Subject: thinking about authority and additional sections in recursive answers

From: Paul Vixie <[email-masked]>
Date: Wed, 19 Mar 2008 01:09:12 +0000

when a recursive server answers an RD=1 question positively, is there any way
that the authority section can be useful to the requestor?  since it's RD=1 we
more or less think that the requestor is not going to do any iteration.  since
this adds octets and costs cycles, and since a lot of us have ways to disable
it and have not heard any complaints from disabling it... could we perhaps
clarify the DNS specification to make this stuff "completely unnecessary" ?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 19 Mar 2008 12:50:30 +1100

> that the authority section can be useful to the requestor?

	Yes.  It's used to short circuit the process to find the zone that
	contains a name.  This is useful for UPDATE.  The alternalte is to
	keep performing SOA queries and chopping off a label a time until
	you get a result.

> since it's RD=1 we
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Edward Lewis <[email-masked]>
Date: Wed, 19 Mar 2008 09:18:04 -0400

>clarify the DNS specification to make this stuff "completely unnecessary" ?

I'd vote for "possibly of some use in certain situations."

In DNSSEC (as if) it would be useful (in case the requestor is 
prepared to do the validation).

Probably helpful for CNAME/DNAME/Wildcard answers too.

And in cases where the requestor is someone using dig and forgetting "+norec".

(I may be wrong, I haven't thought through these cases thoroughly. 
It's too early in the morning for me to think deep thoughts.)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Never confuse activity with progress.  Activity pays more.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 19 Mar 2008 16:47:37 +0000

> I'd vote for "possibly of some use in certain situations."

me too, but, there's no reliable way to know in the responder if a requestor
is in one of those situations.

> In DNSSEC (as if) it would be useful (in case the requestor is prepared to
> do the validation).

doesn't DNSSEC have its own bit for that kind of thing?  i'll agree that if
DNSSEC metadata is desireable, then, a full authority section is also likely
quite desireable.

> Probably helpful for CNAME/DNAME/Wildcard answers too.

i would like to hear an example of this.  remember, RD=1 so you're talking to
a stub resolver.  what are they could do with your NS RRs in the auth section?

> And in cases where the requestor is someone using dig and forgetting

this is a statistical anomaly compared to the cpu cycles and network bandwidth
used up by all these authority sections.  if the standard were that RD=1 meant
no authority sections, then "dig" users would quickly remember to say +norec.

> (I may be wrong, I haven't thought through these cases thoroughly. It's too
> early in the morning for me to think deep thoughts.)

well, thanks for sharing, anyway.