Re: [dnsext] Fwd: RFC 2308 & RFC 4035

[Mark Andrews <[e-mail]>]

In message <a06240805c98db61801c2@[10.31.200.114]>, Edward Lewis writes:
> I have a question referring to two sections in two RFCs, prompted by 
> the resimprove draft.
> 
> RFC 4035:
> 5.4.  Authenticated Denial of Existence
> ...
>     o  If the requested RR name matches the owner name of an
>        authenticated NSEC RR, then the NSEC RR's type bit map field lists
>        all RR types present at that owner name, and a resolver can prove
>        that the requested RR type does not exist by checking for the RR
>        type in the bit map.  ...
> 
> And in RFC 2308:
> 5 - Caching Negative Answers
> ...
>     A negative answer that resulted from a no data error (NODATA) should
>     be cached such that it can be retrieved and returned in response to
>     another query for the same <QNAME, QTYPE, QCLASS> that resulted in
>     the cached negative response.
> 
> Let's aay this happens:
> 
> at 10am a cache receives a response to a query for example.tld./IN/A that say
> s
> 
> example.tld.   3600    NSEC3   a.example.tld.  SOA NS DNSKEY RRSIG NSEC
> 
> at 10:15am the cache gets a query for example.tld./IN/AAAA.
> 
> Should the cache rely with a NoData response or should it try to 
> query for the AAAA?
> 
> If the answer to the previous is "it should rely on the cached NSEC:" 
> What if I said that at 10:10am, the authority was updated with a new 
> zone that had an AAAA RRset at the apex?

Nothing worse than having asked for the AAAA record at 10:00 am.
The zone administrator has to assume that AAAA queries will have
been made prior to adding the AAAA records.  This will almost
certainly be the case if there were A queries.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]