Re: [dnsext] Fwd: RFC 2308 & RFC 4035

["W.C.A. Wijngaards" <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

On 02/27/2011 12:42 AM, Mark Andrews wrote:
>> I think my question wasn't understood.
>>
>> Do cache implementers use the fact that the proof of no A record 
>> coincidently shows there is also no AAAA record when processing a 
>> subsequent AAAA query.  (Meaning, there's no other entry for the AAAA 
>> alredy in the cache.)
>>
>> If a cache does do this kind of proof by inference, what does the 
>> implementer think about the situation in which there is a "race 
>> condition" - that the proof of non-existence has been obviated by 
>> actions outside of it's sphere?  (Like the subsequent adding of the 
>> AAAA set in the authority.
> 
> We do this for NXDOMAIN today.  If we ask for A foo.example and get
> back a NXDOMAIN then the cache gets asked for AAAA foo.example we
> use that NXDOMAIN.  Using the NSEC/NSEC3 that matches the <qname,qclass>
> really no different.
> 
> The much more interesting question is infering NXDOMAIN for a
> <qname,qclass> we havn't asked for.  Named already does this when
> looking for DLV records when validating but is expected by all
> parties involved.

Unbound does not use this, also not for NXDOMAINs and other types.

We infer NXDOMAINs and NODATA for DLV records, like named does, because
the RFC says so.

Qtype DS is also inferred from NSECs, an artifact of the implementation.
 It should never have the problem that you describe because if the
domain suddenly got signed, you would get the DS with the referral, and
having an old referral means that exactly what Mark said earlier 'there
was a referral query 10 minutes ago', otherwise you would not have the
NS data anyway and get the DS information if you were to need new NS data.

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAk1qLr8ACgkQkDLqNwOhpPhinACgiMzWRLSc4VnK/X6eOOkuuy4n
cXYAnR3oMs4g+YODyGtaGvckG/IFpQgm
=ERnd
-----END PGP SIGNATURE-----