Subject: Re: protocol-06 section 4.5 - breaking the problem into chunks

From: Kevin Darcy <[email-masked]>
Date: Wed, 02 Jun 2004 23:11:11 -0400

Paul Vixie wrote:

>>... That a user of a cache might have to wait the minimum TTL (or NSEC
>>TTL) in order to see a change to a zone is undesirable, ...
>>    
>>
>
>Now that we have the ability to sign the SOA, it could be that we should
>be including the SOA in every response, so that middleboxes can do a cache
>purge (or not, befitting local policy) whenever the SOA.SERIAL moves up.
>
Could this "mandatory" SOA not serve double-duty as the "complementary 
negative caching record" I proposed in 
http://ops.ietf.org/lists/namedroppers/namedroppers.2003/msg02197.html 
as a prerequisite for proper synthesis of QTYPE=* answers from cache?

                                                      - Kevin

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Robert Elz <[email-masked]>
Date: Thu, 03 Jun 2004 12:44:12 +0700

Date:        Wed, 02 Jun 2004 22:02:25 +0000
    From:        Paul Vixie <[email-masked]>
    Message-ID:  <[email-masked]>

  | Now that we have the ability to sign the SOA, it could be that we should
  | be including the SOA in every response, so that middleboxes can do a cache
  | purge (or not, befitting local policy) whenever the SOA.SERIAL moves up.

Please no, don't go anywhere near that.

The SOA is way too coarse for this - all it indicates is that some RR
in the zone has altered (or might have) - not that everything in the zone
has changed.

Using SOA that way would have the effect of defeating caching completely
for any zone that is frequently updated (like one using dynamic DNS).
If a zone wants to defeat caching, it already has that mechanism, it just
sets the TTL on everything to 0, and it is done.

Further, making a scheme like that in any way reliable, means having some
way to force the "middle box" do do a query to the auth nameserver, so it
can get that SOA in a response - if one assumes that it currently has cached
all it needs for its operations, noting is going to cause that extra query
of the auth servers in normal operations, until the TTLs expire anyway.

kre