[DNSOP] Clarifying referrals (#35)

[Andrew Sullivan <[e-mail]>]

Dear colleagues,

In github tracker issue #35
(https://github.com/DNSOP/draft-ietf-dnsop-terminology-bis/issues/35),
we have an item about the way Referral is defined in RFC 7719.  The
issue mostly comes from the (as usual incisive) observations of Tony
Finch.  I think he's right.

I think a change is in order, but I'm not fully convinced of the
following text, so that's why I'm putting it here for discussion.  My
co-editors do not deserve the brickbats, so fling them at me.  There
are questions at the end of this proposed text, because there are two
issues about which I am very much in doubt and I'm too lazy to
convince myself of the right answer when I can just ask everyone.

---%<---cut here---

Referral: A type of response in which a server, signalling that it is
not authoritative for an answer, provides the querying resolver with
an alternative place to send its query.

All referral responses follow the same form.  The response has the AA
bit cleared.  It has an empty Answer section.  It has an Authority
section containing an RRset in which the owner name is the referred-to
zone, the class is the queried class, the type is NS, and the RDATA
holds the nameservers for the referred-to owner name as known by the
responding server.  The response might also have an Additonal section
containing glue records.

There are two types of referral response.  The first is a delegation
referral (sometimes described as "delegation response"), where the
server is authoritative for some portion of the QNAME.  The Authority
section RRset's RDATA contains the name servers specified at the zone
cut.  In normal DNS operation, this kind of response is required in
order to find names beneath a delegation.

The second is a non-delegation referral (sometimes described as
"referral response", as distinct from the delegation response above),
where the server is not authoritative for any portion of the QNAME.
In this case, the referred-to zone in the Authority section is
usually[1] the root zone (.).  In normal DNS operation, this kind of
response is not strictly speaking required to work, and in practice
some authoritative server operators will not return referral responses
beyond those required for delegation.

---cut here--->%---

First, on [1], it seems to me that in principle it ought to be
possible for this sort of referral to refer to something other than
. , but I can't come up with an example where it happens or really
ought to happen.  Is this case actually necessarily a referral to the
root?  (In that case, also, the name of this type should be "root
referral", I guess?)

Second, is there any circumstance in which glue in a non-delegation
referral ought not to be treated as possible poison, and just thrown
away?  It seems to me that a root referral ought automatically to
cause the resolver to go to the results of a priming query and follow
that chain.  No?  Also, maybe that's not a terminological issue, and
so it ought to be left out of the document anyway.  In any case, I
seek guidance from the WG.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]