Re: [dnsext] WG opinion on draft : Improvements to DNS Resolvers, for Resiliency, Robustness, and Responsiveness

[Paul Vixie <[e-mail]>]

> Date: Wed, 23 Feb 2011 14:04:15 -0500
> From: Edward Lewis <[e-mail]>
> 
> #      A. Revalidating a delegation when a parent NS RRset TTL expires.
> 
> What does it mean to "validate" a delegation?  We have a definition of
> validation in the context of DNSSEC.  I am sure this is different.

in this context it means making sure the delegation still exists.

> #      B. Stopping a downward cache search when an NXDOMAIN is encountered.
> 
> I'm not so sure this is a good one.  It goes against RFC 2308.

see below.

> #   3.2. When searching downward in its cache, an iterative caching DNS
> #   resolver should stop searching if it encounters a cached NXDOMAIN.
> #   The response to the triggering query should be NXDOMAIN.
> #
> #   3.3. When an iterative caching DNS resolver stores an NXDOMAIN in its
> #   cache, all names and RRsets at or below that node should be deleted
> #   since they will have become unreachable.
> 
> This is in conflict with RFC 2308, section 5:
> 
> RFC A negative answer that resulted from a name error (NXDOMAIN) should
> RFC be cached such that it can be retrieved and returned in response to
> RFC another query for the same <QNAME, QCLASS> that resulted in the
> RFC cached negative response.
> 
> This says that the cached NXDOMAIN only applies to the FQDN itself, not
> it's domain.  Ok, ok, that's just paper fighting paper, but this switch in
> requirements has to be addressed.

it does not say "only", which would have been overprescriptive, and the
resimprove proposal could be seen as a 2308 amendment to the effect that
in addition to what 2308 says, and is not in conflict with it.  if so then
it would make resimprove a standards track document not a bcp.

> And I have a sneaking suspicion that this optimization isn't all that good
> of an idea.

please say more when your suspicions become less sneaky?