Re: DNSSEXT Yokohama Minutes

[Paul Vixie <paul@vix.com>]

> The example I gave in Yokohama had not a match with any QNAME:
> 
> cached was:
> 
> a NXT e
> c NXT f
> 
> and the query is for d. Which proof of non-existence does a cache return.

it's starting to seem to me that answers containing NXT should include an
SOA in the authority section.  (even though that means nonauthoritative
servers will have to cache them, which today is illegal.)  when new secure
(verified) data arrives with a later SOA.SERIAL, all the older cached data
for that zone becomes invalid.

this is something we've discussed previously for all data, not just security
metagoo.  it has a high price both in storage, transport, and computation,
but not as high as dnssec overall, so i think it's finally worth considering.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>