Re: [DNSOP] partial glue is not enough, I-D Action: draft-ietf-dnsop-glue-is-not-optional-00.txt

[John R Levine <[e-mail]>]

On Thu, 2 Jul 2020, Paul Vixie wrote:

> until someone invents faster than light travel, round trips and remote state
> will be the second and third most expensive things on the internet. (the most
> expensive thing is complexity.) i think we can usefully discuss whether to set
> TC=1 if the only thing that won't fit is glue, but some glue did fit. but our
> goal should be to allow smart initiators to avoid retrying with TCP out of
> reflex. my recommendation of TC=0 is to suppress reflexive TCP retries.

I wouldn't disagree but it seems to me once again it's a tradeoff between 
performance and correctness.  I'd prefer correctness, particularly since 
it seems that the option to use what's in a truncated referral gets you 
both.

> 3. even without TC=1 you will know there's under-zonecut glue you didn't
> receive, because you saw the NS RR, and the only path to the address RR is
> through that NS RRset.

Well, maybe.  Even if you got one A record there might be others.  Or if 
you got an AAAA record but no A record and you're on an IPv4 network, you 
can't tell whether there's a lurking A record or not, or vice-versa. 
(See the glue for j.zdnscloud.com in the root.)

If we do it your way, if any NS is in-zone and the lookups fail, you 
*always* need to do a TCP query just to see if if the UDP response left 
something out.

R's,
John

PS: I'm less worried about round-robin DNS, since then it's clearly a
deliberate decision by the parent to leave some of the answers out.