IETF Logo Mail Archive

Re: [DNSOP] new draft: 'NSEC(3) TTLs and NSEC Aggressive Use' (New Version Notification for draft-vandijk-dnsop-nsec-ttl-00.txt)

Vladimír Čunát <vladimir.cunat+ietf@nic.cz> Sat, 12 December 2020 10:46 UTC

Return-Path: <vladimir.cunat+ietf@nic.cz>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FB4A3A1009 for <dnsop@ietfa.amsl.com>; Sat, 12 Dec 2020 02:46:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GLGwyX-d5qef for <dnsop@ietfa.amsl.com>; Sat, 12 Dec 2020 02:46:52 -0800 (PST)
Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73F653A0FFB for <dnsop@ietf.org>; Sat, 12 Dec 2020 02:46:50 -0800 (PST)
Received: from [IPv6:2a02:768:2d1c:226::a2e] (unknown [IPv6:2a02:768:2d1c:226::a2e]) by mail.nic.cz (Postfix) with ESMTPSA id 965E1140AB2; Sat, 12 Dec 2020 11:46:46 +0100 (CET)
To: Peter van Dijk <peter.van.dijk@powerdns.com>, dnsop@ietf.org
References: <160616178406.24526.15858981444327414727@ietfa.amsl.com> <ca6217f45a8b3be86fb62f4967a342bb50b241a0.camel@powerdns.com>
From: Vladimír Čunát <vladimir.cunat+ietf@nic.cz>
Message-ID: <bf61d356-0e9b-6b42-3ee2-9420be0d1460@nic.cz>
Date: Sat, 12 Dec 2020 11:46:46 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.5.1
MIME-Version: 1.0
In-Reply-To: <ca6217f45a8b3be86fb62f4967a342bb50b241a0.camel@powerdns.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US
X-Virus-Scanned: clamav-milter 0.102.2 at mail
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/n7FDdVHBucqBWS-uJUZumDk_NdQ>
Subject: Re: [DNSOP] new draft: 'NSEC(3) TTLs and NSEC Aggressive Use' (New Version Notification for draft-vandijk-dnsop-nsec-ttl-00.txt)
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Dec 2020 10:46:54 -0000

Hello.

 From resolver point of view... this implies that signed *positive* 
wildcard answers will now get cached with this shorter "negative TTL", 
right?  These do need to deny existence of non-wildcard match, so they 
need to contain NSEC*.

Maybe the final text would better explicitly note such implications, but 
that certainly can wait way past WG adoption. Also it might be confusing 
that just by singing a zone the effective TTL of these answers would get 
lower - assuming I got your intention right (if not, perhaps the current 
text wasn't clear enough anyway).

--Vladimir @ Knot Resolver

v2.23.0 | Report a Bug | By Email