<div dir="ltr">Hi Andrew.<div>Thanks for the pointer, but no. Section 8 clarifies the lower and upper bounds for TTL and that bit 32 MUST be 0.</div><div>I know that the minimum value possible for TTL is zero. I can happily configure this in my authoritative server and that TTL will be preserved through a recursive server (which will not cache the answer) all the way back to the client.</div><div><br></div><div>My question is about the behaviour of a recursive server that already has a record in its cache with a non-zero TTL, which it is counting down.</div><div>If it receives a query for that record at the instant its internal logic would turn TTL=1 to TTL=0, should that server answer with TTL=0 or not?</div><div><br></div><div>My personal thoughts are it SHOULD answer with TTL=0 because:</div><div>a) 1035 and 2181 are very clear that 0 is a valid value</div><div>b) a precedent has already been set for recursive servers sending 0 to clients, if that's what the auth server gave it.</div><div><br></div><div>NOTE: BIND used to answer from cache with 0, many years ago. Now it doesn't. This is just one example of how a popular DNS engine behaves. I'm not saying ISC are wrong. I just don't know.</div><div><br></div><div>The reason I am asking this question here is not just for academic interest. We have a very real problem in our network at the moment that hinges on who is right. I consider you all to be 'expert witnesses' whose testimony I can potentially use to wave in front of a vendor and prove they are wrong. Hence why I am being really picky in wanting a definitive answer, if there is one.</div><div><br></div><div><br></div><div>thanks, Greg</div></div><br><div class="gmail_quote"><div dir="ltr">On Sat, 19 Jan 2019 at 00:36, Andrew Sullivan <<a href="mailto:ajs@anvilwalrusden.com">ajs@anvilwalrusden.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<div dir="auto">
<div dir="auto">Section 8?</div><div id="gmail-m_285475435236116648aqm-signature" dir="auto" style="color:black"><div dir="auto">-- </div><div dir="auto">Andrew Sullivan</div><div dir="auto">Please excuse my clumbsy thums.</div></div><div dir="auto"><br></div>
<div id="gmail-m_285475435236116648aqm-original" style="color:black">
<div class="gmail-m_285475435236116648aqm-original-body">
<div style="color:black">
<p style="color:black;font-size:10pt;font-family:sans-serif;margin:8pt 0px">On January 18, 2019 19:05:56 Greg Choules <<a href="mailto:gregchoules@googlemail.com" target="_blank">gregchoules@googlemail.com</a>> wrote:</p>
<blockquote type="cite" class="gmail_quote" style="margin:0px 0px 0px 0.75ex;border-left:1px solid rgb(128,128,128);padding-left:0.75ex">
<div dir="ltr">Hi Andrew.<div>Which bit of 2181?</div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, 18 Jan 2019 at 23:55, Andrew Sullivan <<a href="mailto:ajs@anvilwalrusden.com" target="_blank">ajs@anvilwalrusden.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<div dir="auto">
<div dir="auto">Seems to me RFC2181 already answered this years ago. </div><div id="gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-signature" dir="auto" style="color:black"><div dir="auto">-- </div><div dir="auto">Andrew Sullivan</div><div dir="auto">Please excuse my clumbsy thums.</div></div><div dir="auto"><br></div>
<div id="gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-original" style="color:black">
<div class="gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-original-body">
<div style="color:black">
<p style="color:black;font-size:10pt;font-family:sans-serif;margin:8pt 0px">On January 18, 2019 17:21:40 Greg Choules <<a href="mailto:gregchoules@googlemail.com" target="_blank">gregchoules@googlemail.com</a>> wrote:</p>
<blockquote type="cite" class="gmail_quote" style="margin:0px 0px 0px 0.75ex;border-left:1px solid rgb(128,128,128);padding-left:0.75ex">
<div dir="ltr">Hi Fred.<div>No, I am not talking about dscacheutil or any particular client software. I just want to know whether, in the opinion of the world's DNS professionals, recursive servers should or shouldn't ever send answers from cache with TTL=0.</div><div><br></div><div>cheers, Greg</div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, 17 Jan 2019 at 23:15, m3047 <<a href="mailto:m3047@m3047.net" target="_blank">m3047@m3047.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Who cares about the RFC? In practice, SOME caching resolvers (and that's <br>
being charitable) WILL answer with TTL=0. I've had to live with PFSense <br>
deployments which did this.<br>
<br>
Which in turn leads to things like (for Mac users):<br>
<br>
dscacheutil -flushcache<br>
<br>
Is that what you're talking about?<br>
<br>
On Thu, 17 Jan 2019, Greg Choules wrote:<br>
> [...]<br>
><br>
> Is there ever a case, for cached answers, that the recursive server would<br>
> answer the client with TTL=0? Or would that be illegal? RFC1034 states that<br>
> records with TTL=0 "should not be cached". Note "should" and not "must".<br>
</blockquote></div>
<div>_______________________________________________</div>
<div>dns-operations mailing list</div>
<div><a class="gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-autolink gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-autowrap" href="mailto:dns-operations%40lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a></div>
<div><a class="gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-autolink gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-autowrap" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></div>
<div>dns-operations mailing list</div>
<div><a class="gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-autolink gmail-m_285475435236116648gmail-m_-8034659587385549535aqm-autowrap" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></div>
<div><br></div>
</blockquote>
</div>
</div>
</div><div dir="auto"><br></div>
</div></div>
</blockquote></div>
</blockquote>
</div>
</div>
</div><div dir="auto"><br></div>
</div></div>
</blockquote></div>