Negative Caching of DNS Resolution Failures
draft-ietf-dnsop-caching-resolution-failures-08

# Éric Vyncke, INT AD, comments for draft-ietf-dnsop-caching-resolution-failures-07

Thank you for the work put into this document. It should indeed be VERY useful !

Please find belowsome non-blocking COMMENT points (but replies would be appreciated even if only for my own education).

Special thanks to Andrew McConachie for the shepherd's write-up *but it lacks* the justification of the intended status. 

Other thanks to Carlos Pignataro , the Internet directorate reviewer, please consider this int-dir review:
https://datatracker.ietf.org/doc/review-ietf-dnsop-caching-resolution-failures-07-intdir-telechat-pignataro-2023-09-06/ (I have read Duane's reply, thanks)

Other thanks to Peter van Dijk, the DNS directorate reviewer, please consider this dns-dir review (as a follow-up of his Last Call review):
https://datatracker.ietf.org/doc/review-ietf-dnsop-caching-resolution-failures-07-dnsdir-telechat-van-dijk-2023-09-04/

I hope that this review helps to improve the document,

Regards,

-éric

# COMMENTS

## Abstract

`RFC 2308 specifies requirements for DNS negative caching` should this statement only apply to (2) responses and not (1) responses (as this would be positive caching) ?

## Section 2.2 (and other places)

Is there a reason why EXAMPLE.COM is in uppercase in the text ? This is really unusual.

Please follow RFC 5952 and write IPv6 address is lower case (BTW thanks for using modern addressing)

Thanks for this document and my apologies for being involved/related to two
of the five outages you described :-)


        Consistent with [RFC2308], resolution failures MUST NOT be cached
        for longer than 5 minutes.

If an expired RRSIG has a TTL of 3600, what should happen? The resolution
failed because the signature is no longer valid but the individual
components of this validation failure are all successful lookups of RRs that
are now in the cache.  Wouldn't this result in a resolution failure of
3600? How would an implementation limit this to 5 minutes? By deleting
the RRSIG from its cache within 5 minutes, overriding its TTL?

If so, is there value stating this in the document?


        also known as 'lame'

I thought the WG agreed the definition of 'lame' was not agreed upon and
the term is no longer being favoured for use. Why not just remove this part?

        To prevent such unnecessary DNS traffic, security-aware resolvers
        MUST cache DNSSEC validation failures, with some restrictions.

What are these "some restrictions" ?

Hi,

Thanks for working on this document - I'm not a DNS expert but it looks like good advice.

A couple of minor comments for your consideration:

(1) p 2, sec 1.  Introduction

   This document updates [RFC2308] to require negative caching of DNS
   resolution failures and provides additional examples of resolution
   failures.

Perhaps "caching of all DNS resolution failures"?


(2) p 2, sec 1.1.  Motivation

   RFC Editor: We'd like your thoughts on moving the Motivation and
   Related Work sections to appendices.  Is that a preferred style?

Not the RFC editor, but I would keep the motivation here, as a subsection of the introduction.

Regards,
Rob