[DNSOP] Re: A question regarding DNSSEC validation

[Shumon Huque <[e-mail]>]

On Mon, Apr 20, 2026 at 4:57 PM John Kristoff <jtk=
[e-mail]> wrote:

> On Mon, 20 Apr 2026 16:17:27 -0400
> Shumon Huque <[e-mail]> wrote:
>
> > The DNS protocol specs do not in my view adequately describe robust
> > retry and failover, and I think they should.
>
> I asked a variation of this question (e.g., if a resolver can't
> validate an answer due to an expired sig) elsewhere where a few
> implementing code hang out. In short, specifications are not entirely
> clear and implementations can differ. Here is some additional detail:
>
> From IETF RFC 1034, Section 5.3.3 Algorithm
>
>   "Step 3 sends out queries until a response is received.  The strategy
>   is to cycle around all of the addresses for all of the servers with a
>   timeout between each transmission."
>
> From IETF RFC 1035, Section 7.2 Sending the queries
>
>   "The key algorithm uses the state information of the request to
>   select the next name server address to query, and also computes a
>   timeout which will cause the next action should a response not
>   arrive.  The next action will usually be a transmission to some other
>   server, but may be a temporary error to the client."
>
> Knot, Bind, and Unbound will retry, but each may have exhibit slightly
> different behavior.
>

Thanks John.

Certainly implementations will differ because of software architecture or
other reasons.

I think that's fine as long as some general principles about retry and
failover can be agreed to be followed.

Shumon.