News for hackers. Stuff that matters.

A comment on Review of the .nz DNSSEC Chain Validation Incident on 29-30 May 2023 [pdf].

Re:Review of the .nz DNSSEC Chain Validation Incident on 29-... by mjl- on Monday October 09, 2023 @03:15AM (#37817851)
Does anyone know if DNSSEC-validating recursive resolvers will retry (fetch new records) if their cached DNSSEC-related records (e.g. DS) are a certain age and they are seeing a validating error?

If they would, problems could autocorrect faster (than waiting out a TTL of 1 day). It could cause higher load on name servers, but at first glance it seems like a reasonable trade off.

[ Parent | on HN ]
Re:Review of the .nz DNSSEC Chain Validation Incident on 29-... by comex on Monday October 09, 2023 @03:56AM (#37818068)
Page 50 of the report says that some (unnamed) resolvers do this, and “we think this [..] is a very good implementation feature to reduce the impact of mistakes”, but that it’s “definitely not universally implemented”.
[ Parent | on HN ]
Re:Review of the .nz DNSSEC Chain Validation Incident on 29-... by mcesch on Monday October 09, 2023 @04:04AM (#37818116)
It's implementation dependent. If I recall correctly unbound defaults to caching bogus responses for 60 seconds and BIND for 30 seconds.
[ Parent | on HN ]