[dnsext] NS/NSEC/NSEC3 records in the Additional section

[Klaus Malorny <[e-mail]>]

Hi,

it would be great if any of the experts here could do me a favour and help me on 
the following question, as I did not find a satisfying answer on my research in 
the relevant RFCs.

I am wondering whether the Additional section may contain NS records, and, if 
so, whether the respective NSEC/NSEC3 record to prove the non-existence of the 
DS record for this delegation shall be placed also in the Additional section or 
in the Authority section instead.

If I have the following zone,

tld.                SOA ...
tld.                NS     ns1.sld.tld.

sld.tld.            NS     ns2.other.
sld.tld.            NS     ns3.other.

I think it would make sense to include the NS records of sld.tld. (and DS 
records if signed) in the Additional section if the NS records of tld. are 
included in the Authority section, as this information is available anyway and 
should be useful for the resolver. This is, however, contrary to the behaviour 
of BIND, which I consider as a reference.

Also, in the case that tld. is signed and sld.tld. not, the question is whether 
the respective NSEC/NSEC3 record shall be also in the Additional section. RFCs 
403x and 5155 mention only the Authority section, but the described case does 
not occur at all in these RFCs (unless I missed it).

Regards,

Klaus