Subject: [DNSOP] Do negative cache entries have to be consistent ?

From: "John Levine" <[email-masked]>
Date: 13 Apr 2011 18:04:31 -0000

Some friends of mine who run DNSBLs have this idea to manage the
traffic to their servers: some parts of the IP address space are more
likely to get infected than others, so when they send back a NXDOMAIN
response, they want to adjust the TTL so that addreses that are
unlikely to get listed have a longer TTL and addresses that are more
likely to become listed have a shorter TTL.

Since the TTL on a negative cache entry comes from the TTL on the SOA
returned with the NXDOMAIN, this means that they'll be returning SOAs
with different TTLs on different responses.  This strikes me as
something that's not technically illegal, but that people who write
DNS caches didn't anticipate.  Is it likely to break anything?

Bonus question: with DNSSEC, a cache can use NSEC info to synthesize
NXDOMAIN responses for nearby addresses.  Will inconsistent TTLs break
anything then?

If you think this is a stupid idea, please say why.  Traffic to DNSBL
servers is significant, and traces suggest this will noticably
decrease the traffic, so unless it breaks something, it's useful.
They realize that there is some possibility of stale data, but that's
a given whenever a TTL is greater than zero.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

PS: If you were planning to say that all DNSBLs stink, don't.  We know
they do, but the alternative stinks worse.

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 13 Apr 2011 14:17:37 -0400

> DNS caches didn't anticipate.  Is it likely to break anything?

Strictly, the TTL on a negative cache entry comes from the minimum of
the TTL of the SOA and the SOA.MINIMUM subfield.  So the strategy
won't work if the latter is too low.  I'll ignore that and just assume
you're dealing with it.

In principle, a cache will need to be able to cope with the
possibility that the TTL will change on a record in between times the
cache looked.  That's for two reasons: the authoritative server's
records could change, or there could be a cache in between.

It strikes me that a cache might not actually overwrite its negative
cache for a zone if it already has a negative TTL longer than the one
it gets in a given answer, on the grounds that having been given the
longer TTL before it is permitted to continue using that.  So I think
you'll probably need to test widely in order to learn whether your
strategy will actually work in practice.

> NXDOMAIN responses for nearby addresses.  Will inconsistent TTLs break

I think you'd have to ask implementers of such synthesizing caches.
But I can't see how.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: "George Barwood" <[email-masked]>
Date: Wed, 13 Apr 2011 20:43:56 +0100

----- Original Message ----- 
From: "John Levine" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, April 13, 2011 7:04 PM
Subject: [DNSOP] Do negative cache entries have to be consistent ?

> DNS caches didn't anticipate.  Is it likely to break anything?

It should be fine with modern caches. The way caches are meant to work according to the
DNSSEC standard is that the complete response is cached as single atomic entry,
complete with any asociated SOA/NSEC records.

http://tools.ietf.org/html/rfc4035#section-4.5

The TTL is derived from the SOA minimun and the lowest TTL in the RRsets sent.
So this behavior is not at all unanticipated I think.

> NXDOMAIN responses for nearby addresses.  Will inconsistent TTLs break

Not at present. However there are suggestions that if a parent NXDOMAIN is found,
it could imply that all the responses descended form that could be assumed to be NXDOMAIN.
This is not yet part of the standard though, and in fact old authoritative nameservers sometimes
return NXDOMAIN even when there are children, so in practice it ths will probably have
to be restricted to DNSSEC.

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: "John R Levine" <[email-masked]>
Date: 13 Apr 2011 16:11:20 -0400

> complete with any asociated SOA/NSEC records.

Tnx.

> This is not yet part of the standard though, and in fact old 
> authoritative nameservers sometimes return NXDOMAIN even when there are 
> children, so in practice it ths will probably have to be restricted to 
> DNSSEC.

Oh, I know.  I'm trying to figure out how to fix rbldnsd.

R's,
John

---

From: Florian Weimer <[email-masked]>
Date: Thu, 14 Apr 2011 07:00:41 +0000

> NXDOMAIN responses for nearby addresses.  Will inconsistent TTLs break

You can avoid both issues by introducing sub-zones for the network
ranges which should receive longer TTLs.

In the non-DNSSEC case, you can simply return a SOA record whose owner
name is the full QNAME.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99