Subject: [DNSOP] query regarding DNS Cache in resolver.

From: "venkatesh.bs" <[email-masked]>
Date: Tue, 28 Jul 2009 07:36:57 +0530

Hi all,
    I have one query regarding DNS cache maintaince in dns resolver, 
Whether DNS Cache should be based on per server address or based on FQDN 
only.

1. Query1: Domain name: "google.com" DNS IP: DNS_SERVER_1 - result will 
be stored in DNS Cache
Meanwhile,DNS Server IP got changed.
2. Query2: Domain name: "google.com" DNS IP: DNS_SERVER_2 - Should we 
have to query to DNS Server 2? or Should we have to get it from DNS Cache?

Thanks in Advance.

Best Regards,
Venkatesh.

---

From: Olafur Gudmundsson <[email-masked]>
Date: Mon, 27 Jul 2009 10:37:47 -0400

At 00:56 27/07/2009, venkatesh.bs wrote:
>Hi all,
>     I have one query regarding DNS cache maintaince in dns 
> resolver, Whether DNS Cache should be based on per server address 
> or based on FQDN only.

DNS caches MUST cache by the holy DNS Trinity:
         Query Name, Query Type, Query Class
DNSSEC aware caches the cache should remember the setting of the
DO bit in the answer.
There is no need to remember where the answer came from.

If a new query matches what is in the cache then it can be reused.

         Olafur

>1. Query1: Domain name: "google.com" DNS IP: DNS_SERVER_1 - result 
>will be stored in DNS Cache
>2. Query2: Domain name: "google.com" DNS IP: DNS_SERVER_2 - Should 
>we have to query to DNS Server 2? or Should we have to get it from DNS Cache?
>
>
>Thanks in Advance.
>
>Best Regards,
>Venkatesh.
>_______________________________________________
>DNSOP mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dnsop

---

From: David Blacka <[email-masked]>
Date: Mon, 27 Jul 2009 11:20:18 -0400

On Jul 27, 2009, at 10:37 AM, Olafur Gudmundsson wrote:

>> Whether DNS Cache should be based on per server address or based on  
>> FQDN only.
>

> DNSSEC aware caches the cache should remember the setting of the

The what?  What makes you think that the DO bit in the *answer* means  
anything?

 From dnssec-bis-updates, section 4.5:
    To be clear, in replies to queries with the DO-bit set servers may  
or may not set the DO bit.
DNSSEC-aware caches do need to retain whether or not a particular  
cache entry was an answer to a DO=1 *query*.  In practice they do this  
by setting DO=1 on all queries.

--
David Blacka                          <[email-masked]>
Sr. Engineer          VeriSign Platform Product Development

---

From: "venkatesh.bs" <[email-masked]>
Date: Tue, 28 Jul 2009 08:42:03 +0530

Thanks olufur,

Is anywhere in RFC they have mentioned about DNS cache can be based on 
FQDN, QUERY TYPE (we are ignoring the class as it is always INTERNET(IN)).

Thanks & Regards,
venkatesh.

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Jul 2009 11:30:50 -0400

> DNSSEC aware caches the cache should remember the setting of the

Did you mean the AD bit? 

In any case, I assume what you're trying to capture is that you need
to know whether the cache may possibly have the RRSIG in the cache
too, so that you don't accidentally get an RRSIG that does not in fact
cover the RRSet in your cache when using that cached RRSet (were you
to do that).  Right?

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: [email-masked]
Date: Tue, 28 Jul 2009 04:41:53 +0000

class is not always IN.

--bill

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 28 Jul 2009 10:27:39 +0200

On Tue, Jul 28, 2009 at 08:42:03AM +0530,
 venkatesh.bs <[email-masked]> wrote 
 a message of 49 lines which said:

> Is anywhere in RFC they have mentioned about DNS cache can be based
> on FQDN, QUERY TYPE

RFC 1034, sections 3.7.1, 4.3.1 and 4.3.2.

> (we are ignoring the class as it is always INTERNET(IN)).

Very Bad Idea

---

From: <[email-masked]>
Date: Tue, 28 Jul 2009 22:14:53 +0200

Hi,

Unless there is the unholy(?) split-DNS deployment.

In split-DNS situation some of the information returned by DNS may differ between different administrative domains, and it is thus risky to retain DNS cache (of stub resolver - if that makes difference?) during host movement from one network to another, or if running in multi-homed scenario where different network interfaces are towards different administrative domains (which provide some private or conflicting information).

This week in MIF WG meeting I talked about this in relation to draft-savolainen-mif-dns-server-selection, http://www3.ietf.org/proceedings/75/slides/mif-4.ppt

It would be nice to receive feedback for the problem from dnsop as well (has been in my plans, but never made it this far before).

Best regards,

	Teemu

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] 
>On Behalf Of ext Olafur Gudmundsson
>Sent: 27 July, 2009 16:38
>To: venkatesh.bs; [email-masked]
>Subject: Re: [DNSOP] query regarding DNS Cache in resolver.
>
>resolver, 
>         Query Name, Query Type, Query Class DNSSEC aware 
>caches the cache should remember the setting of the DO bit in 
>the answer.
>>be stored in DNS Cache Meanwhile,DNS Server IP got changed.