Subject: [BEHAVE] [DNS64] TTL of synthetic AAAA records in presence of NSEC

From: Simon Perreault <[email-masked]>
Date: Thu, 07 May 2009 13:30:17 -0400

Hello,

In [draft-bagnulo-behave-dns64-02], Section 3.1, there is the following text:

>    A synthetic AAAA record is created from an A record as follows:
> [...]
>    o  The TTL field is set to the TTL of the original A RR

If an NSEC record was returned in the original AAAA query, then wouldn't it be
more appropriate to use that record's TTL value instead? The synthetic AAAA
record is valid as long as no non-synthetic AAAA record is created. The NSEC's
TTL is exactly the time we are allowed to remember that no non-synthetic AAAA
record exists.

Thanks,
Simon
-- 
STUN/TURN server    --> http://numb.viagenie.ca
Interplanetary news --> http://reeves.viagenie.ca
vCard 4.0           --> http://www.vcarddav.org

---

From: Dave Thaler <[email-masked]>
Date: Thu, 7 May 2009 12:08:42 -0700

I'd say it should really be the minimum of the two.

-Dave

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Simon Perreault
> Sent: Thursday, May 07, 2009 10:30 AM
> To: BEHAVE WG
> Subject: [BEHAVE] [DNS64] TTL of synthetic AAAA records in presence of
> NSEC
> 
> Hello,
> 
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave

---

From: Simon Perreault <[email-masked]>
Date: Thu, 07 May 2009 15:11:35 -0400

> I'd say it should really be the minimum of the two.

Right, thanks for the precision.

Simon

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 7 May 2009 15:45:26 -0400

> TTL is exactly the time we are allowed to remember that no non-synthetic AAAA

On these grounds, the synthetic AAAA's TTL should be the SOA minimum
TTL field, in the spirit of negative caching, no?  I'm not opposed to
it, but it will mean more queries and synthesis.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Mark Andrews <[email-masked]>
Date: Fri, 08 May 2009 10:04:06 +1000

> it, but it will mean more queries and synthesis.

	No.  It should be the minimum of the TTL of the A record
	and the minimum of the TTL of the SOA record indicating
	that there is no AAAA record.  These are the TTL's of the
	two inputs in the decision to create the synthetic AAAA
	record.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Simon Perreault <[email-masked]>
Date: Fri, 08 May 2009 08:05:01 -0400

> 	two inputs in the decision to create the synthetic AAAA

Could you explain why the NSEC record is not considered in your proposal?

Thanks,
Simon

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 8 May 2009 11:55:46 -0400

> 	two inputs in the decision to create the synthetic AAAA

I don't understand why the SOA TTL itself enters into it.  The
justification for the SOA Minimum TTL field is made in RFC 4034:

   The NSEC RR SHOULD have the same TTL value as the SOA minimum TTL
   field.  This is in the spirit of negative caching ([RFC2308]).

It seems to me that if we're going to do anything other than just
re-use the TTL on the A record, we should consider (as was suggested)
the minimum time we're supposed to assume that there couldn't be a
AAAA.  That's the time defined by RFC 2308, no?

A
-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Mark Andrews <[email-masked]>
Date: Sat, 09 May 2009 09:47:42 +1000

> AAAA.  That's the time defined by RFC 2308, no?

	The SOA record's TTL in the negative response should also
	start out with the SOA minimum.  The SOA's record's TTL is
	that which defines the time to live of a negative response
	(RFC 2308).  The TTL of NXT/NSEC/NSEC3 records in the
	negative response should be consistent with the TTL of the
	SOA record in the negative response.

	Using the SOA record works independent of whether the zone
	is signed or not.

	Mark

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 9 May 2009 10:36:20 -0400

On Sat, May 09, 2009 at 09:47:42AM +1000, Mark Andrews wrote:
> 	start out with the SOA minimum.  

Oh, duh, I see what you mean.  Since the negative response's SOA
record's TTL is actually equivalent to the SOA minimum TTL, then you
can use the SOA TTL as the basis.  This is nice because then you don't
have to grovel through the SOA fields to figure out what you need.

So what you're suggesting is that the DNS64 remember the TTL from the
SOA record in the negative response to the AAAA query.  Then when it
gets the positive answer to the A query, it sets the TTL on the
synthesized AAAA to be min(TTL of SOA in first answer,TTL of A in
second answer).  Right?  This way the NSEC record doesn't matter,
because its TTL ought to be exactly the same as the SOA minimum field
anyway.  

This seems right to me.

A 

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Matthijs Mekking <[email-masked]>
Date: Sat, 09 May 2009 16:52:32 +0200

My first thought was that you could simply copy the TTL from the A
record to the synthesized AAAA record, like the (new) DNAME draft does.

However, now I get that it is different than the CNAME from DNAME
synthesis, since this is happening at the server side, while with NAT64,
AAAA records are generated at the DNS64 resolver. So the TTL of the
synthezised AAAA records should reflect negative caching.

Still, I would like to see this clarification in the document, instead
of solely the statement: The TTL of synthesized AAAA records is the
minimum of the TTL of the SOA and the TTL of the A record.

Matthijs