> On 29 Jul 2026, at 09:48, Philip Homburg <[email protected]> wrote: > >> - When DE=1, the authoritative server includes all Delegation Type >> RRsets present at the delegation point, together with the NS RRset >> (if one exists). In the current design, a server omitting an NS >> RRset is an optimisation, not a security feature. > > If I remember correctly, the original purpose of DE was the optimization > to leave out NS when DELEG records were present.
The DE flag was introduced as a capability negotiation mechanism, indicating that the resolver understands DELEG. Omitting the NS RRset was a natural optimisation of the protocol semantics adopted for DELEG (why send NS it if it is not used), but not the purpose of the DE flag itself. > Later it became more > complicated. > > I think it is mostly for the deleg wg to discuss, I’m afraid we need to discuss this in the DNSOP WG as per the AD’s instructions at the time, as that is where this draft now resides. > do we want the extra > complexity for this optimization or not. What does it mean operationally, > when delegation replies get bigger due to inclusion of NS records. The Response size gets larger when all Delegation Types and NS records are included, compared to solely Delegation Types. That is indeed a consequence of my proposed modification. However, new Delegation Types do not necessarily need to have a DELEG RRset, so the cost of larger responses now should be offset against even larger responses in the future, if we don’t make the change. Roy _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
