Summary

  • RFC 2010 converted a loosely coordinated volunteer service into a list of separately observable obligations: current software, UDP checksums, authenticated time, constrained interfaces, protected facilities, spare capacity, reachable people, controlled transfers, disabled recursion and explicit outage reporting.
  • The document deliberately excluded root-server site and administrator selection and the procedure for noncompliance; its checklist could describe a machine's operation without legitimising its operator, proving the root zone correct or guaranteeing service to every user.

At 2 a.m., a root-server failure is not repaired by knowing that its administrator is respected. Someone must know whom to call. RFC 2010 required an emergency contact path for each site, asked that ordinary operator mail receive a response within 24 hours, and distinguished scheduled notification from the telephone escalation expected for an unscheduled outage or one announced with less than a day’s notice. The person ceased to be the only container of operational knowledge. Contactability itself became evidence.

That was the document’s deeper move. It described root servers as a community of highly capable volunteers, loosely coordinated through the Network Information Center, then decomposed reliance on those people into a set of things another operator could inspect. The zone master—identified in the document’s historical vocabulary as IANA—selected the software and could require an update within 96 hours. Every server had to answer with UDP checksums, obtain time from at least two authenticated sources, and present one advertised network interface even if several physical interfaces supported it.

One service, many receipts

RFC 2010 asked for a dedicated host with no unrelated services and encrypted remote administration. Physical access had to be controlled. Power and network connectivity needed redundancy. Security-relevant events had to leave logs. Recursion was to be disabled except where missing glue made a narrowly bounded exception necessary. Zone transfer was restricted to approved destinations, while full transfer by FTP and the then-new NOTIFY and IXFR mechanisms supplied alternative ways to move changes.

Capacity received its own historical number: an average of 1,200 queries per second with response time below five milliseconds, with 2,000 queries per second described as desirable. Those figures are not a modern sizing rule. They reveal how the 1996 authors tried to turn the vague instruction “be robust” into a testable reserve. The same logic appears in the 96-hour software window: neither number proves that operators complied, but each makes failure discussable in a way personal reputation alone does not.

The checklist also separated the server from the root service as a whole. A successful UDP checksum says something about one response; authenticated time says something about one clock; a log says that an event was recorded; a redundant feed says that an alternate path exists. None proves that the root-zone contents were correct, that all servers were reachable, or that an end user received a valid answer. Evidence must stay attached to the layer that produced it.

The authority boundary is in the omissions

RFC 2010 explicitly put two questions outside its scope: how sites and administrators were selected, and what procedure followed noncompliance. This is not a minor drafting gap. Operational criteria can make a service legible without supplying the legitimacy of appointment or the authority to sanction. A server might satisfy the checklist while its institutional mandate remains contested; a server might fail a criterion while the document provides no adjudication process.

The publication record narrows the claim further. RFC 2010 was Informational, is now marked Legacy, and the RFC Editor notes that it was not an IETF-endorsed recommendation. RFC 2870 later obsoleted it, and RFC 7720 later documented requirements for root name service more generally. These later documents establish succession, not proof that the earlier checklist was universally implemented.

Lu Heng’s three distinctions help preserve that boundary. Running-code primacy asks for operational traces rather than symbolic declarations. Minimum initial specification treats a shared checklist as a coordination floor, not a command that automatically creates adoption. Reality layers prevent a written criterion, a configured machine and an observed outcome from collapsing into one claim. Read this way, RFC 2010’s historical achievement was not central control. It was the conversion of personal trust into a portfolio of falsifiable operating receipts.

Sources