[dns-wg] Just another lookaside zone

* Lutz Donnerhacke wrote:
> In order to extend the deployment of security technology, we switch to
> DNSSEC for us and our customers.  [...] This is the reason why, we set
> up an other DLV zone.

Please do *not* try to use this zone with any public available bind version.
There is a bug in long time behaivor of the caching algorithms. Invalidating
of cache entries occurs unrelated to DNSSEC. This causes invalidating of any
signed entries over the time. The race condition caused by cache
invalitation is large enough to hit the lookaside zone itself after some
hours on a busy server. Normal usage hits the problem after some days. Due
to the bind architecture, even authorized servers can be unable to deliver
there own data.

Look for "empty name resolving" entries in the logfiles.

Unfortunly there is no working DNSSECable DNS server software out at all.