Re: [dnsext] Fwd: RFC 2308 & RFC 4035

----- Original Message ----- 
From: "Edward Lewis" <Ed.Lewis@neustar.biz>
To: <dnsext@ietf.org>
Cc: <ed.lewis@neustar.biz>
Sent: Friday, February 25, 2011 7:41 PM
Subject: [dnsext] Fwd: RFC 2308 & RFC 4035


>I have a question referring to two sections in two RFCs, prompted by 
> the resimprove draft.
> 
> RFC 4035:
> 5.4.  Authenticated Denial of Existence
> ...
>    o  If the requested RR name matches the owner name of an
>       authenticated NSEC RR, then the NSEC RR's type bit map field lists
>       all RR types present at that owner name, and a resolver can prove
>       that the requested RR type does not exist by checking for the RR
>       type in the bit map.  ...
> 
> And in RFC 2308:
> 5 - Caching Negative Answers
> ...
>    A negative answer that resulted from a no data error (NODATA) should
>    be cached such that it can be retrieved and returned in response to
>    another query for the same <QNAME, QTYPE, QCLASS> that resulted in
>    the cached negative response.
> 
> Let's aay this happens:
> 
> at 10am a cache receives a response to a query for example.tld./IN/A that says
> 
> example.tld.   3600    NSEC3   a.example.tld.  SOA NS DNSKEY RRSIG NSEC
> 
> at 10:15am the cache gets a query for example.tld./IN/AAAA.
> 
> Should the cache rely with a NoData response or should it try to 
> query for the AAAA?
> 
> If the answer to the previous is "it should rely on the cached NSEC:" 
> What if I said that at 10:10am, the authority was updated with a new 
> zone that had an AAAA RRset at the apex?

I think this is addressed by

http://tools.ietf.org/html/rfc4035#section-4.5

<<
   In theory, a resolver could use wildcards or NSEC RRs to generate
   positive and negative responses (respectively) until the TTL or
   signatures on the records in question expire.  However, it seems
   prudent for resolvers to avoid blocking new authoritative data or
   synthesizing new data on their own.  Resolvers that follow this
   recommendation will have a more consistent view of the namespace.
>>

George


> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis             
> NeuStar                    You can leave a voice message at +1-571-434-5468
> 
> Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
> Son: "Waah!"
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext