Re: [DNSOP] question regarding draft-ietf-dnsop-aname-03.txt/authoritative name server response

[Matthijs Mekking <[e-mail]>]

Hi Ralf,

On 5/29/19 7:42 AM, Ralf Weber wrote:
> Moin!
> 
> On 28 May 2019, at 21:14, Matthijs Mekking wrote:
>> For authoritative servers that receive A or AAAA requests, the address
>> records shall appear only once: in the answer section.  It is correct
>> that those address records have the owner name and TTL adjusted (to the
>> owner name of the ANAME record and the minimum of the encountered TTLs).
>>
>> There is nothing in the additional section, except for the ANAME record,
>> as described in Section 6.1.1:
>>
>>    When a server receives an address query for a name that has an ANAME
>>    record, the response's Additional section MUST contain the ANAME
>>    record.  The ANAME record indicates to a client that it might wish to
>>    resolve the target address records itself.
> So that means an authoritative server could just use the “static” A
> records in the zone and just put in the ANAME in the additional section
> and not do any special processing at all, hoping the resolver does
> follow the ANAME?

Yes, it could do that. But it is not likely that this scenario is
particularly useful in the early stage of ANAME deployment.


>> Note that there is separate additional processing for authoritative
>> servers and resolvers.  For resolvers there is a requirement of having
>> target address records in the additional section.
> Why? They are the same that are in the answer section and for DNSSEC
> the signed ANAME is important and not the unsigned addresses or am I
> missing something?

Why is there a requirement or why is there a difference?

First, the word "requirement" is causing confusion here, I am sorry.
What I meant is that for resolvers the draft has a RFC 2119 keyword
related to adding target address records in the additional section (it's
a MAY). So not required, but optional.

Why is there different additional processing for authoritative servers
and resolvers?  Basically because in a traditional authoritative name
server the target address records are not available (so adding them is
not in scope), but a resolver may have them in the cache (and note these
may be signed address records).


Best regards,

Matthijs



> 
> So long
> -Ralf
> —--
> Ralf Weber
>