Re: [dnsext] NS/NSEC/NSEC3 records in the Additional section

[Klaus Malorny <[e-mail]>]

On 19/05/11 12:57, Florian Weimer wrote:
> * Klaus Malorny:
>
> You should send unusual records only in response to DO=1 queries.
> Otherwise, you risk that the client cannot interpret them.  (The risk
> with DNSSEC-capable clients is still there, of course, but it seems
> less.)

That statement makes me wonder how robust the resolvers are ;-)

>
> There is no precedent for copying NS records to the additional section,
> AFAIK.  Given the amount of work put into reducing response sizes, it's
> also unlikely that such a feature would be a win for all parties
> involved.
>

Yes, but the idea was that if the NS records in the authority section are of any 
use (while only the use as alternative name servers comes to my mind), then the 
additional NS records would allow to omit an extra query to the tld. name servers.

While in the meantime I more or less managed to cope with the complexity of 
authoritative name servers (esp. in conjunction with DNSSEC), resolvers are 
still somewhat secret and magical to me. So I probably will stay away from that 
idea for the sake of stability and reliability.

Regards,

Klaus