Re: DNSSEXT Yokohama Minutes

[Paul Vixie <[e-mail]>]

> >it's starting to seem to me that answers containing NXT should include an
> >SOA in the authority section.  (even though that means nonauthoritative
> >servers will have to cache them, which today is illegal.)  when new secure
> >(verified) data arrives with a later SOA.SERIAL, all the older cached data
> >for that zone becomes invalid.
> 
> NXT's are already supposed to only be signed by the zone key.  Isn't 
> that sufficient to identify the authority - or is there something 
> else needed out of the SOA RR RDATA?

if there's enough info in the signature to be able to tell what other cached
data you should preexpire, then no.  however, i don't think that's the case;
all you can know, afaik, is that the records you're holding were signed less
recently than the records you're now receiving.

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>