Re: Why *can* cached DNS replies be overwritten?

[bert hubert <[e-mail]>]

On Mon, Aug 11, 2008 at 03:04:27PM -0400, Jay R. Ashworth wrote:
> Correct me if I'm wrong, Leo, but your assertion turns on the fact that
> the server will accept an overwriting cache entry for something it
> already has cacheed, does it not?
> 
> Do djb and Power in fact do that?

Yes - PowerDNS does that because of reasons which used to be persuasive. It
is in fact probably possible to ignore such updates.

Costs are that (nameserver) changes get picked up later. 

I'll try this in PowerDNS on the several billion test queries and answers we
have to see if this breaks things.

> Everyone seems to continue asking "why can poisoning overwrite already
> cached answer" and no one seems to be answering, and, unless I'm a
> moron (which is not impossible), that's the crux of this issue.

It feels odd to deviate from 25 years of DNS practice. This may be one
reason why people find it hard to try such things.

Thanks for persistenly asking about this.

It may be something that is not theoretically allowed, but that practically
helps us out of the woods.

Will report results of the tests here.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>