Search RPD Archives
[rpd] [Last Call] Draft Policy Proposal - Hierarchical Names for New AS-SETs (AFPUB-2026-ASN-001-DRAFT02)
Sylvain BAYA
baya.sylvain at cmnog.cm
Sun Jul 19 15:16:43 UTC 2026
Le 16/07/2026 à 23:09, Hytham El-Nakhal a écrit :
> Dear PDWG,
>
>
> The Policy Development Working Group (PDWG) Chairs have initiated a Last Call for this proposal, following rough consensus at the AFRINIC-37 Public Policy Meeting held in hybrid format in Nairobi, Kenya on 24 June 2026.
>
> * Proposal Name: Hierarchical Names for New AS-SETs
>
> * Proposal ID: AFPUB-2026-ASN-001-DRAFT02
>
> * Proposal URL:https://www.afrinic.net/afpub-2026-asn-001-draft02.html
>
> Last Call closes on: July 31, 2026, at 23:59 UTC.
>
Dear PDWG Co-chairs,
Many thanks for your much appreciated work!
<tl;dr>
This long email contains four things:
* the reason why i support this DPP;
* A presentation from Tashi Phuntsho, during
iWeek2026 regarding:
Securing Internet Routing - The Puzzle Pieces | iWeek
<https://iweek.org.za/sessions/securing-internet-routing-puzzle-pieces>
Why Internet Routing Is Broken — And How We're Fixing It | BGP Security
Explained - YouTube <https://www.youtube.com/watch?v=6LJU2IWNAHw>
* Actual AS-SET syntax;
* Actual AS-SET detailed syntax
{as that is where the proposed (by this DPP)
change of behavior would firstly appear...}
</tl;dr>
...i would like to thanks the author of this DPP;
as he wisely ended the References section with
the following words:
"AFRINIC is the only major RIR which has not currently implemented this
feature, or is not currently working towards implementing it. If/when
AFRINIC implements it, AS-SET squatting in the 5 major RIRs will no
longer be possible and AS-SETs will be have become more secure globally."
...which is the exact reason why i want this DPP
to be (i) adopted; (ii) ratified; and (iii) implemented
the soonest.
> Please note the staff observation regarding implementation constraints: due to the current prioritization of the MyAFRINIC v2 deployment, physical database implementation of this policy will be scheduled once the MyAFRINIC v2 deployment is concluded.
>
...this is ok to me! i have also noted the following
from the Staff IAr (Impact Assessment report)
of this DPP (AFPUB-2026-ASN-001-DRAFT02):
"*6. Staff Observations*
We note the exception highlighted in 7.8.6 that could allow restoration
of deleted objects. However, we feel that such recalls may introduce
operational loopholes, and it may also reduce the effective objective
for the policy in general. In the instance that an unintended deletion
happens, the affected members may take the opportunity to create aligned
AS-SETs."
> As always, we kindly request that all participants adhere to the AFRINIC Code of Conduct<https://www.afrinic.net/code> to maintain a respectful and professional environment on the mailing list.
>
Thanks for recalling it; as the risk is always there!
By the way, having noted that there seems to
be some recurring misbeliefs regarding what
an AS-SET class of IRR/Whois objects is; please
allow me to share three things, which could be
helpful to see where the proposed change is
intended to start to be seen:
(i) A presentation from Tashi Phuntsho, during
iWeek2026 regarding:
Securing Internet Routing - The Puzzle Pieces | iWeek
<https://iweek.org.za/sessions/securing-internet-routing-puzzle-pieces>
Why Internet Routing Is Broken — And How We're Fixing It | BGP Security
Explained - YouTube <https://www.youtube.com/watch?v=6LJU2IWNAHw>
(ii) Actual AS-SET syntax;
/cacty at shalom:~$ TZ='UTC' date --rfc-3339='seconds' && whois -h
whois.afrinic.net -t AS-SET # from AS15964 at Bhome
2026-07-19 14:43:17+00:00
% This is the AfriNIC Whois server.
% The AFRINIC whois database is subject to the following terms of Use.
See https://afrinic.net/whois/terms
as-set: [mandatory] [single] [primary/lookup key]
descr: [mandatory] [multiple] [ ]
members: [optional] [multiple] [ ]
mbrs-by-ref: [optional] [multiple] [inverse key]
remarks: [optional] [multiple] [ ]
org: [optional] [multiple] [inverse key]
tech-c: [mandatory] [multiple] [inverse key]
admin-c: [mandatory] [multiple] [inverse key]
notify: [optional] [multiple] [inverse key]
mnt-by: [mandatory] [multiple] [inverse key]
mnt-lower: [optional] [multiple] [inverse key]
changed: [mandatory] [multiple] [ ]
source: [mandatory] [single] [ ]
cacty at shalom:~$ /
(iii) Actual AS-SET detailed syntax;
/cacty at shalom:~$ TZ='UTC' date --rfc-3339='seconds' && whois -h
whois.afrinic.net -v AS-SET # from AS15964 at Bhome
2026-07-19 14:53:36+00:00
% This is the AfriNIC Whois server.
% The AFRINIC whois database is subject to the following terms of Use.
See https://afrinic.net/whois/terms
The as-set class:
An as-set object defines a set of aut-num objects. The
attributes of the as-set class are shown in Figure 1.2.2. The
"as-set:" attribute defines the name of the set. It is an RPSL
name that starts with "as-". The "members:" attribute lists the
members of the set. The "members:" attribute is a list of AS
numbers, or other as-set names.
as-set: [mandatory] [single] [primary/lookup key]
descr: [mandatory] [multiple] [ ]
members: [optional] [multiple] [ ]
mbrs-by-ref: [optional] [multiple] [inverse key]
remarks: [optional] [multiple] [ ]
org: [optional] [multiple] [inverse key]
tech-c: [mandatory] [multiple] [inverse key]
admin-c: [mandatory] [multiple] [inverse key]
notify: [optional] [multiple] [inverse key]
mnt-by: [mandatory] [multiple] [inverse key]
mnt-lower: [optional] [multiple] [inverse key]
changed: [mandatory] [multiple] [ ]
source: [mandatory] [single] [ ]
The content of the attributes of the as-set class are defined below:
as-set
Defines the name of the set.
An as-set name is made up of letters, digits, the
character underscore "_", and the character hyphen "-"; it
must start with "as-", and the last character of a name must
be a letter or a digit.
An as-set name can also be hierarchical. A hierarchical set
name is a sequence of set names and AS numbers separated by
colons ":". At least one component of such a name must be
an actual set name (i.e. start with "as-"). All the set
name components of a hierarchical as-name have to be as-set
names.
descr
A short decription related to the object.
A sequence of ASCII characters.
members
Lists the members of the set.
<as-number> or
<as-set-name>
mbrs-by-ref
This attribute can be used in all "set" objects; it allows indirect
population of a set. If this attribute is used, the set also includes
objects of the corresponding type (aut-num objects for as-set, for
example) that are protected by one of these maintainers and whose
"member-of:" attributes refer to the name of the set. If the value of
a "mbrs-by-ref:" attribute is ANY, any object of the corresponding
type referring to the set is a member of the set. If the
"mbrs-by-ref:" attribute is missing, the set is defined explicitly by
the "members:" attribute.
<mntner-name> | ANY
remarks
Contains remarks.
A sequence of ASCII characters.
org
Points to an existing organisation object representing the entity that
holds the resource.
The 'ORG-' string followed by 2 to 4 characters, followed by up to
5 digits
followed by a source specification. The first digit must not be "0".
Source specification starts with "-" followed by source name up to
9-character length.
tech-c
References a technical contact.
From 2 to 4 characters optionally followed by up to 5 digits
optionally followed by a source specification. The first digit
must not be "0". Source specification starts with "-" followed
by source name up to 9-character length.
admin-c
References an on-site administrative contact.
From 2 to 4 characters optionally followed by up to 5 digits
optionally followed by a source specification. The first digit
must not be "0". Source specification starts with "-" followed
by source name up to 9-character length.
notify
Specifies the e-mail address to which notifications of changes to an
object should be sent.
This attribute is filtered from the default whois output.
An e-mail address as defined in RFC 2822.
mnt-by
Specifies the identifier of a registered mntner object used for
authorisation of operations performed with the object that contains
this attribute.
Made up of letters, digits, the character underscore "_",
and the character hyphen "-"; the first character of a name
must be a letter, and the last character of a name must be a
letter or a digit. The following words are reserved by
RPSL, and they can not be used as names:
any as-any rs-any peeras and or not atomic from to at
action accept announce except refine networks into inbound
outbound
Names starting with certain prefixes are reserved for
certain object types. Names starting with "as-" are
reserved for as set names. Names starting with "rs-" are
reserved for route set names. Names starting with "rtrs-"
are reserved for router set names. Names starting with
"fltr-" are reserved for filter set names. Names starting
with "prng-" are reserved for peering set names. Names
starting with "irt-" are reserved for irt names.
mnt-lower
Specifies the identifier of a registered mntner object used for
hierarchical authorisation. Protects creation of objects directly (one
level) below in the hierarchy of an object type. The authentication
method of this maintainer object will then be used upon creation of
any object directly below the object that contains the "mnt-lower:"
attribute.
Made up of letters, digits, the character underscore "_",
and the character hyphen "-"; the first character of a name
must be a letter, and the last character of a name must be a
letter or a digit. The following words are reserved by
RPSL, and they can not be used as names:
any as-any rs-any peeras and or not atomic from to at
action accept announce except refine networks into inbound
outbound
Names starting with certain prefixes are reserved for
certain object types. Names starting with "as-" are
reserved for as set names. Names starting with "rs-" are
reserved for route set names. Names starting with "rtrs-"
are reserved for router set names. Names starting with
"fltr-" are reserved for filter set names. Names starting
with "prng-" are reserved for peering set names. Names
starting with "irt-" are reserved for irt names.
changed
Specifies who submitted the update, and when the object was updated.
This attribute is filtered from the default whois output.
An e-mail address as defined in RFC 2822, followed by a date
in the format YYYYMMDD.
source
Specifies the registry where the object is registered. Should be
"AFRINIC" for the AFRINIC Database.
Made up of letters, digits, the character underscore "_",
and the character hyphen "-"; the first character of a
registry name must be a letter, and the last character of a
registry name must be a letter or a digit.
cacty at shalom:~$ /
Have a blessed sunday; y'all!
Shalom,
--sb.
> Kind regards,
>
>
> Haitham el Nakhal
>
> AFRINIC PDWG Co-Chair
>
>
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd
--
Best Regards !
baya.sylvain [AT cmNOG DOT cm] |
cmNOG's Structure <https://www.cmnog.cm/dokuwiki/Structure> | CAMIX's
Website <https://www.camix.cm/> | Douala-IX's Looking Glass
<https://tools.std.douala-ix.net/lg> |
cmNOG's Surveys <https://survey2.cmnog.cm/> | Subscribe to cmNOG's
Mailing List <https://lists.cmnog.cm/mailman/listinfo/cmnog> |
__
#LASAINTEBIBLE|#Ephésiens5:18,15-21«[...] 18 Et *_ne vous enivrez_* pas
*_de vin_*, en quoi *_il y a de la dissolution_*; mais *_soyez remplis
de l'Esprit_*, [...]»
#LASAINTEBIBLE|#Hébreux13:9,5-15«[...] 9 _*Ne soyez pas seduits par*_
des _*doctrines diverses*_ et _*etrangeres*_, car il est bon _*que le
coeur soit affermi par la grace*_, non par les viandes, lesquels n'ont
pas profite à ceux qui y ont marche. [...]»
#AMEN,#Maranatha,#MerciJÉSUS! #MaPrière est que tu naisses de
nouveau.#Chrétiennement
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: FZqxPTyZXI0rz0ip.png
Type: image/png
Size: 218713 bytes
Desc: not available
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x0387408365AC8594.asc
Type: application/pgp-keys
Size: 19437 bytes
Desc: OpenPGP public key
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.sig>
More information about the RPD
mailing list