Re: [DNSOP] [[e-mail]: I-D Action: draft-bortzmeyer-dnsop-nxdomain-cut-00.txt]

[Stephane Bortzmeyer <[e-mail]>]

On Wed, Nov 11, 2015 at 01:15:37AM +0000,
 Wessels, Duane <[e-mail]> wrote 
 a message of 107 lines which said:

> This updates RFC 2308 (Negative Caching of DNS Queries).

Good point, I'll add that. Also, I did not dare to add "Updates: RFC
1034". Should I?

> I think the WG needs to discuss and agree whether or not to make the
> NXDOMAIN cut based on QNAME only, or on the SOA owner name.

This is discussed (shortly) in section 5 of the draft. Apparently, it
can be risky to rely on the SOA. More discussion welcome.

> If the goal is to thwart random qname attacks, then it would be
> better to use the SOA

Sure, if you don't have access to the resolver (if you do, you can
"poison" it with a request QNAME=apex-of-the-attack).

> Implementing NXDOMAIN cut should also reduce the effectiveness of a
> Kaminsky attack since the attack relies on the cache to forward
> numerous non-existent names.

Right.

> I think its a little dangerous to say that an NXDOMAIN response
> SHOULD cause a cache to delete already cached "positive" data.

Could you elaborate why is it dangerous? (See also the second
paragraph of section 7.)