[Doh] assorted things

[bert hubert <[e-mail]>]

Hi everyone,

I'm going through -10 with fresh eyes, so I may be discovering some parts
that are not obvious to the outsider, or at least this reader. 

This paragraph in 4 seems to be important, but I can't figure out what it is
trying to achieve:

   A DNS API client MUST NOT use a different URI simply because it was
   discovered outside of the client's configuration, or because a server
   offers an unsolicited response that appears to be a valid answer to a
   DNS query.  This specification does not extend DNS resolution
   privileges to URIs that are not recognized by the DNS API client as
   configured URIs.  Such scenarios may create additional operational,
   tracking, and security hazards that require limitations for safe
   usage.  A future specification may support this use case.

Does this say "don't just use any URI"?  What are 'DNS resolution
privileges'? Is this about disallowing javascript to send out random DNS
queries? 

This sentence:

   Some of these non-successful HTTP responses (e.g., redirects or
   authentication failures) could mean that clients need to make new
   requests to satisfy the original question.

I would recommending teeth to this. Naive implementations may decide to not
follow 3xx codes. I would recommend making this explicit with a MUST. Also,
it may be worth it to explicitly say if authentication is in our out of
scope. Here it is a bit uncertain if you'd ever prompt a user for a
username/password for doing DNS resolution. 

In 6.3 "Server Push":
   For HTTP server push ([RFC7540] Section 8.2) extra care must be taken to
   ensure that the pushed URI is one that the client would have directed the
   same query to if the client had initiated the request.

This means an API server is free to send responses to DNS queries we haven't
seen yet?  And should a client do something with that?  Or can it ignore the
pushed records?

	Bert