<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div style="font-size: 14px;"><div style="font-size: medium;"><div>Dear RSSAC caucus, </div><div><br></div><div>In its last teleconference meeting, the RSSAC has identified root zone TTLs to be a work item for the group. According to the process recently sent out, the RSSAC is looking for volunteers for document leaders and participants for the effort. If you're interested in leading the effort and/or contributing the effort, please send a message indicating that to both Liman and Steve Sheng (staff support)</div><div><br></div><div> Steve Sheng <<a href="mailto:steve.sheng@icann.org">steve.sheng@icann.org</a>></div><div> Lars-Johan Liman <<a href="mailto:liman@netnod.se">liman@netnod.se</a>></div><div><br></div><div>Before 2015-01-30 2400 UTC. The scope of the task at hand is as follows:</div><div><br></div><div>#----------------------------------------------------------------------</div><div><br></div><div>STATEMENT OF WORK AND SCOPE FOR root zone TTLs</div><div><br></div></div><div style="font-size: medium;">TTLs of records in the root zone have remain unchanged for as far back in time as we know from available root zone archives (i.e., at least 1999). This predates both a signed root zone and the use of anycast on root name servers. Until very recently, there has been little reason to consider changes to root zone TTLs.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">Records in the root zone presently have three TTL values: 24 hours, 48 hours, and 6 days. Most authoritiatve data in the zone is given a 24 hour TTL. This includes SOA, DS, NSEC, and their associated RRSIGs.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">The TLD delegation records (NS and glue), as well as DNSKEY records, are given a 48 hour TTL. Since the NS+glue are not authoritative, the only RRSIG records with a 48 hour TTL are the DNSKEY signatures.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">The only remaining records in the zone are the NS+glue (and RRSIG) for the root zone itself. These are given a 6 day TTL.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">Until just recently, all RRSIG records in the root zone were given a signature validity period of 7 days. This meant that a root server instance that was not updated within 24 hours could return NS RRset responses whose TTL exceeded the signature validity. This is not a problem for validating or non-validating resolvers alone, but could cause problems when a validator is behind (i.e., forwarding to) a non-validator. The signature validity period was increased to 10 days to alleviate this problem.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">Lowering of the NS RRset TTL is another way to alleviate the problem. If the NS RRset TTL were lowered, it would be reasonable to again reduce signature validity values to previous levels.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">Verisign, as the Root Zone Maintainer, requests the RSSAC Caucus to consider the extent to which: (1) the current root zone TTLs are appropriate for today's environment, (2) lowering the NS RRset TTL makes sense, and (3) the impacts that TTL changes would have on the wider DNS.</div><div style="font-size: medium;"><br></div></div><div><div>#----------------------------------------------------------------------</div><div style="font-size: 14px; font-family: Calibri, sans-serif;"><br></div></div></body></html>