[dns-wg] New on RIPE Labs: Making the DNS More Private with QNAME Minimisation

On Sat, Apr 27, 2019 at 11:19:11AM -0700, Randy Bush wrote:
>     foo.you:/usr/home/randy> dig a.b.qnamemin-test.internet.nl TXT
>     a.b.qnamemin-test.internet.nl. 10 IN    TXT     "HOORAY - QNAME minimisation is enabled on your resolver :)!"
>     ;; SERVER: 147.28.0.35#53(147.28.0.35)
>     ;; WHEN: Sat Apr 27 16:58:51 UTC 2019
> 
>     foo.you:/usr/home/randy> dig a.b.qnamemin-test.internet.nl TXT
>     a.b.qnamemin-test.internet.nl. 10 IN    TXT     "NO - QNAME minimisation is NOT enabled on your resolver :("
>     ;; SERVER: 127.0.0.1#53(127.0.0.1)
>     ;; WHEN: Sat Apr 27 17:41:11 UTC 2019
> 
> so, maybe if it is cached it is not working.
> 
> local server is a bind 9.12.4 auth.  recurses locally, but not globally.

Interesting, I'm not quite sure how this is happening, we've set the TTL
very low (10) so there should be very little caching going on.

How did the local server cache the answer from the first request if that
went directly to the external recursor? (And why is the cached answer
different?)

Wouter
>