Re: [DNSOP] Fw: New Version Notification for draft-arnt-yao-dnsop-root-data-caching-00.txt

Arnt Gulbrandsen <> Fri, 15 February 2019 12:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id E1C11130F82 for <>; Fri, 15 Feb 2019 04:48:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id FduJX-R_lTUb for <>; Fri, 15 Feb 2019 04:48:58 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C5B1F128AFB for <>; Fri, 15 Feb 2019 04:48:57 -0800 (PST)
Received: from ( [IPv6:2a01:4f8:191:91a8::3]) by (Postfix) with ESMTP id 29C38C05EA; Fri, 15 Feb 2019 12:50:40 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;; s=mail; t=1550235040; bh=sZ8/eyqzkdrbvrTC/j+/q+xKKzETgAkaN94vKOhffto=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TUUqzFDCQdrSlYKm3SM56UV7CpC67TGCb8rNQHPDTrdJzw81Skd+DFXtHKwHWqmgE DWjhGisDI6gc9kqKbegMT10VKQdPxfb4HhGYdHaUyF8vJCX+Ekx08jvjDE4a0/QpU/ pKUz6FD2r27nUN11mNA1d/53tHRhbzo00+TvQt3s=
Received: from by (Archiveopteryx 3.2.0) with esmtpsa id 1550235039-26265-2661/9/24; Fri, 15 Feb 2019 12:50:39 +0000
From: Arnt Gulbrandsen <>
To: Bob Harold <>
Cc: Tony Finch <>, Jiankang Yao <>, IETF DNSOP WG <>
Date: Fri, 15 Feb 2019 13:48:53 +0100
Mime-Version: 1.0
Message-Id: <>
In-Reply-To: <>
References: <> <> <> <>
User-Agent: Trojita/0.7; Qt/5.7.1; xcb; Linux; Devuan GNU/Linux 2.0 (ascii)
Content-Type: text/plain; charset="utf-8"; format="flowed"
Archived-At: <>
Subject: Re: [DNSOP] Fw: New Version Notification for draft-arnt-yao-dnsop-root-data-caching-00.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 15 Feb 2019 12:49:00 -0000

On Thursday 14 February 2019 22:41:56 CET, Bob Harold wrote:
> The draft assumes typical TTL is a week, but what I see in the root zone is:

I hoped noone would notice. It's good rather than bad, overall, but it 
complicates the description.

A good resolver verifies DNSSEC, so the two-day RRs tend to be kept alive 
for as long as the six-day RRs are. Once the six-day RRs are discarded from 
the resolver's cache, the two-day RRs are no longer needed for 
verification, and after about a month they cease being refreshed.

In effect, the six-day RRs (typically NS records) have an average lifetime 
of slightly less than three months after the last use, and the supporting 
DNSSEC RRs of slightly more than four months after the last time the NS is 

The SOA record is a special case, but IMO too minor to matter. The focus 
here is to eliminate root-zone queries as a significant delay factor for 
day-to-day DNS use, without introducing additional moving parts such as 
humans or crontabs downloading zone files. Caching one SOA too long or too 
short won't make much difference.