Re: [DNSOP] Clarifying referrals (#35)

[Tony Finch <[e-mail]>]

Paul Vixie <[e-mail]> wrote:
>
> the reason i use SERVFAIL for NOTAUTH is because what i want the initiator to
> do when i'm configured as primary but can't read my zone file, or am
> configured as secondary but can't write my zone file, is the same as what i
> want when i'm not configured for the zone: cache this failure under a
> hold-down timer so as not to melt the tubez, but do try again later in case
> i'm merely late to change my config, or flubbed my config in some way.

I'm interested in this discussion.

Recently I changed private.cam.ac.uk so that queries from off-campus get
NXDOMAIN instead of REFUSED. This had the unanticipated effect of halving
the query load on our authoritative servers. Not really surprising except
perhaps for the size of the effect.

I've had a skim through BIND's resolver code to see how the lame server
cache works. It's, um, not simple :-) but as far as I can see, both
SERVFAIL and REFUSED responses get the server put in the lame cache.

(BIND's servfail cache is different - that's for failures of this server
itself, not the servers it is sending queries to.)

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/  -  I xn--zr8h punycode
Fisher, German Bight: Northwest backing south 4 or 5, veering southwest 5 to 7
later. Moderate, occasionally rough. Showers. Moderate or good.