Re: [dnsext] caches, validating resolvers, CD and DO

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Alex Bligh writes:
> 
> 
> --On 30 March 2011 18:11:05 +1100 Mark Andrews <[e-mail]> wrote:
> 
> > You can have different clocks and different sets of trust anchors.
> > The upstream could be treating a zone as insecure but you have a
> > trust anchor.  The upstream won't filter stale responses for you
> > so it won't cope with a authoritative server with stale data and a
> > number of other operational errors that you can work around with
> > direct access to the authoritative servers.
> 
> Hmmm. I think I understand.
> 
> And none of these errors that you can work around with "direct"
> access to the authoritative servers are ones that
> will end up in the BAD cache? As you'll still see these I think.
> RFC4035 s3.2.2
> >    If the CD bit is set,
> >    the name server side SHOULD return the data from the BAD cache;
> 
> Isn't the real answer here just to be a full recursive resolver
> and *really* access the authoritative nameservers directly?

There are plenty of sites that only allow the recursive server talk
to the world.  As much as I would like to say "go direct to the
source" it is not practical.

As for the "bad cache" the only reason for that is we provided bad
advice of "set the CD if you intend to validate".  CD really needs
to be set less often.

> I take it you are suggesting that the reissued query should always
> have DO set as well as CD.
> 
> -- 
> Alex Bligh
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]