DNSOP, Based on some discussions both in person at IETF 117 and on the list, we have updated some of the requirements language for caching resolution failures. We’ve also used an excerpt of Evan’s previous email to the list in the Implementation Status section of the document. It would be nice to have additional notes from other implementations (open source and proprietary), if possible.
OLD: Resolvers MUST cache resolution failures for at least 5 seconds. The value of 5 seconds is chosen as a reasonable amount of time that an end user could be expected to wait. Resolvers SHOULD employ an exponential backoff algorithm to increase the amount of time for subsequent resolution failures. For example, the initial time for negatively caching a resolution failure is set to 5 seconds. The time is doubled after each retry that results in another resolution failure. Consistent with [RFC2308], resolution failures MUST NOT be cached for longer than 5 minutes. NEW: Resolvers MUST cache resolution failures for at least 1 second. Resolvers MAY cache different types of resolution failures for different (i.e., longer) amounts of time. The minimum cache duration SHOULD be configurable by the operator. A longer cache duration for resolution failures will reduce the processing burden from repeated queries, but may also increase the time to recover from transitory issues. Resolvers SHOULD employ an exponential or linear backoff algorithm to increase the cache duration for persistent resolution failures. For example, the initial time for negatively caching a resolution failure might be set to 5 seconds, and increased after each retry that results in another resolution failure, up to a configurable maximum. Consistent with [RFC2308], resolution failures MUST NOT be cached for longer than 5 minutes. > On Jul 27, 2023, at 3:44 PM, internet-dra...@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. This Internet-Draft is a work item of the Domain Name System > Operations (DNSOP) WG of the IETF. > > Title : Negative Caching of DNS Resolution Failures > Authors : Duane Wessels > William Carroll > Matthew Thomas > Filename : draft-ietf-dnsop-caching-resolution-failures-06.txt > Pages : 18 > Date : 2023-07-27 > > Abstract: > In the DNS, resolvers employ caching to reduce both latency for end > users and load on authoritative name servers. The process of > resolution may result in one of three types of responses: (1) a > response containing the requested data; (2) a response indicating the > requested data does not exist; or (3) a non-response due to a > resolution failure in which the resolver does not receive any useful > information regarding the data's existence. This document concerns > itself only with the third type. > > RFC 2308 specifies requirements for DNS negative caching. There, > caching of type (1) and (2) responses is mandatory and caching of > type (3) responses is optional. This document updates RFC 2308 to > require negative caching for DNS resolution failures. > > RFC 4035 allows DNSSEC validation failure caching. This document > updates RFC 4035 to require caching for DNSSEC validation failures. > > RFC 4697 prohibits aggressive requerying for NS records at a failed > zone's parent zone. This document updates RFC 4697 to expand this > requirement to all query types and to all ancestor zones. > > The IETF datatracker status page for this Internet-Draft is: > https://secure-web.cisco.com/1LPtXLkDvbOCPxlDPD5CaqPhJ7pJBz5g4gpuyT27ndNKUQ3wwfnBWfT06g30XAy3DcfrXGxzwN7AOnwWFSUwO2p5fRIMROg3PmGMgm9koQ56YVb2nie1L3ddAM3hLdNhLDKeF9FwJoti8oUMc3pfK1WtEQrbGj1W5dJdeISiIdmzgoDHALFJPAubOwndXSSqG-LfcPrJEhosMik0RpL6DF8w66DrYysUMPO3HkV6coWXI-KHOjNIGzBGYu6pquvkNGpzdUORkeB-83KFpYsPFPS9HkJs6YSA3NKR21-LukxlO2n8VqysxtX3smdbrcsHW/https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-dnsop-caching-resolution-failures%2F > > There is also an htmlized version available at: > https://secure-web.cisco.com/1RuWnzxYtUSdl1039aW5onITseotw57Ca1Ta9aHPhFR16svfwpXkGztb-1bZ2bx1mTNVD2Vlp6WLRMZuCLjcvJNepxgZPQIVd8t34jnKOoyOjUKyzL1qVcOtWyZ1SIvMqpDSW6WvI5sCJ2mCOeFnAET87u0kmsyI40-VKlPmbseMjT02OYrcqBB_iY14PDHJ1CtDUjC1I-XoJLWNt-iLUEWqqvRgZNenndiIVT09hYTlWbYaBcXCdCynvFKRQrxnUTaf2npmSIoX0MljrxFllHZTvKi5XTQ7vtGCwt6MEelqaZL7W3xuMoEHI_iIjSjFz/https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-dnsop-caching-resolution-failures-06 > > A diff from the previous version is available at: > https://secure-web.cisco.com/1zOzWHtiSfeTZABShmm-FOPt7jMdOks2xLn6M72fF5fN-6TSB3IHfLp9xkbAHLLrwdyvI9fUYode9ztKJf0edoLLYOlMgBOHzL4fQIgFW3gNxLU6Tp0_XzhWJ1huEvO_ZZw-qIZBZifyTE9tfeb8P-tA-N8ieyXYvQA91uICJdRYLiS90Mhkf9oewkYTQ1hgPnLy6WSb7H6RlhXk8oYybF_0cT5a5emsbd6oDeIeD1SYcozprT3R5BBpFLwcDW1Pm0NRWRvCiONexqFdYKjR9pFCSUbVdLrlcodNK6a6AGGJ9SUwOby3I2He0Y-S3Aipv/https%3A%2F%2Fauthor-tools.ietf.org%2Fiddiff%3Furl2%3Ddraft-ietf-dnsop-caching-resolution-failures-06 > > Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://secure-web.cisco.com/1gcQcKISR3cXSkoS7Udzkx0RWRyekrGknSPDiFYbveEkkjKjxak5H-ssdo3rKHq-qWlOM61WLkFiajt69KNNaqduM8Iah3DW4onlWxo3pLrHdwaYB56wfdPjBhvKzWe-J_uIM1Uwc7k7CImqQr8NMPVwnH76f--ZgYmsNqk-ML6DLSNAmWNjH7ChDFfLjZ4dNztHWENqnmLy-Kb861VvNrmpG0IBex-B_RjcR0YftwqFFcQfbM9cd6IvCTQUbxinsj3vPt_j6ct1g-eWMWad0VDn6mPgHVZ7sJyVJSKJDo4EtYkfuoUi4HKDf_m2yqif6/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdnsop > _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
