Subject: [dnsext] DNSSEC Response caching

From: Sean Wells <[email-masked]>
Date: Sun, 31 Jul 2011 17:51:54 -0700

Hi,

In RFC 4035, section 4.5, Response Caching:

   A security-aware resolver SHOULD cache each response as a single
   atomic entry containing the entire answer, including the named RRset
   and any associated DNSSEC RRs.  The resolver SHOULD discard the
   entire atomic entry when any of the RRs contained in it expire.

DNSSEC  RRs here includes NSECs also. For example, when processing a
wildcard answer response, NSEC also should be taken into consideration when
determining the TTL of the "atomic" entry. In section 5.3.3, the discussion
about setting the TTL does not explicitly mention this case (or other cases
where the response contains NSEC). I guess this is just a trivial omission.
Can someone clarify ?

-regards
Sean
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext