From: Peter van Dijk Date: Wed, 22 Jan 2020 12:19:22 +0000 (+0100) Subject: auth dnssec docs: some notes on TTL usage X-Git-Tag: auth-4.3.0-beta1~17^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F8735%2Fhead;p=thirdparty%2Fpdns.git auth dnssec docs: some notes on TTL usage --- diff --git a/docs/dnssec/operational.rst b/docs/dnssec/operational.rst index c5e4b328ca..8bd0822467 100644 --- a/docs/dnssec/operational.rst +++ b/docs/dnssec/operational.rst @@ -227,3 +227,14 @@ memory used for the signature caches. In addition, on startup or AXFR-serving, a lot of signing needs to happen. Most best practices are documented in :rfc:`6781`. + +Some notes on TTL usage +----------------------- + +In zones signed by PowerDNS (so non-presigned zones), some TTL values need to be filled in by PowerDNS. +The TTL of RRSIG record sets is the TTL of the covered RRset. +For CDS, CDNSKEY, DNSKEY, NSEC, NSEC3 and NSEC3PARAM, we use the SOA default TTL (the last number in the SOA record). +Except for CDS/CDNSKEY/DNSKEY, these TTLs are chosen because `RFC 4034 `__ demands it so. + +If you want a 'normal' TTL (3600, 86400, etc.) for your DNSKEY but a low TTL on negative answers, set your SOA default TTL to the high number, and set the TTL on the SOA record itself to the low TTL you want for negative answers. +Note that the NSEC/NSEC3 records proving those negatives will get the high TTL in that case, and this may affect subsequent resolution in resolvers that do aggressive NSEC caching (`RFC 8198 `__). \ No newline at end of file