RFC 8198 - Aggressive Use of DNSSEC-Validated Cache
Abstract
The DNS relies upon caching to scale; however, the cache lookup
generally requires an exact match. This document specifies the use
of NSEC/NSEC3 resource records to allow DNSSEC-validating resolvers
to generate negative answers within a range and positive answers from
wildcards. This increases performance, decreases latency, decreases
resource utilization on both authoritative and recursive servers, and
increases privacy. Also, it may help increase resilience to certain
DoS attacks in some circumstances.
This document updates RFC 4035 by allowing validating resolvers to
generate negative answers based upon NSEC/NSEC3 records and positive
answers in the presence of wildcards.
generally requires an exact match. This document specifies the use
of NSEC/NSEC3 resource records to allow DNSSEC-validating resolvers
to generate negative answers within a range and positive answers from
wildcards. This increases performance, decreases latency, decreases
resource utilization on both authoritative and recursive servers, and
increases privacy. Also, it may help increase resilience to certain
DoS attacks in some circumstances.
This document updates RFC 4035 by allowing validating resolvers to
generate negative answers based upon NSEC/NSEC3 records and positive
answers in the presence of wildcards.
