Re: [Opendnssec-user] timings and ttl

2013-09-23 Thread Jakob Schlyter
On 23 sep 2013, at 08:16, Jakob Schlyter wrote: >> Validating resolvers will drop an RRSIG from a cache and re-fetch if the >> local clock has ticked past the expiration timer specified in the >> corresponding RRSIG RDATA field. > > I would not "might drop", not "will drop". The specification

Re: [Opendnssec-user] timings and ttl

2013-09-23 Thread John Dickinson
On 19 Sep 2013, at 17:32, Joe Abley wrote: > > On 2013-09-19, at 12:20, Mathieu Arnold wrote: > >> I was just wondering about the TTL of RRSIGs, say I have my ZSK rollover >> set for every 30 days, if I add a record with a 10 weeks TTL, (yes, that's >> a bit stupid, but, for the sake of the a

Re: [Opendnssec-user] timings and ttl

2013-09-22 Thread Jakob Schlyter
On 19 sep 2013, at 19:32, Joe Abley wrote: > Validating resolvers will drop an RRSIG from a cache and re-fetch if the > local clock has ticked past the expiration timer specified in the > corresponding RRSIG RDATA field. I would not "might drop", not "will drop". The specification is not stric

[Opendnssec-user] timings and ttl

2013-09-19 Thread Mathieu Arnold
Hi, I was just wondering about the TTL of RRSIGs, say I have my ZSK rollover set for every 30 days, if I add a record with a 10 weeks TTL, (yes, that's a bit stupid, but, for the sake of the argument,) its RRSIG will also have a 10 weeks TTL, and will still be alive in a cache somewhere long after

Re: [Opendnssec-user] timings and ttl

2013-09-19 Thread Joe Abley
On 2013-09-19, at 12:20, Mathieu Arnold wrote: > I was just wondering about the TTL of RRSIGs, say I have my ZSK rollover > set for every 30 days, if I add a record with a 10 weeks TTL, (yes, that's > a bit stupid, but, for the sake of the argument,) its RRSIG will also have > a 10 weeks TTL, an