On Monday, 8 July 2019 18:02:32 UTC Michael J. Sheldon wrote: > On 7/8/19 10:56 AM, Paul Vixie wrote: > > i've always sent back SERVFAIL when the zone isn't loaded, on either a > > primary or secondary (authoritative, that is) server. and i cache > > SERVFAIL on the recursive/iterative side with a holddown timer equal to > > the negative TTL interval (SOA.MINIMUM). > > > > but i didn't realize that the standard doesn't say to do this, until i > > read > > the above. > > > > -- > > Paul > > BIND returns REFUSED, so that's what I've always used, for maximum > consistency/compatibility.
REFUSED means, in my reading (and coding) that there is no zone declaration at the authority. SERVFAIL means the zone is declared/configured, but not loaded. i now realize that both have to have a holddown timer, not just SERVFAIL. > What SOA.minimum are you returning? Which SOA? And on what record would > it be returned? The issue is that there is no matching zone. closest enclosing zone, on the assumption that the authority who sent me the SERVFAIL (or REFUSED) may be an ancestor of the missing or not-loaded zone. if this means the SOA.MINIMUM of the root priming metadata, then so be it. this timing information isn't returned with the SERVFAIL or REFUSED -- as you say, those don't have records, so there's noplace to put a negative TTL. however, my negative cache has a holddown timer for SERVFAIL, just to suppress query storms. i think i need to add one for REFUSED. the idea of a holddown timer is, within that interval, you assume that the error is still present, and so the iterator just does what it would do if it asked the same question and got the same answer. -- Paul _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
