Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: Who is Dean Anderson?
Matthew Dempsky <[email protected]>
| Newsgroups | gmane.network.djbdns |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Mar 11, 2010 at 5:23 PM, Matthew Dempsky <[email protected]> wrote: > For #1, dnscache simply never caches SOA records. Any SOA query will > *always* be sent upstream. > > For #2, dnscache doesn't cache NODATA CNAME responses; if a domain > name *does not* have a CNAME record, then an explicit CNAME query will > result in a CNAME query being sent upstream. Oops, I should point out that in both of these cases, if an NXDOMAIN is cached for the name, the NXDOMAIN will be answered out of cache (e.g., "dig -t soa nonexistent.google.com" and "dig -t cname nonexistent.google.com" won't result in upstream queries). Of course, this isn't really an issue because for either of these queries, an attacker would just target the zone name (which has to at least have NS records).