RFC 7314

Extension Mechanisms for DNS (EDNS) EXPIRE Option

📅 published July 2014, from ietf

Extension Mechanisms for DNS (EDNS) EXPIRE Option 🎀

Okay bestie, so this is RFC 7314 📜 and the title is Extension Mechanisms for DNS (EDNS) EXPIRE Option. Mark P. Andrews (M. Andrews) from ISC wrote it. It's an Independent Submission in the Experimental category 🧪, dated July 2014, with ISSN 2070-1721. It doesn't say it obsoletes or updates anything, so it's a standalone little gem ✨.

Abstract 💜

This doc is about how secondary DNS servers can honour the SOA EXPIRE field as if they were always transferring straight from the primary. The sneaky part is that this still works when they're pulling from other secondaries for indirect transfers and refresh queries 🫶.

Status of This Memo 📝

Not an Internet Standards Track spec! This one is published for examination, experimental implementation, and evaluation 🔬. It defines an Experimental Protocol for the Internet community. It's a contribution to the RFC Series, separate from any other RFC stream. The RFC Editor picked to publish it at their discretion and makes no statement about its value for implementation or deployment. Docs the RFC Editor approves aren't candidates for any level of Internet Standard, see Section 2 of RFC 5741 💅.

For the current status, errata, and feedback info, check http://www.rfc-editor.org/info/rfc7314.

Copyright Notice ©️

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the publication date. Read those carefully, because they spell out your rights and restrictions 📖.

Table of Contents 🗂️

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  1.1.  Reserved Words  . . . . . . . . . . . . . . . . . . . . .   2
2.  Expire EDNS Option (Query)  . . . . . . . . . . . . . . . . .   3
3.  Expire EDNS Option (Response) . . . . . . . . . . . . . . . .   3
  3.1.  Primary Server  . . . . . . . . . . . . . . . . . . . . .   3
  3.2.  Secondary Server  . . . . . . . . . . . . . . . . . . . .   3
  3.3.  Non-authoritative Server  . . . . . . . . . . . . . . . .   3
4.  Secondary Behaviour . . . . . . . . . . . . . . . . . . . . .   3
5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   4
6.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
7.  Normative References  . . . . . . . . . . . . . . . . . . . .   4

1. Introduction ✨

Okay so the expire field of a DNS zone's SOA record [RFC1035] is supposed to tell a secondary server when to throw out the zone contents, once it's been unable to reach the primary [RFC1034]. The catch is that today's approach only works when every secondary talks directly to the primary for refresh queries and zone transfers 😬.

Secondaries are meant to be able to transfer from other secondaries, and lots of them are configured to do exactly that, for robustness and reachability reasons 🌸. But there's no mechanism for keeping the expiry behaviour intact when a secondary does this. Instead, secondaries have to figure out whether they're talking to the primary or to another secondary, and then use that to decide whether to update the expire timer. That doesn't account for delays in transferring from one secondary to another, which is giving "not accounted for" energy 🙈.

It gets worse! There are zone-transfer graphs where the secondary never talks to the primary at all, so the effective expiry period gets multiplied by the length of the graph. And if the graph has loops, that length is infinite 💀.

So this doc provides a mechanism to keep the expiry behaviour no matter what zone-transfer graph gets built, and whether the secondary is talking to the primary or to another secondary 🦋.

1.1. Reserved Words 🔑

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀.

2. Expire EDNS Option (Query) 🧚

The EDNS [RFC6891] EXPIRE option has the value <9> 🔢. The EDNS EXPIRE option MAY be included on any QUERY, though usually it only shows up on SOA, AXFR, and IXFR queries involved in zone maintenance 🛠️. To include it, you add a zero-length EDNS EXPIRE option to the options field of the OPT record when you make the query.

3. Expire EDNS Option (Response) 💌

3.1. Primary Server 👑

When the query goes to the primary server for the zone, the response is an EDNS EXPIRE option of length 4. It contains the value of the SOA EXPIRE field, in seconds and network byte order 🔥.

3.2. Secondary Server 🦋

When the query goes to a secondary server for the zone, the response is an EDNS EXPIRE option of length 4. This time it contains the value of the expire timer on that server, in seconds and network byte order 💜.

3.3. Non-authoritative Server 🙅‍♀️

If an EDNS EXPIRE option gets sent to a server that isn't authoritative for the zone, that server MUST NOT add an EDNS EXPIRE option to the response. No sneaking it in! 😤

4. Secondary Behaviour 🌈

When a secondary server does a zone-transfer request or a zone-refresh query, it SHALL add an EDNS EXPIRE option to the query message 📨.

If a secondary gets an EDNS EXPIRE option in a response to an SOA query, it SHALL update its expire timer to be the maximum of the value returned in the EDNS EXPIRE option and the current timer value 🙌. Same vibe for an IXFR query response when the query said the secondary is up to date (serial matches current serial): the secondary SHALL update the expire timer to be the maximum of the value returned in the EDNS EXPIRE option and the current timer value ✨.

If the zone gets transferred or updated because of an AXFR or IXFR query, and the response has an EDNS EXPIRE option, then the EDNS EXPIRE option value SHOULD be used instead of the SOA EXPIRE field value to initialise the expire timer 🎯.

In all cases, if the SOA EXPIRE field value is less than the EDNS EXPIRE option value, then the SOA EXPIRE field value MUST be used and MUST be treated as a maximum when updating or initialising the expire timer. This is the big rule, so don't skip it! 🚨

5. IANA Considerations 🏛️

IANA has assigned an EDNS option code point for the EDNS EXPIRE option from Section 2, with "Optional" status, in the "DNS EDNS0 Option Codes (OPT)" registry 🎉.

6. Security Considerations 🔐

This method makes sure that servers which no longer have a connection to the primary, directly or indirectly, stop serving the zone content once the SOA EXPIRE timer is reached 🛑. That way stale data doesn't get served forever. Iconic, honestly 💅.

The EDNS EXPIRE option reveals how long the secondaries have been out of communication with the primary server. This is not believed to be a problem, and it might even help monitoring systems 📊.

7. Normative References 📚

[RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, April 2013.

Author's Address 📮

Mark P. Andrews
Internet Systems Consortium
950 Charter Street
Redwood City, CA  94063
US

EMail: marka@isc.org

That's the whole RFC, bestie! 🌈💖 You're officially caught up 🫶

📦 where this page comes from

ietf: rfc7314 2014-07
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms