[dns-operations] Is there value to leaving additional-from-auth enabled?

[Paul Vixie]

baliwick rules pretty much don't work.  ns.columbia.edu might or might
not be a zone cut, so when you hear its A RR in a referral response
that supposedly came from the columbia.edu nameservers, you can't
really believe it.  you can use it to try to find that name server
for the duration of that iteratative transaction, but you can't use
it as an answer.