolder: "PCH", type: "NotForProfit", rir: "ARIN" }, { name: "4777", holder: "APNIC-NSPIXP2-AS Asia Pacific Network Information Centre, JP", shortHolder: "APNIC", type: "APNIC", rir: "APNIC" }, { name: "11284", holder: "Núcleo de Inf. e Coord. do Ponto BR - NIC., BR", type: "NotForProfit", shortHolder: "NIC.BR", rir: "LACNIC" }, { name: "3557", holder: "ISC-AS - Internet Systems Consortium, Inc., US", shortHolder: "ISC", type: "NotForProfit", rir: "ARIN" }, { name: "Per-Node", holder: "*SOME CODE* - VeriSign Global Registry Services, US", shortHolder: "Verisign", type: "ForProfit", rir: "ARIN" } ]35:T871,function createRaws(data) { const height = data.length * nameserverHeight + headerHeight + 2 * margin; const svg = d3.select(DOM.svg(width, height)).classed("raws", true); const g = svg .append("g") .attr("transform", `translate(${margin}, ${margin})`); const header = g .append("g") .attr("id", "header") .selectAll("text") .data(d => [ { col: "nsRir", label: "RIR" }, { col: "ns", label: "has nameservers" }, { col: "asn", label: "in AS" }, { col: "asHolder", label: "held by" }, { col: "asRir", label: "allocated by" } ]) .enter() .append("text") .attr("text-anchor", "middle") .attr("x", d => widths[d.col] / 2) .attr("y", headerHeight / 2) .attr("transform", d => `translate(${colX[d.col]},0)`) .attr("fill-opacity", 0.7) .text(d => d.label); const raw = g .append("g") .attr("id", "raws") .attr("transform", `translate(0,${headerHeight + margin})`) .selectAll("g") .data(d => data) .enter() .append("g") .classed("raw", true) .attr("id", d => d.ns) .attr( "transform", (d, i) => `translate(0,${i * nameserverHeight + margin})` ); const col = function(colName, color) { const b = raw .append("g") .classed(colName, true) .attr("transform", `translate(${colX[colName]},0)`); b.append("rect") .attr("fill", d => typeColorLU[d[color]].fillColor) .attr("stroke", d => typeColorLU[d[color]].fillColor) //.attr("stroke-width", 4) .attr("width", widths[colName]) .attr("height", nameserverHeight - 2 * margin); b.append("text") .attr("text-anchor", "middle") .attr("x", widths[colName] / 2) .attr("y", nameserverHeight / 2) //.attr("fill-opacity", 0.7) .attr("fill", d => typeColorLU[d[color]].color) //.attr("stroke", d => typeColorLU[d[color]].color) .text(d => d[colName]); }; const nsRir = col("nsRir", "nsRir"); const ns = col("ns", "nsRir"); const asn = col("asn", "asRir"); const asHolder = col("asHolder", "asRir"); const asRir = col("asRir", "asRir"); return svg.node(); }36:[] 2f:{"title":"How do the five RIR manage their nameservers","cells":[{"id":0,"value":"$31","pinned":false,"hidden":false,"mode":"ojs"},{"id":68,"value":"md`## The RIR nameservers\n\nLet's review the relationships between these five RIR, focusing on their nameservers configurations.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":348,"value":"md`### Select a RIR`","pinned":false,"hidden":false,"mode":"ojs"},{"id":114,"value":"viewof selectedRir = html``","pinned":false,"hidden":false,"mode":"ojs"},{"id":357,"value":"md`${selectedRir} has configured its ${\n raws.filter(c => c.nsRir === selectedRir).length\n} nameservers as follows:`","pinned":false,"hidden":false,"mode":"ojs"},{"id":340,"value":"createRaws(raws.filter(c => c.nsRir === selectedRir))","pinned":false,"hidden":false,"mode":"ojs"},{"id":457,"value":"{\n if (selectedRir === \"RIPE-NCC\")\n return md`**Note:** In the case of Verisign, there are various ASN associated to the same IP, one for every anycast node, following the [RFC 6382](http://www.bortzmeyer.org/6382.html). We denote this using \"Per-Node\".`;\n else return md``;\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":362,"value":"md`Among all the ${raws.length} RIR's nameservers, ${\n raws.filter(c => c.asRir === selectedRir).length\n} are hosted inside an autonomous system allocated by ${selectedRir}:`","pinned":false,"hidden":false,"mode":"ojs"},{"id":342,"value":"createRaws(raws.filter(c => c.asRir === selectedRir))","pinned":false,"hidden":false,"mode":"ojs"},{"id":379,"value":"$32","pinned":false,"hidden":false,"mode":"ojs"},{"id":34,"value":"md`---\n## Data`","pinned":false,"hidden":false,"mode":"ojs"},{"id":40,"value":"rir = [\n {\n name: \"AFRINIC\",\n ns: [\n \"ns1.afrinic.net.\",\n \"ns2.afrinic.net.\",\n \"ns4.apnic.net.\",\n \"tinnie.arin.net.\",\n \"ns2.lacnic.net.\",\n \"ns3.lacnic.net.\",\n \"afrinic.authdns.ripe.net.\"\n ]\n },\n {\n name: \"APNIC\",\n ns: [\n \"ns2.apnic.net.\",\n \"ns4.apnic.net.\",\n \"apnic.authdns.ripe.net.\",\n \"netnod.apnic.net.\"\n ]\n },\n {\n name: \"ARIN\",\n ns: [\"ns1.arin.net.\", \"ns2.arin.net.\", \"ns3.arin.net.\", \"u.arin.net.\"]\n },\n {\n name: \"LACNIC\",\n ns: [\n \"sec3.apnic.net.\",\n \"tinnie.arin.net.\",\n \"ns.lacnic.net.\",\n \"ns2.lacnic.net.\",\n \"ns2.dns.br.\"\n ]\n },\n {\n name: \"RIPE-NCC\",\n ns: [\n \"ns4.apnic.net.\",\n \"tinnie.arin.net.\",\n \"sns-pb.isc.org.\",\n \"a1.verisigndns.com.\",\n \"a2.verisigndns.com.\",\n \"a3.verisigndns.com.\",\n \"manus.authdns.ripe.net.\"\n ]\n }\n]","pinned":false,"hidden":false,"mode":"ojs"},{"id":47,"value":"$33","pinned":false,"hidden":false,"mode":"ojs"},{"id":55,"value":"$34","pinned":false,"hidden":false,"mode":"ojs"},{"id":203,"value":"typeColor = [\n { name: \"AFRINIC\", color: \"#FFF\", fillColor: \"#000000\" },\n { name: \"APNIC\", color: \"#FFF\", fillColor: \"#AF0000\" },\n {\n name: \"ARIN\",\n color: \"#FFF\",\n fillColor: \"#0000B0\"\n },\n {\n name: \"LACNIC\",\n color: \"#000\",\n fillColor: \"#00B000\"\n },\n {\n name: \"RIPE-NCC\",\n color: \"#000\",\n fillColor: \"#FFCC33\"\n }\n]","pinned":false,"hidden":false,"mode":"ojs"},{"id":260,"value":"raws = rir\n .map(c => [\n ...c.ns.map(n => {\n const ns = nameserversLU[n];\n const as = asLU[ns.asn];\n return {\n nsRir: c.name,\n ns: n,\n ipv4: ns.ipv4,\n ipv6: ns.ipv6,\n asn: ns.asn,\n asHolder: as.holder,\n asType: as.type,\n asHolder: as.shortHolder,\n asRir: as.rir\n };\n })\n ])\n .reduce((a, c) => [...a, ...c], [])","pinned":false,"hidden":false,"mode":"ojs"},{"id":75,"value":"md`---\n## Boring stuff\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":78,"value":"rirLU = createLookup(rir)","pinned":false,"hidden":false,"mode":"ojs"},{"id":86,"value":"nameserversLU = createLookup(nameservers)","pinned":false,"hidden":false,"mode":"ojs"},{"id":88,"value":"asLU = createLookup(as)","pinned":false,"hidden":false,"mode":"ojs"},{"id":219,"value":"typeColorLU = createLookup(typeColor)","pinned":false,"hidden":false,"mode":"ojs"},{"id":81,"value":"createLookup = array =>\n array.reduce((a, c) => {\n a[c.name] = c;\n return a;\n }, {})","pinned":false,"hidden":false,"mode":"ojs"},{"id":370,"value":"$35","pinned":true,"hidden":false,"mode":"ojs"},{"id":96,"value":"d3 = require(\"d3\")","pinned":false,"hidden":false,"mode":"ojs"},{"id":119,"value":"height = 420","pinned":false,"hidden":false,"mode":"ojs"},{"id":306,"value":"headerHeight = 50","pinned":false,"hidden":false,"mode":"ojs"},{"id":126,"value":"nameserverHeight = 50","pinned":false,"hidden":false,"mode":"ojs"},{"id":129,"value":"nameserverWidth = 250","pinned":false,"hidden":false,"mode":"ojs"},{"id":151,"value":"strokeColor = \"#333\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":156,"value":"margin = 5","pinned":false,"hidden":false,"mode":"ojs"},{"id":308,"value":"widths = {\n return { nsRir: 150, ns: 250, asn: 100, asHolder: 150, asRir: 150 };\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":324,"value":"colX = {\n return {\n nsRir: 0,\n ns: widths.nsRir,\n asn: widths.nsRir + widths.ns,\n asHolder: widths.nsRir + widths.ns + widths.asn,\n asRir: widths.nsRir + widths.ns + widths.asHolder + widths.asn\n };\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":440,"value":"css = html``","pinned":false,"hidden":false,"mode":"ojs"},{"id":447,"value":"webFont = html` `","pinned":false,"hidden":false,"mode":"ojs"}],"files":"$W36","stdlib":"1","titling":"auto"}