Re: [dnsext] perhaps we should reintroduce "resimprove"

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Stephane,

On 02/10/2012 09:44 AM, Stephane Bortzmeyer wrote:
> It seems to me that this draft does not currently address the ghost
> domain problem. It mandates revalidation at the parent when the
> records expire, but it does not say anything about the rules that
> allow an authoritative server to overwrite the old TTL with a new
> value, thus preventing expiration.
> 
> Would it be a better idea to use this draft as a starting point to
> work on the issues proposed by the ghost domains paper? (Replacing >=
> by > in the credibility rules and other measures.)

This replacement is wrong.  We must have '=' in >= to pick up zone
changes from the same server.  We must have revalidation at the parent
for the ghost-domain problem, it is simply a case of having the NS TTL
expire (i.e. meaning, the NS RRset can be replaced with a newer one but
the NS TTL does not increase).

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPNOC/AAoJEJ9vHC1+BF+NkM0P/2nD+lSLsjAF0lf1gFEJpUh5
w2GUOFeGbPnuLdz/ohf3b/da50/H3va8XjXFZfgbo+4C1A8nawmMc1IGn6SRIJ+0
50WVZ7la5Yi8v1Ud88UWAeqZohp4dvB4jUcY7exe+5/o7UFNPt7OFdUjQHVjT3ua
IH2AEoy78W4/cBurwcUe2mS5SQ+ihUeNyLhAXmsZiZK9DJDXkPhJQwCJqEvjy8AO
/tpD2jn/dNncbM09UMBCxVaBvB0VBsywG9HoY4Q3vpCbc0/21CxhqtS2FSoTgtJK
a6afKcJ1TNBWSlXqSg3JwGdVsTABzrlh8JIdd7cKBf6uyzQzK+BhsEra9CcTmYjG
MQ2KdZsxCKdfuTWFpsdZKDTCnMuCp3PBK582zzOIv/+HxI9nAR4+QYHec9+l5faI
YWcsQb/zaf+l6TFJg1nB0DoieGqLO+zwO+o5wJ3M2wrr+FIuKgVs8pyw1q8hVRou
w4uCwOEfV5cuL9+IivzC5w/RM58TKNihcHLqQ0fyeBpQd5ZKjwgo5AYmMMr+n5Jg
MszACzTzDHfb01S23FFgxzFfMw4zq6M9LOKrrxVOPZ73CVQYbuHsEpxgona04srD
oFe8UDdb2O478JkmAO7y6H+ZKVXxCzbM9oSGlEFVZWZbmtMYAlxa1cmhW5GwRuM1
Bc8M+hKwKiiqPgEtSC2e
=Ir1l
-----END PGP SIGNATURE-----
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext