attack
Click on the red underlined text to get to the source
... validate or due to missing data that the relevant DNSSEC RRs
indicate should be present. This case may indicate an attack but
may also indicate a configuration error or some form of data
corruption.
...
... cache MUST take steps to prevent the
cache from being useful as a denial-of-service attack amplifier,
particularly the following:
...
... TTL SHOULD be small,
in order to mitigate the effect of caching the results of an
attack.
o In order to prevent caching of a transient validation ...
... o In order to prevent caching of a transient validation failure
(which might be the result of an attack), resolvers SHOULD track
queries that result in validation ...
...
accidentally interferes with DNSSEC RRs or due to a deliberate attack
in which an adversary forges a response, strips DNSSEC RRs from a
...