DNS Glue Requirements in Referral Responses
updates
- rfc-1034 — Domain names - concepts and facilities
Extracted elements (15)
In-domain glue records are not optional additional data; they are required for resolution. This is in contrast to other additional-section data which may be omitted freely. The document clarifies that the TC flag must be set rather than silently truncating required glue.
Sibling domain glue is treated as optional (SHOULD rather than MUST) because resolvers can make follow-on queries to resolve sibling name server addresses. The exception is cyclic sibling dependencies, which cannot be resolved without glue; however, such delegations are rare (222 out of ~209,000,000 total in a 2021 analysis).
This document only clarifies requirements for name server software implementations and does not introduce requirements for data placed in DNS zones or registries. The presence of glue in a zone is out of scope; only the behavior when glue is available is addressed.
At the time of writing, most DNS server implementations set TC only if none of the available glue records fit in a UDP response. The updated requirements may increase the fraction of UDP responses with TC=1 and consequently increase TCP query volume.
Real-world examples of missing glue with TC=0 have been observed and confirmed to cause resolution failures. An example from June 2020 shows a DNSSEC-signed referral where no glue fit in the UDP response but TC was not set.
UDP responses are generally limited to between 1232 and 4096 bytes due to values commonly used for the EDNS0 UDP Message Size field (RFC 6891); TCP responses are limited to 65,535 bytes.
If, after adding glue for all in-domain name servers, glue for sibling domain name servers does not fit due to message size constraints, the name server MAY set TC=1 but is not obligated to do so.
Upon receiving a response with TC flag set, the client SHOULD use another transport (e.g., TCP) to retrieve the full response.
When a name server generates a referral response, it SHOULD include all available glue records (including sibling domain name servers) in the additional section.
Cyclic sibling domain name servers occur when two sibling zones each reference the other's name servers. Cyclic dependencies can only be resolved when the delegating name server includes glue for the sibling domain in the referral response.
Glue records are A or AAAA address records for delegation name servers placed in the additional section of a referral response. At the time of writing, addresses (A or AAAA records) for a delegation's authoritative name servers are the only type of glue defined for the DNS.
In-domain name servers are NS records whose names fall below the delegation point (within the delegated zone itself). Their glue records are not optional in referral responses.
RFC 1034 step 3.b is updated to require that if all glue RRs for in-domain name servers do not fit in the referral response, TC=1 must be set in the header before proceeding to step 4.
Sibling domain name servers are NS records not in the delegated zone but in another zone delegated from the same parent. Glue for sibling name servers is generally optional but provided as an optimization.
This document clarifies correct DNS server behavior and does not introduce any changes or new security considerations.