Dear all,
My apologies for sending the notes and action items for this call late.
Steve
23 April 2015 RSSAC Caucus TTL WP Call
Participants: Duane Wessels (leader), Jaap Akkerhuis, John Bond, Joe Abley,
Matt Thomas. Staff: Steve Sheng, Carlos Reyes, Barbara Roseman, Kathy
Schnitt
Apologies: Brian Dickson, Warren Kumari
Action items:
* Matt and Shumon to rerun the test measuring the DS and DNSKEY TTLS for
TLDs with a more recent copy of the root zone file. Also perform the
analysis to compare NS and DNSKEY on a per TLD basis to see if they are the
same or different.
* Jaap to continue the task of finding the recursive resolver application's
TTL settings. Jaap to provide some text about measurements of TTL in
relation to Warren¹s contribution.
* Each of the streams of work to provide an ETA for their efforts.
* Duane to send an email to the WP regarding 6 May meeting time, if no
objections the next meeting will be 6 May.
Decision:
* For next meeting, the working group will create the report document and
puttings things together.
Notes:
Kathy Schnitt:Apology: Brian Dickson
jaap akkerhuis:No sound no mike
Kathy Schnitt:Japp sound on AC is working now
Matt: Shumon and I measured the TTL of DS and DNSKEY of delegated TLDs,
these came from root zone file in March
the DS key TTL is uniform. There were some DS keys that are absent. The
DNSKEY, there is a non-uniform TTL distribution. Majority is 86400. A large
portion of them have smaller values, varing from TTLs in ccTLDs. We plan to
rerun the test, as quite a few TLDs have been delegated.
Duane: The graph you send are specific to DNSKEY TTLs, right?
Duane: have you done work on NS TTLs?
Duane: Matt is having some connectivity issues.
Duane: This is good. One thing is compare to compare NS and DNSKEY on a
per TLD basis.
Duane: To see if they are the same or they are different.
Matt: Sure.
ACTION ITEM: Matt to compare NS and DNSKEY TTL for the root zone.
ACTION: With new zone file.
Jaap: It is too early to draw conclusions.
Duane: Yes, I agree. Since most of the TTL is one day.
Matt: Duane and I are doing some analysis on the DITL data.
Matt: As it stand, we are about half way done.
Matt: We use the root zone file to determine delegated TLDs.
Matt: We calculate, minimum, maximum, mean, median time delta of the
queries.
Kathy Schnitt:Warren is unable to make the call today.
Matt: This graph shows the distribution of the queries by TLD.
Matt: The number of requests measured by IP.
Duane: As we are writing the report on TTL, we need to think about what
group of users are most important.
Duane: One thing is to profile the IP by query types.
Duane: To identify recursive resolvers.
Duane: The problem of identifying typical is that they are all over the
map.
Duane: It is difficult to define normal vs. abnormal.
John: Looking at that, it seems there is no impact if changing TTL from 2
day to 1 day.
Duane: That seems to be my understanding, but this affect clients, we need
to see how many queries are affected.
Duane: Jaap, do you have any news for us?
Jaap: I looked at warren's measurements, but I think some of it may not be
measuring the right thing.
Jaap: [not captured]
Duane: It would be good to document this behavior.
ACTION: Jaap to continue the task on the recursive resolver application
TTL.
Jaap: Also Peter Koch did not respond to my requests for root zone's prior
1999.
Duane: Let's look at SOA.
John: I have put my contribution in the email, my recommendation is change
some values.
Duane: I tend to agree.
Duane: One way is to lower the zone expiry time from 7 days to 3 days at
least to solve this problem.
Duane: The other to increase the validity period to 20 days.
Duane: The other option is to generate more signatures more frequently.
John: My gut feeling here is changing the expiray in SOA seem to make the
most sense.
That value seems a little bit too high, I woudl prefer root zone to expire
their data earlier than 7 days.
The root server operators should ensure their servers much earlier than
expiry period.
Joe: There is also a large part of the population not validating DNSSEC.
Duane: I have some experience with this kind of thing, the tool is
designed to tell whether you were using a validating recusive name server.
The first time you query it, it responded with bad response, and expected
you to try again.
Duane: This works great for BIND. It works just ok for UNBOUND. It works
terribly for Nominom's implementation.
as they only tried once.
Duane: I think there is nothing in the protocol that mandates retrial
numbers.
Duane: I suspect we will need RSSAC to choose.
Duane: Are there any last minute things to talk about.
Duane: I will send out a message to the list. For each item, let's get an
update progress and ETA. I think maybe in about 2 weeks we should start
creating the report document and puttings things together. That would give
us three weeks before our deadline.
John: My item is complete, but Joe raised a good point. How caching
resolvers respond when they get an expired response.
Duane: One administrivia in two weeks, I will be heading to OARC meeting.
Can we reschedule that.
to the day before?
ACTION: Duane to send a note asking people's flexibility on Wed 6 May.
jabley:thanks!
jaap akkerhuis:Later!
