Re: [Resolverless-dns] Load-balancing concerns

[Justin Henck <[e-mail]>]

Got it, I made a mistake and inferred behavior from recursives :-/

How is a "resolverless" (unrequested resolution?) solution here any
different from sharing a recursive, if we use ECS or if the primary service
is widely deployed?

E.g. it seems to me that there are three scenarios:
1) really large globally distributed services implementing will act like
geographicaply distributed resolvers, which some of them also are
2) small single-datacenter services won't produce enough traffic to matter
3) large single-datacenter services might cause a problem

Are there other negative scenarios? I suppose 1 but not very well
distributed?


On Thu, Nov 8, 2018, 3:47 PM Jim Reid <[e-mail] wrote:

>
>
> > On 8 Nov 2018, at 08:19, Justin Henck <henck=[e-mail]>
> wrote:
> >
> > You'll have to forgive my ignorance - I definitely don't pretend to be
> an expert in any of these areas.  My understanding (please correct me!) was
> that generally an authoritative will return a single A or AAAA record based
> on a particular query, but with DNSSEC it will return an entire relevant
> RRSET.
>
> Not quite. If an authoritative server is queried for the A or AAAA records
> for some name, it will return all the matching A (or AAAA) records. [Modulo
> truncated responses and TCP retries.] It won't return a single A or AAAA
> record unless of course there's only one of them.
>
> When DNSSEC is used, authoritative servers return RRsets.* That's because
> the signature covers the RRset and the validator has to have all of the
> original data -- the RRset -- so that it can validate the signed response.
>
> *That's pretty much the same as the unsigned response with the addition of
> some extra RRtypes for the DNSSEC special sauce.
>
>