Subject: SOA records in negative responses

From: Roy Arends <[email-masked]>
Date: Mon, 15 May 2006 16:22:10 +0100

Hi,

Negative responses may have SOA records included so the cache has an 
indication for the time it should cache a negative response.

With DNSSEC, all negative responses have NSEC records with its own TTL. 
Therefor, I don't think it is useful to include SOA record and 
signature(s), saving a little more space, and reducing the amplification 
vector a bit.

I've heard arguments in private discussions that a cache would want the 
SOA record anyway in order to include it in non-dnssec negative responses 
to RD=1 requests. However, this is not required, since a resolver could 
easily return rfc2308 name-error response type 3 or 4 (or nodata response 
type 3).

Is this worth discussing ?

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>