Freely available data

The DNS Health Report checks the reachability of name servers and .ch and .li domain names. In the event of technical problems, SWITCH informs the operator and makes recommendations for resolving them. As such, the DNS Health Report improves the reliability of the internet in Switzerland.

SWITCH tests all .ch and .li domain names which are signed with DNSSEC. The test checks whether a DNSSEC-signed domain name can be resolved over a validating recursive resolver.

In addition, all name servers which host .ch and .li domain names are tested. The name server addresses are tested for compliance with DNS standards using the following tests:

• TCP: checks if DNS messages over TCP succeed as DNS messages may be delivered using UDP or TCP communications. Also see RFC 7766.
• EDNS: checks EDNS compliance. The server must either comply with the original DNS standard from 1987 (RFC 1035) or the newer EDNS standards from 1999 (RFC 2671 and RFC 6891). Note that supporting EDNS is not a requirement.
• EDNS Cookie: checks EDNS cookie compliance. As in the EDNS test, the server must respond with an EDNS-compliant answer (but supporting EDNS is not a requirement). If the server supports EDNS, the answer must also be EDNS cookie-compliant. Also see RFC 7873.
• Query Type: checks if the server returns a response to a more recent query type, such as CDS. The expected behaviour is a data or NODATA response. A NODATA response means there are records for the requested domain name, but none of them match the query type in the request. A data response would be an actual CDS record for example.

Data

The .ch & .li zone files, containing all delegated domain names, are publicly available for download. Access is restricted for the purposes of combating cybercrime, scientific and social research or for other purposes in the public interest, as e.g., foreseen by Article 10(1)(a)(6) of the Ordinance on Internet Domains.

Access to the zone file data 

The zone files are available by doing a DNS zone transfer (AXFR) from zonedata.switch.ch. using the following TSIG keys:

# filename ch_zonedata.key
key tsig-zonedata-ch-public-21-01 {
    algorithm hmac-sha512;
    secret "stZwEGApYumtXkh73qMLPqfbIDozWKZLkqRvcjKSpRnsor6A6MxixRL6C2HeSVBQNfMW4wer+qjS0ZSfiWiJ3Q==";
};

# filename li_zonedata.key
key tsig-zonedata-li-public-21-01 { 
    algorithm hmac-sha512;
    secret "t8GgeCn+fhPaj+cRy1epox2Vj4hZ45ax6v3rQCkkfIQNg5fsxuU23QM5mzz+BxJ4kgF/jiQyBDBvL+XWPE6oCQ=="; 
};

By downloading the .ch or .li zone file, you agree to use the zone file data only for combating cybercrime, scientific and social research or for other purposes in the public interest. For operational reasons we cannot provide DNS notify messages when a new zone has been published and we ask you to download each zone file not more than once every 24h.

If the service is abused, or if the legal terms of the Ordinance on Internet Domains are violated, we reserve the right to block the IP prefix which is causing the problem. If you have any questions about zone file access please contact SWITCH-CERT.

Downloading the zonefile using the dig utility

As an example, you can download the zone file using the dig command (download from https://www.isc.org/bind/):

dig -k ch_zonedata.key @zonedata.switch.ch +noall +answer +noidnout +onesoa AXFR ch. > ch.txt