Re: [DNSOP] I-D Action: draft-ietf-dnsop-glue-is-not-optional-02.txt

[Joe Abley <[e-mail]>]

On Jul 28, 2021, at 14:00, Paul Wouters <[e-mail]> wrote:

> If the zone example contains amongst other content:
> 
> foo.example. IN NS ns0.foo.example.
> foo.example. IN NS ns0.bar.example.
> ns0.foo.example. IN A 1.2.3.4
> ns0.bar.example. IN A 1.2.3.5
> 
> Then for the DNS server returning an NS query for foo.example, it is
> easy to either:
> 
> 1) return ns0.foo.example's A record
> 
> or
> 
> 2) return ns0.foo.example and ns0.bar.example. A records`
> 
> What is harder to do is determining whether it should or should not
> include ns0.bar.example's A record based on whether it is "needed" or
> not, as there are various kinds of loops possible.

So your assumption is that it's easier to return all possible glue for every nameserver in the delegation set than it is to return glue for just that subset that are subordinate to the zone cut.

Perhaps this is a good opportunity to let actual implementers let us know what is what.

>> I don't see where the "extra CPU power" you are talking about comes from.
> 
> To determine if the glue you know you have is "needed or not".

As I said, it seems to me that this is absolutely knowledge that you can gain at load time and it's not necessary to wait until response time to do the work. So I think the CPU consumption argument is not especially persuasive. However, I am not an implementer.

Regardless, it does seem to me that glue for nameservers that are subordinate to the zone cut is the MUST and other glue is at best a MAY.


Joe