From: Paul Hoffman <paul.hoffman@icann.org>
To: Wes Hardaker <wjhns1@hardakers.net>
Thread-Topic: DNSOP[Ext] actual expire time for http-based xfrs
Thread-Index: AQHcp0xJALp9OVmIG02ghodXXQcrLLWV12mA
Date: Thu, 26 Feb 2026 18:44:33 +0000
Message-ID: <920168F5-1F55-49DA-9FE2-6D41B1E73A8E@icann.org>
References: <ybla4y6lwjf.fsf@wx.hardakers.net> <m17bsdf74s.fsf@narrans.de>
 <yblfr6ol783.fsf@wx.hardakers.net> <m1jyvza6b9.fsf@narrans.de>
 <93B4FB22-BA75-4DCE-8350-44AB28BCB136@rfc1035.com>
 <CA75B08F-EA52-4282-9A40-27AC743341C7@icann.org>
 <ybla4wv8j3m.fsf@wx.hardakers.net>
In-Reply-To: <ybla4wv8j3m.fsf@wx.hardakers.net>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <9E95D7AB29C8BE4E9538643D3A03F7D8@pexch112.icann.org>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Message-ID-Hash: PO7K65PK76TNSGMYERO46AXHIM44T6NA
CC: "dnsop@ietf.org" <dnsop@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5BDNSOP=5D_Re=3A_DNSOP=5BExt=5D_actual_expire_time_for_http-based?=
	=?utf-8?q?_xfrs?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dnsop/_rwPIs8m28KAXLTUf92ahqbqAMY>

On Feb 26, 2026, at 10:17, Wes Hardaker <wjhns1@hardakers.net> wrote:
>=20
> Paul Hoffman <paul.hoffman@icann.org> writes:
>=20
> Hi Paul,
>=20
>>> And looking at the signature times is definitely one of the
>>> possibilities, but I'm not sure that's the perfect solution either.
>>=20
>> I'm interested in why not
>=20
> There is no reason it won't work, other than we would need a policy
> somewhere stating that signature lengths must be X long minimum and
> LocalRoot implementations must check the end-signature time as the
> method of determining when their data is too old.

It's simpler than that: the resolver just looks at the RRSIG inception time=
 and assumes that this is when the zone was first available. If that is mor=
e than the retry timer, it retries.

> It is doable -- it's just not how we currently consider what signature
> end-times are encoding.  We can add that semantic, certainly, if we
> document it carefully in probably multiple places.

The heuristic would be based on inception times, not expiration. That is, t=
he resolver doesn't wait for the zone to expire, it refreshes while the sig=
natures are still valid.

--Paul Hoffman