Paul Wilson, APNIC and the BIND 9.12 NSEC Cache

Paul Wilson Asked DNS to Stop Bothering the Root About Ghost Names

Why it matters

APNIC had helped install at least 29 root-server instances across 21 economies. Wilson’s next question was sharper: what if resolvers learned when an answer was already “no”?

Sofia Ren25 October 2026Reading Time 2 minLast update: 25 October 2026

Paul Wilson, likeness grounded in ITU’s named portrait; the DNS operations backdrop is imagined.

Summary

In August 2017, Paul Wilson said APNIC would fund ISC’s implementation of aggressive NSEC caching in BIND, shifting part of root-server resilience into recursive resolvers.
APNIC’s 2017 activity report credited the sponsorship, and ISC’s January 2018 BIND 9.12 release included NSEC Aggressive use.

For years, APNIC answered a familiar DNS problem by putting more root servers closer to the networks that used them. Its director general Paul Wilson counted at least 29 assisted or sponsored instances in 21 economies since 2002. Then he proposed the less photogenic improvement: teach the questioner to remember a well-proven “no.” In his August 2017 account, Wilson asked whether resolvers could lean less heavily on root servers, rather than keep adding places for the root to answer.

The trick sits in DNSSEC’s NSEC records. A signed NSEC response can prove that a stretch of names does not exist. Under RFC 8198, a validating recursive resolver may keep that proof and synthesize another negative answer for a name in the proven gap until the cache expires. It need not send each new absurd name back to the root. Ordinary caching remembers the same question; aggressive NSEC can answer a family of different wrong questions. A small piece of authenticated absence does useful work.

Wilson said APNIC would sponsor the Internet Systems Consortium to put this behaviour into BIND. That made the choice unusually concrete for a registry: spend on open resolver code, with the possible benefit shared by operators far beyond APNIC’s own equipment. APNIC’s 2017 activity report later listed its sponsorship of aggressive NSEC in BIND 9.12. ISC’s release announcement on 23 January 2018 listed NSEC Aggressive use among the new features. The proposal had become shipped software.

There is a pleasing inversion in the decision. APNIC had spent years helping install root-server instances; Wilson then helped fund a way for many resolvers to leave those servers alone when they already had a cryptographic answer. The first project placed capacity near users. The second put judgment nearer the question.