Subject: Re: I-D ACTION:draft-ietf-dnsext-rfc2672bis-dname-05.txt

From: Mark Andrews <[email-masked]>
Date: Tue, 02 Oct 2007 15:11:15 +1000

What "old resolvers" are we protecting by forcing the TTL
	to 0 rather than having the TTL match the DNAME's TTL?

	Additionally this is inconsistant with the rest of the
	draft.

	A CNAME RR record, with TTL matching that of the DNAME, is
	synthesized for old resolvers, specifically for the QNAME
	in the query.

	Mark

   On the server side, the DNAME RR record is always included in the
   answer section of a query.  A CNAME RR record with TTL 0 is
   synthesized for old resolvers, specifically for the QNAME in the
   query.  DNSSEC [RFC4033], [RFC4034], [RFC4035] says that the
   synthesized CNAME does not have to be signed.  The DNAME has an RRSIG
   and a validating resolver can check the CNAME against the DNAME
   record and validate the DNAME record.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Wed, 3 Oct 2007 07:06:56 -0400

> 	to 0 rather than having the TTL match the DNAME's TTL?

No reason, I admit.  We thought we had to choose something consistant. I've
noticed servers doing either TTL=0 or TTL=CNAME TTL

> 	synthesized for old resolvers, specifically for the QNAME

We really just kept that because it was in the old draft and there wasn't
enough strong desire to change it.

Scott

---

From: Mark Andrews <[email-masked]>
Date: Thu, 04 Oct 2007 09:49:17 +1000

> enough strong desire to change it.

	For serious use of DNAME, i.e. in the root zone, you need
	a longer ttl than zero.  Zero is a good way to inflict a
	DoS on yourself.

	Mark

---

From: Edward Lewis <[email-masked]>
Date: Thu, 4 Oct 2007 08:16:02 -0400

>>  noticed servers doing either TTL=0 or TTL=CNAME TTL

I noticed this issue too when I read the draft but didn't give it much thought.

Use the latter (=CNAME's TTL).  TTL's of 0 have proven to be 
problems, and with DNSSEC, short TTLS (less than a 1-5 minutes) have 
been demonstrated to be problem causers.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Think glocally.  Act confused.