[DNSOP] Re: A question regarding DNSSEC validation

[John Kristoff <[e-mail]>]

On Tue, 21 Apr 2026 15:41:04 -0400
Shumon Huque <[e-mail]> wrote:

> Unless I've missed it, this does not seem to be clearly addressed
> today anywhere in the DNS specs.

In addition to the quoted bits IETF RFCs 1034 and 1035 I put in my last
message, IETF RFC 4035 has this:

  4.7 Caching BAD Data

    While many validation errors will be transient, some are likely to
    be more persistent, such as those caused by administrative error
    (failure to re-sign a zone, clock skew, and so forth).  Since
    requerying will not help in these cases, validating resolvers might
    generate a significant amount of unnecessary DNS traffic as a result
    of repeated queries for RRsets with persistent validation failures.

    To prevent such unnecessary DNS traffic, security-aware resolvers MAY
    cache data with invalid signatures, with some restrictions.

It is not clear to me from this if data should be considered bad after a
single response or if it is OK for a resolver to retry other name
servers to be sure. I could imagine someone interpreting it either way.

Hopefully these bits are useful leads as to what specifically may need
clarification in your proposal.

John