Network Working Group M. Andrews Internet-Draft ISC Intended status: Experimental March 3, 2014 Expires: September 4, 2014 EDNS EXPIRE OPTION draft-andrews-dnsext-expire-02 Abstract This document specifies a method for slave DNS servers to honour the SOA EXPIRE field as if they were always transferring from the master, even when using other slaves to perform indirect transfers and refresh queries. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on September 4, 2014. Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Andrews Expires September 4, 2014 [Page 1] Internet-Draft EDNS EXPIRE OPTION March 2014 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Reserved Words . . . . . . . . . . . . . . . . . . . . . . 3 2. Expire EDNS option (Query) . . . . . . . . . . . . . . . . . . 3 3. Expire EDNS option (Response) . . . . . . . . . . . . . . . . . 3 3.1. Master Server . . . . . . . . . . . . . . . . . . . . . . . 3 3.2. Slave Server . . . . . . . . . . . . . . . . . . . . . . . 4 3.3. Non-Authoritative Server . . . . . . . . . . . . . . . . . 4 4. Slave Behaviour . . . . . . . . . . . . . . . . . . . . . . . . 4 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 4 6. Security Considerations . . . . . . . . . . . . . . . . . . . . 5 7. Normative References . . . . . . . . . . . . . . . . . . . . . 5 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 5 Andrews Expires September 4, 2014 [Page 2] Internet-Draft EDNS EXPIRE OPTION March 2014 1. Introduction The expire field of a DNS zone's SOA record [RFC 1035] is supposed to indicate when a slave server shall discard the contents of the zone when it has been unable to contact the master [RFC 1034]. Current practice works when all the slaves contact the master directly to perform refresh queries and zone transfers. While slaves are expected to be able to transfer from other slaves for robustness reasons as well as reachability constraints, there was no mechanism provided to preserve the expiry behaviour when using a slave. Slaves instead have to know whether they were talking directly to the master or another slave, and use that to decide whether to update the expire timer or not. This however fails to take into account delays in transferring from one slave to another. There are also zone transfer graphs in which the slave never talks to the master, so the effective expiry period becomes multiplied by the length of the zone transfer graph--which when it contains loops is infinite. This document provides a mechanism to preserve the expiry behaviour regardless of what zone transfer graph is constructed and whether the slave is talking to the master or another slave. 1.1. Reserved Words The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119]. 2. Expire EDNS option (Query) The EDNS [RFC 6891] EXPIRE option has the value . The EDNS EXPIRE option MAY included set on any QUERY, though usually this is only done on SOA, AXFR and IXFR queries involved in zone maintenance. This is done by adding a zero length EDNS EXPIRE option to the options field of the OPT record when the query is made. 3. Expire EDNS option (Response) 3.1. Master Server When the query is directed to the master server for the zone, the response will be a EDNS EXPIRE option of length 4 containing the current value of the SOA EXPIRE field, in seconds and network byte Andrews Expires September 4, 2014 [Page 3] Internet-Draft EDNS EXPIRE OPTION March 2014 order. 3.2. Slave Server When the query is directed to a slave server for the zone, then the response will be an EDNS EXPIRE option of length 4 containing the value of the expire timer on that server, in seconds and network byte order. 3.3. Non-Authoritative Server If an EDNS EXPIRE option is sent to a server that is not authoritative for the zone then there will be no EDNS EXPIRE option added to the response. 4. Slave Behaviour When a slave server performs a zone transfer request or performs a zone refresh query it SHALL add an EDNS EXPIRE option to the query message. If a slave receives an EDNS EXPIRE option in a response to a SOA query, it SHALL update its expire timer to be the maximum of the value returned in the EDNS EXPIRE option and its current value. Similarly, if a slave receives an EDNS EXPIRE option in its response to an IXFR query which indicated the slave is up to date (serial matches current serial) the slave SHALL update the expire timer to be the maximum of the value returned in the EXPIRE EDNS option and its current value. If the zone is transferred or updated as the result of an AXFR or IXFR query and there is an EDNS EXPIRE option with the response then the value of the EDNS EXPIRE option SHOULD be used instead of that of the SOA EXPIRE field to initialise the expire timer. In all cases, if the value of SOA EXPIRE field is less than the value of the EDNS EXPIRE option, then the value of SOA EXPIRE field MUST be used and MUST be treated as a maximum when updating or initialising the expire timer. 5. IANA Considerations IANA is requested to assign a EDNS option code point (Registry Name: DNS EDNS0 Options) for the EDNS EXPIRE option specified in Section 2. Andrews Expires September 4, 2014 [Page 4] Internet-Draft EDNS EXPIRE OPTION March 2014 6. Security Considerations The EDNS EXPIRE option exposes how long the slaves have been out of communication with the master server. This is not believed to be a problem and may provide some benefit to monitoring systems. 7. Normative References [RFC 1034] Mockapetris, P., "DOMAIN NAMES - CONCEPTS AND FACILITIES", STD 13, RFC 1034, November 1987. [RFC 1035] Mockapetris, P., "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION", STD 13, RFC 1035, November 1987. [RFC 2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC 6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, April 2013. Author's Address Mark P. Andrews Internet Systems Consortium 950 Charter Street Redwood City, CA 94063 US Email: marka@isc.org Andrews Expires September 4, 2014 [Page 5]