Re: [knot-dns-users] Additional section

Hi Charles, generally speaking - if the stuff in ADDITIONAL section is not inside the domain you are asking (and at the same level) it should not be used by secure resolver. You can see exact example at my personal domain name: rfc1925.org. Try asking: # kdig IN A www.rfc1925.org @master.dns.rocks - this is Knot DNS and it will only return ANSWER and AUTHORITY section because neither trubka.network.cz nor master.dns.rock falls within "rfc1925.org" bailiwick. # kdig IN A www.rfc1925.org @trubka.network.cz - this server is running BIND and it will return all kind of (useless) stuff in ADDITIONAL section. Why the data cannot be used? Data for "trubka.network.cz" is not in the bailiwick (and if you are querying this server you already know the answer), data for "master.dns.rocks" cannot be used, because the resolver have no idea if "trubka.network.cz" is also authoritative server for "dns.rocks" unless the resolver also does the bottom-up lookup for the "master.dns.rocks" - and in that case you would also already know the answer. On the other hand, there are legitimate uses of ADDITIONAL section, see this query: # kdig IN SOA dns.rocks @master.dns.rocks This query returns IPv4/v6 addresses of master.dns.rocks in ADDITIONAL section because they are in the bailiwick of the dns.rocks zone (and at the same level - that means the resolver can be sure the name is not delegated elsewhere). The other legitimate use is providing GLUE records in the parent zone. Cheers, -- Ondřej Surý -- Chief Science Officer -------------------------------------------- CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC Milesovska 5, 130 00 Praha 3, Czech Republic mailto:ondrej.sury@nic.cz https://nic.cz/ -------------------------------------------- ----- Original Message -----