On Sat, Apr 12, 2014 at 02:09:19PM +0800, P J P wrote:
On Saturday, 12 April 2014 11:11 AM, William Brown wrote: Say I have freshly installed my fedora system at home. I then boot it up and start to use it. My laptop is caching DNS results all the while from the "unreliable" ISP.
I then go to work and suddenly things don't work.
Having a DNS cache doesn't fix your unreliable ISP: You need to lodge a complaint with your ISP.
What, no! that was the case for having local cache and not forwarding queries to the ISP's name servers at all. Because those are not reliable.
I disagree. You can still do DNSSEC validation with a local caching resolver and configure that local resolver to forward all queries to the ISP. That should be tried first, and only bypassed and become a full interative recursive querier bypassing the ISP resolvers if that fails. We need to respect the DNS caching infrastructure by default.