Browse Prior Art Database

Aggressive Use of DNSSEC-Validated Cache (RFC8198)

IP.com Disclosure Number: IPCOM000250503D
Original Publication Date: 2017-Jul-01
Included in the Prior Art Database: 2017-Jul-26
Document File: 26 page(s) / 28K

Publishing Venue

Internet Society Requests For Comment (RFCs)

Related People

K. Fujiwara: AUTHOR [+3]

Abstract

A DNS negative cache exists, and is used to cache the fact that an RRset does not exist. This method of negative caching requires exact matching; this leads to unnecessary additional lookups, increases latency, leads to extra resource utilization on both authoritative and recursive servers, and decreases privacy by leaking queries.

This text was extracted from an ASCII text file.
This is the abbreviated version, containing approximately 10% of the total text.

Internet Engineering Task Force (IETF)                       K. Fujiwara Request for Comments: 8198                                          JPRS Updates: 4035                                                    A. Kato Category: Standards Track                                      Keio/WIDE ISSN: 2070-1721                                                W. Kumari                                                                   Google                                                                July 2017

                 Aggressive Use of DNSSEC-Validated Cache

Abstract

   The DNS relies upon caching to scale; however, the cache lookup    generally requires an exact match.  This document specifies the use    of NSEC/NSEC3 resource records to allow DNSSEC-validating resolvers    to generate negative answers within a range and positive answers from    wildcards.  This increases performance, decreases latency, decreases    resource utilization on both authoritative and recursive servers, and    increases privacy.  Also, it may help increase resilience to certain    DoS attacks in some circumstances.

   This document updates RFC 4035 by allowing validating resolvers to    generate negative answers based upon NSEC/NSEC3 records and positive    answers in the presence of wildcards.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force    (IETF).  It represents the consensus of the IETF community.  It has    received public review and has been approved for publication by the    Internet Engineering Steering Group (IESG).  Further information on    Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,    and how to provide feedback on it may be obtained at    http://www.rfc-editor.org/info/rfc8198.

 Fujiwara, et al.             Standards Track                    [Page 1]
 RFC 8198                    NSEC/NSEC3 Usage                   July 2017

 Copyright Notice

   Copyright (c) 2017 IETF Trust and the persons identified as the    document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal    Provisions Relating to IETF Documents    (http://trustee.ietf.org/license-info) in effect on the date of    publication of this document.  Please review these documents    carefully, as they describe your rights and restrictions with respect    to this document.  Code Comp...