lib: child-side NS records are not always fetched
Activity
depends on #36
This should be OK now, though we could implement that "post-prefetching" idea from Ondra. That would better be done as a separate request, so it doesn't depend on #36.
We should discuss this first.
I think that using child-side NS partially hide problems with desynchronized parent-child NS. It might even make the problem worse because nobody will notice delays until the last working NS on parent side breaks - and then it stops working at once (instead of creeping delays).
For these reasons I would say that we should use parent-side NS and ignore child-side NS. This is up to discussion.
added needinfo label
-
That's for a long discussion, I guess, and we've touched it already months ago. Traditionally the child-side NS records are considered to be "more accurate/trustworthy". Parent-side NS also won't be signed, but there won't be any real impact on security, as NS records stand outside the chains of trust (except when returning themselves). A recent IETF draft suggesting to change the ways: https://tools.ietf.org/html/draft-fujiwara-dnsop-resolver-update-00
We could make a switch controlling this, as the change would have to disregard some standard RFCs.
added ~773 and removed needinfo labels
Consider this again when looking into #246 (closed) .
marked this issue as related to #658
