Aggressive Use of DNSSEC-Validated Cache (RFC8198)
Original Publication Date: 2017-Jul-01
Included in the Prior Art Database: 2017-Jul-26
Internet Society Requests For Comment (RFCs)
K. Fujiwara: AUTHOR [+3]
A DNS negative cache exists, and is used to cache the fact that an RRset does not exist. This method of negative caching requires exact matching; this leads to unnecessary additional lookups, increases latency, leads to extra resource utilization on both authoritative and recursive servers, and decreases privacy by leaking queries.
Internet Engineering Task Force (IETF) K. Fujiwara Request for Comments: 8198 JPRS Updates: 4035 A. Kato Category: Standards Track Keio/WIDE ISSN: 2070-1721 W. Kumari Google July 2017
Aggressive Use of DNSSEC-Validated Cache
The DNS relies upon caching to scale; however, the cache lookup generally requires an exact match. This document specifies the use of NSEC/NSEC3 resource records to allow DNSSEC-validating resolvers to generate negative answers within a range and positive answers from wildcards. This increases performance, decreases latency, decreases resource utilization on both authoritative and recursive servers, and increases privacy. Also, it may help increase resilience to certain DoS attacks in some circumstances.
This document updates RFC 4035 by allowing validating resolvers to generate negative answers based upon NSEC/NSEC3 records and positive answers in the presence of wildcards.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc8198.
Fujiwara, et al. Standards Track [Page 1]
RFC 8198 NSEC/NSEC3 Usage July 2017
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Comp...