Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Nico Williams <[e-mail]>]

On Tue, Sep 15, 2015 at 07:00:36PM +0000, Viktor Dukhovni wrote:
> I for one don't see any reason to support multiple realms in the
> response.

Some services have the same name in multiple realms...  If there's a
more preferred transit path (or not every path is available) then in
principle a client (or referral issuer) might need to know about the
service's multiple realms.  A KDC issuing referrals can certainly pick
the better realm based on the transit path that will be required (though
this need not be the optimal path from the service's point of view) to
reach it given the capaths information available to the KDC.

So multiple PTR RRs can be meaningfully supported, but I agree that by
and large only one should be published, and that supporting more than
one will impose a significant additional burden for implementors.

Nico
--