Re: [DNSOP] Alias mode processing in auths for draft-ietf-dnsop-svcb-https-01

[Ben Schwartz <[e-mail]>]

On Tue, Aug 11, 2020 at 6:18 PM Tony Finch <[e-mail]> wrote:

> Ben Schwartz <bemasc=[e-mail]> wrote:
>
...

> > In this procedure, "all returned records" for follow-up queries are added
> > to the Additional section.  Therefore, there could be SOA records in the
> > Additional section.
>
> I thought the target types were just A, AAAA, SVCB, so where does the SOA
> come from?


If one of the follow-up queries for those types returns NODATA, there could
be an SOA in the Authority section.  "all returned records" includes all
sections, so it would be copied into the Additional section (in this
procedure).

On Tue, Aug 11, 2020 at 6:38 PM Tony Finch <[e-mail]> wrote:
...

>
> > It seems to me that returning a (downward) delegation could actually be
> > useful.  So why not include that?
>
> Additional section processing does not normally include referrals.


Do you know why not?  It seems like a logical thing to include, if you
predict that the resolver will be making a followup query for which you
have a delegation.

That
> would be weird and new. I thought the point of the SVCB record was to
> appear to existing auth and recursive DNS servers as much as possible like
> a bog standard RR type, i.e. just wire and presentation format and a bit
> of normal additional section processing.


Is there a standard for "normal additional section processing"?  My
impression is that it is RR-type-dependent, so defining what should go
there is in the purview of this draft.

Which is basically what the draft
> says now, though it unnecessarily respecifies additional section
> processing.
>

Yes, the intent is to work well with "normal additional section
processing", but Pieter and Brian requested some behaviors or
clarifications in this thread, related to CNAME and SOA records, that are
either unclear or not supported with "normal additional section
processing".  Hence this proposal, which would leave us in the following
position:
* Auths are not required to do any additional section processing
* Auths SHOULD do some kind of additional section processing, details
unspecified
* Auths MAY do this specific form of additional section processing, which
follows CNAME chains, enables negative caching, and (maybe) even provides
referrals when appropriate.

Do you think this proposal would not actually work?  Or do you think that
it is simply too inconvenient to implement?

I would also like to hear Pieter's perspective, since the proposal is based
on his request in this thread.


> Tony.
> --
> f.anthony.n.finch  <[e-mail]>  http://dotat.at/
> Mull of Kintyre to Ardnamurchan Point: Variable, mainly north or
> northwest, 2
> to 4, occasionally 5 near the Mull of Kintyre and Tiree. Slight,
> occasionally
> smooth in shelter, becoming slight or moderate later. Fog patches
> developing.
> Moderate or good, occasionally very poor.
>