Re: [dnsext] NS/NSEC/NSEC3 records in the Additional section

Florian Weimer <fweimer@bfk.de> Thu, 19 May 2011 11:00 UTC

From: Florian Weimer <fweimer@bfk.de>
To: Klaus Malorny <Klaus.Malorny@knipp.de>
References: <4DD4CEFB.3050702@knipp.de>
Date: Thu, 19 May 2011 10:57:06 +0000
In-Reply-To: <4DD4CEFB.3050702@knipp.de> (Klaus Malorny's message of "Thu, 19 May 2011 10:04:11 +0200")
Message-ID: <82k4dnez5p.fsf@mid.bfk.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: dnsext@ietf.org
Subject: Re: [dnsext] NS/NSEC/NSEC3 records in the Additional section
Precedence: list

* Klaus Malorny:

> I think it would make sense to include the NS records of sld.tld. (and
> DS records if signed) in the Additional section if the NS records of
> tld. are included in the Authority section, as this information is
> available anyway and should be useful for the resolver. This is,
> however, contrary to the behaviour of BIND, which I consider as a
> reference.

You should send unusual records only in response to DO=1 queries.
Otherwise, you risk that the client cannot interpret them.  (The risk
with DNSSEC-capable clients is still there, of course, but it seems
less.)

There is no precedent for copying NS records to the additional section,
AFAIK.  Given the amount of work put into reducing response sizes, it's
also unlikely that such a feature would be a win for all parties
involved.

-- 
Florian Weimer                <fweimer@bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

[dnsext] NS/NSEC/NSEC3 records in the Additional … Klaus Malorny
Re: [dnsext] NS/NSEC/NSEC3 records in the Additio… Florian Weimer
Re: [dnsext] NS/NSEC/NSEC3 records in the Additio… Klaus Malorny
Re: [dnsext] NS/NSEC/NSEC3 records in the Additio… Edward Lewis