Search RPD Archives
Limit search to: Subject & Body Subject Author
Sort by:

[rpd] [Last Call] Draft Policy Proposal - Hierarchical Names for New AS-SETs (AFPUB-2026-ASN-001-DRAFT02)

Sylvain BAYA baya.sylvain at cmnog.cm
Sun Jul 19 15:16:43 UTC 2026


Le 16/07/2026 à 23:09, Hytham El-Nakhal a écrit :
> Dear PDWG,
>
>
> The Policy Development Working Group (PDWG) Chairs have initiated a Last Call for this proposal, following rough consensus at the AFRINIC-37 Public Policy Meeting held in hybrid format in Nairobi, Kenya on 24 June 2026.
>
>    *   Proposal Name: Hierarchical Names for New AS-SETs
>
>    *   Proposal ID: AFPUB-2026-ASN-001-DRAFT02
>
>    *   Proposal URL:https://www.afrinic.net/afpub-2026-asn-001-draft02.html
>
> Last Call closes on: July 31, 2026, at 23:59 UTC.
>

Dear PDWG Co-chairs,

Many thanks for your much appreciated work!

<tl;dr>
This long email contains four things:
   * the reason why i support this DPP;
   * A presentation from Tashi Phuntsho, during
iWeek2026 regarding:
Securing Internet Routing - The Puzzle Pieces | iWeek 
<https://iweek.org.za/sessions/securing-internet-routing-puzzle-pieces>
Why Internet Routing Is Broken — And How We're Fixing It | BGP Security 
Explained - YouTube <https://www.youtube.com/watch?v=6LJU2IWNAHw>

   * Actual AS-SET syntax;
   * Actual AS-SET detailed syntax
   {as that is where the proposed (by this DPP)
   change of behavior would firstly appear...}
</tl;dr>

...i would like to thanks the author of this DPP;
as he wisely ended the References section with
the following words:

"AFRINIC is the only major RIR which has not currently implemented this 
feature, or is not currently working towards implementing it. If/when 
AFRINIC implements it, AS-SET squatting in the 5 major RIRs will no 
longer be possible and AS-SETs will be have become more secure globally."

...which is the exact reason why i want this DPP
to be (i) adopted; (ii) ratified; and (iii) implemented
the soonest.

> Please note the staff observation regarding implementation constraints: due to the current prioritization of the MyAFRINIC v2 deployment, physical database implementation of this policy will be scheduled once the MyAFRINIC v2 deployment is concluded.
>

...this is ok to me! i have also noted the following
from the Staff IAr (Impact Assessment report)
of this DPP (AFPUB-2026-ASN-001-DRAFT02):

"*6. Staff Observations*

We note the exception highlighted in 7.8.6 that could allow restoration 
of deleted objects. However, we feel that such recalls may introduce 
operational loopholes, and it may also reduce the effective objective 
for the policy in general. In the instance that an unintended deletion 
happens, the affected members may take the opportunity to create aligned 
AS-SETs."


> As always, we kindly request that all participants adhere to the AFRINIC Code of Conduct<https://www.afrinic.net/code> to maintain a respectful and professional environment on the mailing list.
>

Thanks for recalling it; as the risk is always there!

By the way, having noted that there seems to
be some recurring misbeliefs regarding what
an AS-SET class of IRR/Whois objects is; please
allow me to share three things, which could be
helpful to see where the proposed change is
intended to start to be seen:

(i) A presentation from Tashi Phuntsho, during
iWeek2026 regarding:
Securing Internet Routing - The Puzzle Pieces | iWeek 
<https://iweek.org.za/sessions/securing-internet-routing-puzzle-pieces>
Why Internet Routing Is Broken — And How We're Fixing It | BGP Security 
Explained - YouTube <https://www.youtube.com/watch?v=6LJU2IWNAHw>

(ii) Actual AS-SET syntax;

/cacty at shalom:~$ TZ='UTC' date --rfc-3339='seconds' && whois -h 
whois.afrinic.net -t AS-SET # from AS15964 at Bhome
2026-07-19 14:43:17+00:00
% This is the AfriNIC Whois server.
% The AFRINIC whois database is subject to  the following terms of Use. 
See https://afrinic.net/whois/terms

as-set:         [mandatory]  [single]     [primary/lookup key]
descr:          [mandatory]  [multiple]   [ ]
members:        [optional]   [multiple]   [ ]
mbrs-by-ref:    [optional]   [multiple]   [inverse key]
remarks:        [optional]   [multiple]   [ ]
org:            [optional]   [multiple]   [inverse key]
tech-c:         [mandatory]  [multiple]   [inverse key]
admin-c:        [mandatory]  [multiple]   [inverse key]
notify:         [optional]   [multiple]   [inverse key]
mnt-by:         [mandatory]  [multiple]   [inverse key]
mnt-lower:      [optional]   [multiple]   [inverse key]
changed:        [mandatory]  [multiple]   [ ]
source:         [mandatory]  [single]     [ ]

cacty at shalom:~$ /


(iii) Actual AS-SET detailed syntax;

/cacty at shalom:~$ TZ='UTC' date --rfc-3339='seconds' && whois -h 
whois.afrinic.net -v AS-SET # from AS15964 at Bhome
2026-07-19 14:53:36+00:00
% This is the AfriNIC Whois server.
% The AFRINIC whois database is subject to  the following terms of Use. 
See https://afrinic.net/whois/terms

The as-set class:

       An as-set object defines a set of aut-num objects. The
       attributes of the as-set class are shown in Figure 1.2.2. The
       "as-set:" attribute defines the name of the set. It is an RPSL
       name that starts with "as-". The "members:" attribute lists the
       members of the set.  The "members:" attribute is a list of AS
       numbers, or other as-set names.

as-set:         [mandatory]  [single]     [primary/lookup key]
descr:          [mandatory]  [multiple]   [ ]
members:        [optional]   [multiple]   [ ]
mbrs-by-ref:    [optional]   [multiple]   [inverse key]
remarks:        [optional]   [multiple]   [ ]
org:            [optional]   [multiple]   [inverse key]
tech-c:         [mandatory]  [multiple]   [inverse key]
admin-c:        [mandatory]  [multiple]   [inverse key]
notify:         [optional]   [multiple]   [inverse key]
mnt-by:         [mandatory]  [multiple]   [inverse key]
mnt-lower:      [optional]   [multiple]   [inverse key]
changed:        [mandatory]  [multiple]   [ ]
source:         [mandatory]  [single]     [ ]

The content of the attributes of the as-set class are defined below:

as-set

    Defines the name of the set.

      An as-set name is made up of letters, digits, the
      character underscore "_", and the character hyphen "-"; it
      must start with "as-", and the last character of a name must
      be a letter or a digit.

      An as-set name can also be hierarchical.  A hierarchical set
      name is a sequence of set names and AS numbers separated by
      colons ":".  At least one component of such a name must be
      an actual set name (i.e. start with "as-").  All the set
      name components of a hierarchical as-name have to be as-set
      names.

descr

    A short decription related to the object.

      A sequence of ASCII characters.

members

    Lists the members of the set.

      <as-number> or
      <as-set-name>

mbrs-by-ref

    This attribute can be used in all "set" objects; it allows indirect
    population of a set. If this attribute is used, the set also includes
    objects of the corresponding type (aut-num objects for as-set, for
    example) that are protected by one of these maintainers and whose
    "member-of:" attributes refer to the name of the set. If the value of
    a "mbrs-by-ref:" attribute is ANY, any object of the corresponding
    type referring to the set is a member of the set. If the
    "mbrs-by-ref:" attribute is missing, the set is defined explicitly by
    the "members:" attribute.

      <mntner-name> | ANY

remarks

    Contains remarks.

      A sequence of ASCII characters.

org

    Points to an existing organisation object representing the entity that
    holds the resource.

      The 'ORG-' string followed by 2 to 4 characters, followed by up to 
5 digits
      followed by a source specification.  The first digit must not be "0".
      Source specification starts with "-" followed by source name up to
      9-character length.

tech-c

    References a technical contact.

      From 2 to 4 characters optionally followed by up to 5 digits
      optionally followed by a source specification.  The first digit
      must not be "0".  Source specification starts with "-" followed
      by source name up to 9-character length.

admin-c

    References an on-site administrative contact.

      From 2 to 4 characters optionally followed by up to 5 digits
      optionally followed by a source specification.  The first digit
      must not be "0".  Source specification starts with "-" followed
      by source name up to 9-character length.

notify

    Specifies the e-mail address to which notifications of changes to an
    object should be sent.
    This attribute is filtered from the default whois output.

      An e-mail address as defined in RFC 2822.

mnt-by

    Specifies the identifier of a registered mntner object used for
    authorisation of operations performed with the object that contains
    this attribute.

      Made up of letters, digits, the character underscore "_",
      and the character hyphen "-"; the first character of a name
      must be a letter, and the last character of a name must be a
      letter or a digit.  The following words are reserved by
      RPSL, and they can not be used as names:

       any as-any rs-any peeras and or not atomic from to at
       action accept announce except refine networks into inbound
       outbound

      Names starting with certain prefixes are reserved for
      certain object types.  Names starting with "as-" are
      reserved for as set names.  Names starting with "rs-" are
      reserved for route set names.  Names starting with "rtrs-"
      are reserved for router set names. Names starting with
      "fltr-" are reserved for filter set names. Names starting
      with "prng-" are reserved for peering set names. Names
      starting with "irt-" are reserved for irt names.

mnt-lower

    Specifies the identifier of a registered mntner object used for
    hierarchical authorisation. Protects creation of objects directly (one
    level) below in the hierarchy of an object type. The authentication
    method of this maintainer object will then be used upon creation of
    any object directly below the object that contains the "mnt-lower:"
    attribute.

      Made up of letters, digits, the character underscore "_",
      and the character hyphen "-"; the first character of a name
      must be a letter, and the last character of a name must be a
      letter or a digit.  The following words are reserved by
      RPSL, and they can not be used as names:

       any as-any rs-any peeras and or not atomic from to at
       action accept announce except refine networks into inbound
       outbound

      Names starting with certain prefixes are reserved for
      certain object types.  Names starting with "as-" are
      reserved for as set names.  Names starting with "rs-" are
      reserved for route set names.  Names starting with "rtrs-"
      are reserved for router set names. Names starting with
      "fltr-" are reserved for filter set names. Names starting
      with "prng-" are reserved for peering set names. Names
      starting with "irt-" are reserved for irt names.

changed

    Specifies who submitted the update, and when the object was updated.
    This attribute is filtered from the default whois output.

      An e-mail address as defined in RFC 2822, followed by a date
      in the format YYYYMMDD.

source

    Specifies the registry where the object is registered. Should be
    "AFRINIC" for the AFRINIC Database.

      Made up of letters, digits, the character underscore "_",
      and the character hyphen "-"; the first character of a
      registry name must be a letter, and the last character of a
      registry name must be a letter or a digit.

cacty at shalom:~$ /


Have a blessed sunday; y'all!

Shalom,
--sb.


> Kind regards,
>
>
> Haitham el Nakhal
>
> AFRINIC PDWG Co-Chair
>
>
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd

-- 

Best Regards !

baya.sylvain [AT cmNOG DOT cm] |
cmNOG's Structure <https://www.cmnog.cm/dokuwiki/Structure> | CAMIX's 
Website <https://www.camix.cm/> | Douala-IX's Looking Glass 
<https://tools.std.douala-ix.net/lg> |
cmNOG's Surveys <https://survey2.cmnog.cm/> | Subscribe to cmNOG's 
Mailing List <https://lists.cmnog.cm/mailman/listinfo/cmnog> |
__
#LASAINTEBIBLE|#Ephésiens5:18,15-21«[...] 18 Et *_ne vous enivrez_* pas 
*_de vin_*, en quoi *_il y a de la dissolution_*; mais *_soyez remplis 
de l'Esprit_*, [...]»
‬#LASAINTEBIBLE|#Hébreux13:9,5-15«[...] 9 _*Ne soyez pas seduits par*_ 
des _*doctrines diverses*_ et _*etrangeres*_, car il est bon _*que le 
coeur soit affermi par la grace*_, non par les viandes, lesquels n'ont 
pas profite à ceux qui y ont marche. [...]»
#AMEN,#Maranatha,#MerciJÉSUS! #‎MaPrière‬ est que tu naisses de 
nouveau.#Chrétiennement

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: FZqxPTyZXI0rz0ip.png
Type: image/png
Size: 218713 bytes
Desc: not available
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x0387408365AC8594.asc
Type: application/pgp-keys
Size: 19437 bytes
Desc: OpenPGP public key
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260719/1111aa55/attachment-0001.sig>


More information about the RPD mailing list