Subject: Re: does anybody use additional/authority records on RD/RA replies

From: Paul Vixie <[email-masked]>
Date: Sat, 11 Jan 2003 18:33:49 +0000

> In a refreshing change, here is a question about DNS.
> 
> I'm wondering if anybody knows of any client library actually using
> additional/authority records in answers to recursion desired/recursion
> available questions, with the exception of the SOA negative presence
> indication.

sure.  sendmail's internal getmxrr does this, to try to get the MX and A
from a single dns transaction.  as far as i know, so does kerberos's 
internal getsrvbyname.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Sat, 11 Jan 2003 19:45:56 +0000

> An example is www.bibleinfo.org which defines its own NS records with a 10
> second TTL. After those are passed, the 'best' NS records are the ORG ones,
> which are then attached to the answer, leading to an overly large packet.
> 
> A simple solution to that is not allowing a child to lower the TTL of
> existing records, but that does not solve the root issue of the silliness of
> adding the 'best' NS records known. Was there a non-human rationale to
> adding those?

the child zone owns the delegation point.  the parent's zone-bottom NS RR's
are not authoritative in the parent, they are just hints/glue.  the child's
data, no matter how icky the TTL's are, is what you have to keep, TTL and all.

you could keep an opaqued copy of the parent's hints/glue around, so that
when the child's NS RRset expires, you can go back to the glue that got you
to the child in the first place.  but you have to keep going back to the
child.