default local DNS failover solution needed, nscd?

[Miloslav Trmač]

2014-04-26 0:51 GMT+02:00 Chuck Anderson <cra at wpi.edu>:

> > Main goal is to have local DNSSEC-validating resolver.
>
> I, as the OP, did not intend that as the goal, although I have no
> problem with that as a different goal.  My intent was to fix the
> atrocious failover behavior of the glibc resolver.  I also don't mind
> using a caching resolver BUT there should be a better stub resolver
> that can be widely deployed in a default configuration that doesn't
> require a local caching resolver to paper over its deficiencies.
> Maybe nscd (and some of the other ideas in the link I posted) are part
> of the solution.
>
> Basically, we aren't going to win the war by suggesting that everyone
> should run a DNSSEC-validating resolver everywhere.


Right now I'd actually guess that it's more likely to have a
DNSSEC-validating resolver soon, than the simple caching daemon you
propose.  Specific people are already dedicated to working on the former,
and the principal elements of the solution already exist; what is left is
(a large amount of) integration work.  And that will also inherently handle
the caching/failover case "for free".

OTOH the caching daemon initiative would require new research, probably new
implementation, and about the same large amount of integration work
(currently unstaffed for *that* project)—and then doing the integration all
over again when we do decide deploy DNSSEC.
     Mirek
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/devel/attachments/20140426/e99164ab/attachment.html>