[bind10-dev] About resolver Negative Cache Design

[Likun Zhang]

> As for filling up the cache with negative answers... an attacker can
> also easily fill up the cache with "junk" answers, for example by
> creating an authoritative server which always answers A queries with a
> random IP. In fact this is an even easier target, because the bad guy
> might be able to use TXT lookups and get large responses - it takes a
> lot fewer 3000 byte TXT cache entries than 300 byte negative SOA entries
> to bloat memory. :)

Should we do some thing to avoid these too long message being cached?  :)

Likun