Subject: [DNSOP] Roll Over and Die ?

From: "George Barwood" <[email-masked]>
Date: Thu, 18 Feb 2010 12:36:08 -0000

Any reaction to this CircleID article ?

http://www.circleid.com/posts/dns_resolvers_and_dnssec_roll_over_and_die/    

It seems that BIND and Unbound can

 "enter a mode of sustained, repeated and very rapid querying of DNS servers for DNSKEY and RRSIG Resource records, causing potential problems for both DNS servers and resolvers."

when configured with out of date trust anchors.

It seems to me that caching is required when data fails to validate, to avoid possible operational problems.

I had assumed that the validation component of a validating resolver would be independent of the cache.

Is there a mis-conceived attempt to prevent DoS attacks here?

George

---

From: Tony Finch <[email-masked]>
Date: Thu, 18 Feb 2010 13:35:59 +0000

> http://www.circleid.com/posts/dns_resolvers_and_dnssec_roll_over_and_die/

https://www.isc.org/announcement/response-to-concerns10Feb
http://unbound.net/pipermail/unbound-users/2010-February/001031.html

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.