Subject: Re: negative caching support

From: Peter Koch <[email-masked]>
Date: Thu, 03 Oct 2002 13:49:28 +0200

> In the interest of interoperability, what do you suggest an authoritive DNS
> implementation should do? Follow the RFC or bind?

Follow both. RFC 1034 was updated by RFC 2308.

-Peter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Chris Thompson <[email-masked]>
Date: Thu, 3 Oct 2002 13:02:16 +0100 (BST)

[email-masked] (bert hubert) writes:

> RFC 1034 mentions the following about negative response caching:
> 
>  The method is that a name server may add an SOA RR to the additional
>  section of a response when that response is authoritative.  The SOA must
>  be that of the zone which was the source of the authoritative data in
>  the answer section, or name error if applicable.  The MINIMUM field of
>  the SOA controls the length of time that the negative result may be
>  cached.
> 
> However, bind 8 and 9 add the SOA RR to the authority section.

RFC 1034 section 4.3.4, which you quote, is *explicitly* obsoleted by RFC 2308.

> implementation should do? Follow the RFC or bind?

If anyone seriously imagines they can create a new DNS server implementation 
by looking only at RFC 1034-5, and not bothering about all those tedious
updating RFCs until later (if at all), they are out of their tiny minds! 

Chris Thompson
Email: [email-masked]

---

From: bert hubert <[email-masked]>
Date: Thu, 3 Oct 2002 14:27:04 +0200

> updating RFCs until later (if at all), they are out of their tiny minds! 

Your needlessly abusive candour is appreciated. We did in fact search newer
rfcs but not thoroughly enough.

Thanks.

Regards,

bert hubert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

---

From: Don Moore <[email-masked]>
Date: Thu, 3 Oct 2002 13:09:19 -0500

Chris,

> If anyone seriously imagines they can create a new DNS server
> implementation by looking only at RFC 1034-5, and not bothering about
> all those tedious updating RFCs until later (if at all), they are out
> of their tiny minds! 

What a constructive comment!  Unfortunately, some of us are busy
writing new DNS server implementations, instead of putting down the
same.  How proud you must be to have committed to memory the (if the
BIND9 "doc" directory is any indication) 65 working drafts and 65 RFC's
pertinent to DNS.  You can help actual implementors by being our doc
boy!

Bert,

> In the interest of interoperability, what do you suggest an
> authoritive DNS implementation should do? Follow the RFC or bind?

I pretty much always try to match BIND's behavior, mostly due to
the number of registries worldwide that depend on server behavior to
exactly mimic BIND.  I think there are at least a few that will refuse
to register a domain if the authoritative server does not return a SOA
RR in the Authority.  IIRC, .nl is a good example.

-- Don (http://mydns.bboy.net/)

-- 
     "I never knew words could be so confusing," Milo said to Tock
as he bent down to scratch the dog's ear.
     "Only when you use a lot to say a little," answered Tock.
                             -- Norton Juster, _The Phantom Tollbooth_

---

From: bert hubert <[email-masked]>
Date: Thu, 3 Oct 2002 20:53:48 +0200

> RR in the Authority.  IIRC, .nl is a good example.

.nl does not check that. They do however block registrations for SOA
hostmasters with a '.' in the local-part...

We updated pdns today (at 11AM EST) to include the SOA according to the RFC
Chris mentioned and we think we notice a marked drop in query load:
http://mrtg-us.powerdns.com

So this appears to be a good idea. Sadly, DENIC for example demands a 40.000
second SOA minimum which is a bit much for negative caching.

Regards,

bert hubert