Re: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt

["White, Andrew" <[e-mail]>]

Hi Shumon,

True. When a resolver gets an NXDOMAIN for, say x.example.com, would it better to say the resolver SHOULD drop from cache all descendents of x.example.com, or MAY?

It may be computationally expensive to search cache to remove cached NXDOMAIN responses below x.example.com, and I see no harm in letting those cached entries expire as their TTL runs out.

Andrew


NB: This is not official Charter Communications correspondence but rather my personal thoughts.


Andrew White
Desk:  314.394-9594<sip:13143949594>  | Cell:  314-452-4386<sip:1-314-452-4386> | Jabber<sip:[e-mail]>
[e-mail]<mailto:[e-mail]>
Systems Engineer III, DAS DNS group
Charter Communications
12405 Powerscourt Drive<https://goo.gl/maps/AH2PXFKnaGU2>,<http://www.html5zombo.com/> St. Louis,  MO 63131


From: Shumon Huque [mailto:[e-mail]]
Sent: Tuesday, September 27, 2016 2:10 PM
To: White, Andrew
Cc: Edward Lewis; [e-mail]
Subject: Re: [DNSOP] Comment on section 2 of draft-ietf-dnsop-nxdomain-cut-05.txt

On Tue, Sep 27, 2016 at 2:48 PM, White, Andrew <[e-mail]<mailto:[e-mail]>> wrote:
Hi Shumon,

What about this?

# When an iterative caching DNS resolver receives a response with RCODE being NXDOMAIN,
# the resolver SHOULD store the response in its (negative) cache.  During the time the response
# is cached, any query with a QNAME at or descended from the denied name that is not otherwise
#cached (positively), can be assumed to result in a name error.  Responses to those queries
# SHOULD set RCODE=NXDOMAIN (using the DNSSEC records cached as proof).

When an iterative caching DNS resolver receives a query response with RCODE as NXDOMAIN,
The resolver should store the NXDOMAIN response in cache. During the time that this response
is cached, any query with a QNAME at or descended from the query that resulted in NXDOMAIN
and that is not already in cache can be assumed to result in a name error. Responses to such
queries SHOULD respond with RCODE as NXDOMAIN using DNSSEC records from cache as proof.

Andrew

Andrew - this looks very similar to Ed's rewrite.

The problem I see with both is that it says to reply with NXDOMAIN for all names at or below the cut, except for RRsets already positively cached. But the current draft also allows resolvers to immediately invalidate cached entries below the cut and also return NXDOMAIN for them. Your rewrite appears to remove (or at least not mention) that possibility.

--
Shumon Huque