Re: [dnsext] Fwd: RFC 2308 & RFC 4035

["W.C.A. Wijngaards" <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Ed,

On 02/25/2011 08:41 PM, Edward Lewis wrote:
> I have a question referring to two sections in two RFCs, prompted by the
> resimprove draft.

> Let's aay this happens:
> 
> at 10am a cache receives a response to a query for example.tld./IN/A
> that says
> 
> example.tld.   3600    NSEC3   a.example.tld.  SOA NS DNSKEY RRSIG NSEC
> 
> at 10:15am the cache gets a query for example.tld./IN/AAAA.
> 
> Should the cache rely with a NoData response or should it try to query
> for the AAAA?

I think they should use the passage quoted by George.  NSECs are used
for exactly the qname,qtype,qclass that solicited them (NODATA and
NXDOMAIN).

> If the answer to the previous is "it should rely on the cached NSEC:"
> What if I said that at 10:10am, the authority was updated with a new
> zone that had an AAAA RRset at the apex?

- From an efficiency point, using cached NSECs helps; but for caches the
nxdomain and nodata traffic is a lot smaller than e.g. for roots.

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAk1otGQACgkQkDLqNwOhpPghXACfXunnU5hAj20WTbjbVTTXmRWC
Z2EAn3+XUuyESnIuigYwLuEfSas3ngOE
=JN8C
-----END PGP SIGNATURE-----