dotse/dnscheck — Issue #55: Faulty SOA recommendation 
Author: pos42
Created: 2011-11-30 14:20:32+00:00
State: open

Hi

I think maybe dnscheck gives wrong recommendations for SOA expiration...

If DNSSEC is enabled, RFC 4641 bis says the SOA expiration timer should be between 1/4 and one 1/3 of the signature validity period.

A key signature validity of 12 says (1034800) then gives the SOA expiration should be between 259200 and 345600. Setting the SOA expiration to 3 days and 12 hours (302400) should be within the recommendations here. Even so.. The dnscheck.iis.se gives a recommendation of 604800.

From the RFC 4641 page 13...

--snip--
We suggest the SOA expiration timer being approximately one
third or one fourth of the signature validity period. It will
allow problems with transfers from the master server to be
noticed before the actual signature times out. We also suggest
that operators of nameservers that supply secondary services
develop 'watch dogs' to spot upcoming signature expirations in
zones they slave, and take appropriate action.
--snip--

Shouldn't the recommendation look at if DNSSEC is enabled before the recommendation is given?

Am I missing something here?

Thanks
Per-Olov Sjöholm