upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-24 00:29:58 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

NXDOMAIN TTL considerations.

Browse source 
git-svn-id: file:///svn/unbound/trunk@1591 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2009-04-06 14:36:42 +00:00
parent 1e1ac9900a
commit 3ee3492095
2 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
doc/Changelog
View file

@ -12,6 +12,7 @@
libunbound/python/examples) are not installed. libunbound/python/examples) are not installed.
- python invalidate routine respects packed rrset ids and locks. - python invalidate routine respects packed rrset ids and locks.
- clock skew checks in unbound, config statements. - clock skew checks in unbound, config statements.
- nxdomain ttl considerations in requirements.txt
3 April 2009: Wouter 3 April 2009: Wouter
- Fixed a bug that caused messages to be stored in the cache too - Fixed a bug that caused messages to be stored in the cache too

14
doc/requirements.txt
View file

@ -243,3 +243,17 @@ o 0x20 backoff.
They are sent to a random server, but no one address more than 4 times. They are sent to a random server, but no one address more than 4 times.
It succeeds if one has 0x20 intact, or else all are equal. It succeeds if one has 0x20 intact, or else all are equal.
Otherwise, servfail is returned to the client. Otherwise, servfail is returned to the client.
o NXDOMAIN and SOA serial numbers.
Unbound keeps TTL values for message formats, and thus rcodes, such
as NXDOMAIN. Also it keeps the latest rrsets in the rrset cache.
So it will faithfully negative cache for the exact TTL as originally
specified for an NXDOMAIN message, but send a newer SOA record if
this has been found in the mean time. In point, this could lead to a
negative cached NXDOMAIN reply with a SOA RR where the serial number
indicates a zone version where this domain is not any longer NXDOMAIN.
These situations become consistent once the original TTL expires.
If the domain is DNSSEC signed, by the way, then NSEC records are
updated more carefully. If one of the NSEC records in an NXDOMAIN is
updated from another query, the NXDOMAIN is dropped from the cache,
and queried for again, so that its proof can be checked again.