[dns-operations] DNS trust dependencies for TLDs

[Florian Weimer]

* Antoin Verschuren:

> What would happen if we accidentally deleted all *.nic.nl A records
> from our nic.nl zone ?

Nothing at once, if there's still glue.  But if a client queries for
one of those names, some resolvers will issue a fresh upstream query,
cache the resulting NXDOMAIN and not use this particular server any
further.

> I would say no authoritative answer for .nl would exist anymore on
> the *.nic.nl nameservers, but the out of bailiwick nameservers would
> still produce valid answers for the .nl zone, and there is no way we
> could cause their glue to change, either in their zones, or at the
> root.

It's very brittle.  If those were the only servers for .nl, client
queries can make the zone unavailable from the point of view of the
resolver they use.