<html><head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:B7C37977-A543-42E6-976A-E155102F9B32@ogud.com" type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="ogud@ogud.com" photoname="Olafur Gudmundsson"
src="cid:part1.09060306.01040502@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:ogud@ogud.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Olafur Gudmundsson</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Tuesday, January
27, 2015 1:22 PM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div><!----><br>The original
reasoning was to save round trip times and network bandwidth. <br>This
does not hold any more as Dan Kaminsky showed us how to use extra data
as <br>cache poison via forged answers. <br><br>In DNS referrals there
is value for extra data when name servers are below the zone cut. <br>In
no other situation do I see value for application to see anything that
is not<br>in the first NON-empty response section. (i.e. either Answer
or, Authority) <br><br>I have been thinking about shortening MX answers
by only include the Answer section and<br>violate the server side
processing of additional records. If Florian and Tony are right then
that should be harmless. As in most cases these days mail servers are
outside the domain.<br>
</div></div>
</blockquote>
<br>
i'm fine with additional data that's within the bailiwick of a referral,
but also, with data whose owner name matches the qname. so, including
AAAA as additional data for QTYPE=A, and including A as additional data
for QTYPE=AAAA, has no "kaminsky problem", and could save round trips.<br>
<br>
note, it has to match the QNAME, not the final owner of a CNAME chain,
to qualify for this treatment.<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>