NSEC and NSEC3: TTLs and Aggressive Use
updates
Extracted elements (12)
RFC 4034 and RFC 5155 used SHOULD-level language requiring NSEC/NSEC3 TTLs to equal the SOA MINIMUM field. This was written before RFC 8198 enabled aggressive use of NSEC/NSEC3 records; once resolvers began synthesizing responses from cached NSEC/NSEC3 records, correctness of those TTLs became much more critical, justifying an upgrade to MUST.
The original RFC 4034 wording set NSEC TTL equal to SOA MINIMUM, which could be much larger than the effective negative TTL (min of SOA TTL and SOA MINIMUM). This discrepancy allowed aggressive NSEC use to deny existence of names for far longer than the zone operator intended — e.g., 86400 seconds instead of 900 seconds.
RFC 8198's Section 5.4 previously advised resolvers to reduce NSEC/NSEC3 TTLs to match SOA.MINIMUM if smaller, but because RFC 4034/5155 already set NSEC/NSEC3 TTL equal to SOA MINIMUM, this advice would not actually change anything for conformant authoritative servers. RFC 9077 corrects the root definition instead.
Validating resolvers consider an expanded wildcard valid for the wildcard's TTL, capped by the TTLs of the NSEC or NSEC3 proof. Reducing NSEC/NSEC3 TTLs per this document may shorten the effective lifetime of wildcard responses.
A resolver that supports aggressive use of NSEC and NSEC3 MAY limit the TTL of NSEC and NSEC3 records to the lesser of the SOA.MINIMUM field and the TTL of the SOA in a response, if present. It MAY also use a previously cached SOA for a zone to find these values.
Due to incremental NSEC/NSEC3 chain updates by some signers, a transient inconsistency between the observed and expected TTL MAY exist.
It is RECOMMENDED that validating resolvers limit the maximum effective TTL value of negative responses (NSEC/NSEC3 RRs) to 3 hours (10800 seconds), consistent with RFC 2308's suggested maximum default negative cache TTL.
The TTL of the NSEC RR that is returned MUST be the lesser of the MINIMUM field of the SOA record and the TTL of the SOA itself. This matches the definition of the TTL for negative responses in RFC 2308.
The TTL of the NSEC3 RR that is returned MUST be the lesser of the MINIMUM field of the SOA record and the TTL of the SOA itself. This matches the definition of the TTL for negative responses in RFC 2308.
Zone operators whose signers and DNS servers cannot immediately be updated are encouraged to set their SOA record TTL and SOA MINIMUM field to the same value, so that the TTL used for aggressive NSEC/NSEC3 matches the SOA TTL for negative responses.
IANA has added a reference to RFC 9077 in the 'Resource Record (RR) TYPEs' subregistry of the 'Domain Name System (DNS) Parameters' registry for the NSEC and NSEC3 RR types.
An attacker can delay future records from appearing in a cache by seeding it with queries that cause NSEC or NSEC3 responses to be cached for aggressive use. This document reduces that attack's impact in cases where NSEC/NSEC3 TTLs were previously higher than the zone operator intended.