draft-dnsop-nsec-ttl's People
draft-dnsop-nsec-ttl's Issues
update text from 8198?
review notes from Benjamin Kaduk
Benjamin wrote:
| A signer MAY cause the TTL of the NSEC RR to have a
| deviating value after the SOA record has been updated, to allow
| for an incremental update of the NSEC chain.I don't think I understand what a "deviating value" would be (and in
which direction it would deviate).
This sentence was added because some implementations may need time to rework the whole NSEC/NSEC3 chain after a TTL change. The deviation would be 'part of the chain still has the old, wrong, value - for a while'. I'll ponder better words - suggestions are very welcome, of course.
Section 4
If signers & DNS servers for a zone cannot immediately be updated to
conform to this document, zone operators are encouraged to consider
setting their SOA record TTL and the SOA MINIMUM field to the same
value. That way, the TTL used for aggressive NSEC and NSEC3 use
matches the SOA TTL for negative responses.Are there any negative consequences of such a move that would need to be
weighed against the stated benefits?
Signers might use either value (the SOA TTL or the SOA MINIMUM) as a default for some other value. For example, PowerDNS uses the SOA MINIMUM value as the TTL for DNSKEYs. So, lowering the SOA MINIMUM would also lower the DNSKEY TTL (in PowerDNS).
A quick skim of the BIND dnssec-keygen manual page suggests that BIND might sometimes take the SOA TTL as the DNSKEY TTL.
So, yes, there might be consequences. I will add a note.
words on opt-out?
0cb1965 removes this sentence:
(Note that, because .com uses opt-out NSEC3, such aggressive use would not in fact apply to this zone -
it is merely used as a very visible example here.)
The removal was because the sentence was irrelevant, especially with the change to .example. However, a conversation I had with @mnordhoff today reminded me that an opt-out NSEC(3) is basically a 'no-DS' claim over a range of (hashed) names. This means that the 86400 TTL on .com NSEC3s does in fact matter, because resolvers can act on it for the strict purpose of deciding if a delegation is insecure. This, then, means that the .com NSEC3 TTL in fact has operational impact.
20:41Z <Peng> Habbie: I thiiiiiiink Unbound is affected by this. It doesn't automatically do explicit DS queries like PowerDNS, and in my experience it caches "this domain is insecure" for a long time, but I don't know precisely how long or what its logic is.
20:41Z <Habbie> Peng, ok, will note that too
20:42Z <Peng> (I believe, if a user does "dig @unbound example.com ds", it will do an explicit DS query even if it had a cached there-is-no-DS referral.)
20:42Z <Habbie> Peng, can I quote your thiiiink in a public github ticket?
20:42Z <Peng> (Because its logic doesn't account for it, or so it can get the SOA record, or something. I don't know.)
20:43Z <Peng> Habbie: Sure. :D I haven't checked a recent version of Unbound, and I haven't examined its source code to see what the logic is, but I'm ~certain of my observation.
20:43Z <Habbie> the uncertainty is clear
20:43Z <Habbie> and I don't want to forget this
20:43Z <Habbie> thanks :)
20:44Z <Peng> I am certain of my observation, but I'm uncomfortable saying so out loud without carefully testing it for sure. :D
20:45Z <Habbie> Peng, do note that 'dig dnsdist.com @c.gtld-servers.net +dnssec' includes the denial
update 8198 anyway?
While any update we could do to 8198 would be without function, there's still wrong language in 5.4 and perhaps it would be better to 'delete' the third paragraph (because it's no longer true after this document) and fourth paragraph (because resolvers should not do that and if they did, it would just be wasted cycles) or replace them with a clarification.
use .example instead of .com?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.