Subject: [dnsext] Same-server out-of-bailiwick data?

From: Brandon Black <[email-masked]>
Date: Fri, 23 Apr 2010 19:03:11 -0500

My google-fu has come up short, so I'm hoping the experts here at
namedroppers can shed some light...

Consider the case where an authoritative nameserver is authoritative
for two unrelated domains, example.com and example.net, and there are
some references between the two sets of data that could cause some
implementations to generate Additional/CNAME responses that cross
zones and are thus technically out-of-zone (out of bailiwick, for at
least some definitions of bailiwick?)

I'll give an example using BIND.  BIND is in a basic auth-only config
serving these two zonefiles:

--- example.com ----
@ SOA ns1 hostmaster 1 7200 30M 3D 900
@ NS ns1
ns1 A 192.0.2.1
www A 192.0.2.2
xd-ad MX 0 www.example.net.
xd-cn CNAME www.example.net.
--- end ---

--- example.net ---
@ SOA ns1 hostmaster 1 7200 30M 3D 900
@ NS ns1
ns1 A 192.0.2.1
www A 192.0.2.2
--- end ---

It's responses include all possible data that it knows about on those
two names that have cross-zone references, e.g. (dig outputs):

-------

;; QUESTION SECTION:
;xd-ad.example.com.		IN	MX

;; ANSWER SECTION:
xd-ad.example.com.	900	IN	MX	0 www.example.net.

;; AUTHORITY SECTION:
example.com.		900	IN	NS	ns1.example.com.

;; ADDITIONAL SECTION:
www.example.net.	900	IN	A	192.0.2.2
ns1.example.com.	900	IN	A	192.0.2.1

--------

;; QUESTION SECTION:
;xd-cn.example.com.		IN	A

;; ANSWER SECTION:
xd-cn.example.com.	900	IN	CNAME	www.example.net.
www.example.net.	900	IN	A	192.0.2.2

;; AUTHORITY SECTION:
example.net.		900	IN	NS	ns1.example.net.

;; ADDITIONAL SECTION:
ns1.example.net.	900	IN	A	192.0.2.1

--------

In both of the above cases, if a cache server were following the usual
"in bailiwick" rules, it would ignore all of the example.net records
it received in these responses to queries about example.com names,
which makes it seem silly to send them in the first place.  On the
other hand, ns1.example.com and ns1.example.net actually use the same
IP address.  In theory, a cache could be smart enough to say "hey I
cached a nameserver at 192.0.2.1 for example.net a few minutes ago,
and now I've received example.net records from 192.0.2.1 when I was
looking up an example.com name, so since the nameserver IPs are the
same, we'll cache the example.net records as well".

My questions are: Is there anything wrong with the cache's reasoning
for accepting records that are technically out-of-bailiwick, but for
which it knows both bailiwicks are served by the same server IP?  Do
any widely used caches employ this trick, or are the example.net
records pretty much universally thrown out these days?  I ask because
I'm facing the decision of whether to include these "out-of-bailiwick,
but authoritatively served by the same server" additional/cname
references in an authoritative server, and I'm not really sure whether
it's a better design decision to include them (as BIND does) or leave
them out completely (since by most published writings on the subject,
they would be universally ignored).

Thanks,
-- Brandon