Subject: negative caching support

From: bert hubert <[email-masked]>
Date: Thu, 3 Oct 2002 13:15:12 +0200

Hi,

RFC 1034 mentions the following about negative response caching:

 The method is that a name server may add an SOA RR to the additional
 section of a response when that response is authoritative.  The SOA must
 be that of the zone which was the source of the authoritative data in
 the answer section, or name error if applicable.  The MINIMUM field of
 the SOA controls the length of time that the negative result may be
 cached.

However, bind 8 and 9 add the SOA RR to the authority section.

In the interest of interoperability, what do you suggest an authoritive DNS
implementation should do? Follow the RFC or bind?

Regards,

bert hubert
PowerDNS

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Thu, 03 Oct 2002 13:49:28 +0200

> implementation should do? Follow the RFC or bind?

Follow both. RFC 1034 was updated by RFC 2308.

-Peter

---

From: Chris Thompson <[email-masked]>
Date: Thu, 3 Oct 2002 13:02:16 +0100 (BST)

> However, bind 8 and 9 add the SOA RR to the authority section.

RFC 1034 section 4.3.4, which you quote, is *explicitly* obsoleted by RFC 2308.

> implementation should do? Follow the RFC or bind?

If anyone seriously imagines they can create a new DNS server implementation 
by looking only at RFC 1034-5, and not bothering about all those tedious
updating RFCs until later (if at all), they are out of their tiny minds! 

Chris Thompson
Email: [email-masked]

---

From: bert hubert <[email-masked]>
Date: Thu, 3 Oct 2002 14:27:04 +0200

> updating RFCs until later (if at all), they are out of their tiny minds! 

Your needlessly abusive candour is appreciated. We did in fact search newer
rfcs but not thoroughly enough.

Thanks.

Regards,

bert hubert

---

From: Don Moore <[email-masked]>
Date: Thu, 3 Oct 2002 13:09:19 -0500

Chris,

> If anyone seriously imagines they can create a new DNS server
> implementation by looking only at RFC 1034-5, and not bothering about
> all those tedious updating RFCs until later (if at all), they are out
> of their tiny minds! 

What a constructive comment!  Unfortunately, some of us are busy
writing new DNS server implementations, instead of putting down the
same.  How proud you must be to have committed to memory the (if the
BIND9 "doc" directory is any indication) 65 working drafts and 65 RFC's
pertinent to DNS.  You can help actual implementors by being our doc
boy!

Bert,

> In the interest of interoperability, what do you suggest an
> authoritive DNS implementation should do? Follow the RFC or bind?

I pretty much always try to match BIND's behavior, mostly due to
the number of registries worldwide that depend on server behavior to
exactly mimic BIND.  I think there are at least a few that will refuse
to register a domain if the authoritative server does not return a SOA
RR in the Authority.  IIRC, .nl is a good example.

-- Don (http://mydns.bboy.net/)

-- 
     "I never knew words could be so confusing," Milo said to Tock
as he bent down to scratch the dog's ear.
     "Only when you use a lot to say a little," answered Tock.
                             -- Norton Juster, _The Phantom Tollbooth_

---

From: bert hubert <[email-masked]>
Date: Thu, 3 Oct 2002 20:53:48 +0200

> RR in the Authority.  IIRC, .nl is a good example.

.nl does not check that. They do however block registrations for SOA
hostmasters with a '.' in the local-part...

We updated pdns today (at 11AM EST) to include the SOA according to the RFC
Chris mentioned and we think we notice a marked drop in query load:
http://mrtg-us.powerdns.com

So this appears to be a good idea. Sadly, DENIC for example demands a 40.000
second SOA minimum which is a bit much for negative caching.

Regards,

bert hubert

---

From: Jim Reid <[email-masked]>
Date: Thu, 03 Oct 2002 17:57:01 -0700

>>>>> "bert" == bert hubert <[email-masked]> writes:

    bert> So this appears to be a good idea. Sadly, DENIC for example
    bert> demands a 40.000 second SOA minimum which is a bit much for
    bert> negative caching.

Why? Long TTLs are a very good thing IMO, even for negative answers.
Large TTLs should only present a problem when people don't plan and
co-ordinate their DNS changes very well. For instance, by dropping the
TTL on a server a decent interval before the box gets renumbered.

And anyway, what's stopping someone changing their SOA values after
DENIC has done their pre-registration check and delegated the zone?

---

From: Peter Koch <[email-masked]>
Date: Fri, 04 Oct 2002 10:30:57 +0200

> Why? Long TTLs are a very good thing IMO, even for negative answers.

while there have been different statements even for the effectiveness of
positive caching in the past, the gain of negative caching lies within
shorter time frames. It helps with 'insisting' resolvers and applications
(at least that's what I've seen on a server with lots of IN-ADDR.ARPA
zones).

> TTL on a server a decent interval before the box gets renumbered.

Sure, but you can't decrease the TTL on particular negative answers in
advance.

> DENIC has done their pre-registration check and delegated the zone?

Nothing, unfortunately.

-Peter