Post #2280151
2026-05-09 07:36 UTC
@jpmens@mastodon.social I guess for nonexistent DS RRs it's the 'minimum' of the de. SOA RR which is 2h. But resolvers may have shorter overwrites.
Replies (1)
-
@winfried@fosstodon.org 2026-05-09 13:37
@jpmens@mastodon.social proactive mitigation idea: permanent NTAs for zones that you are sure are not, and will not be, signed. But I'm not sure if the (signed) referrals (NS RRs) of the parent would work once they have expired