Possible to prevent/limit caching of DNSSec records?

Question

I am looking at the SmartCache service of OpenDNS where it caches authoritative responses.

From a client perspective, is there any way I can use a recursive DNS resolver to determine if the record is cached, and if so for how long?

From a server perspective, is there a way I can prevent the replay of the DNSSec data? (outside of key expiry)

Answer 1

As a client

I don't think that there is a way to check the cache status of a record on a DNS resolver. If you are really concerned about whether the record is cached then you can directly query the authoritative nameserver.

As a resolver

As a resolver you can choose to cache (or not cache) what you want, but I wouldn't recommend messing with this. The authoritative server has requested the cache time with their TTL, and I'd recommend that you just respect that. Caching is very important in DNS to spread out the load over the network.

As an authoritative nameserver

As an authoritative nameserver you can use your TTL to request that resolvers cache your record for a certain time (which you can set very low for near instant expiry). However, unfortunately, resolvers sometimes choose to not listen to TTLs.

Answer 2

When you query a DNS server, and you get back records, each one is associated with a TTL. If you do multiple times the same query you will see that:

• if you query an authoritative nameserver, the TTL will always be the same
• but if you query a recursive nameserver the TTL will decrease each time (it is a number of seconds); recursive nameserver are expected to follow first the TTL given by the related authoritative nameserver for the record queried and then while keeping the response in their case, decrease the TTL over time ; some recursive nameserver do however muck with this by forcing some minimum and/or maximum TTL value, irrespective of what is at the authoritative nameserver. Hence in this case the TTL will let you know how long it will remain cached and if you query the authoritative nameserver for its own TTL, the difference would be how long the record is in the recursive cache.

As for your other question, I'm not sure to understand, on two levels. First, why do you want to filter out the DNSSEC date? Then, when you say server are you talking about a recursive one, or any server doing DNS queries?