Subject: [dnsext] Spec for AA in query meaning AA-only?

From: Phil Pennock <[email-masked]>
Date: Tue, 8 Feb 2011 01:37:59 -0500

RFC 1035 defines AA for responses; I'm failing to find a specification
which states that AA in a query means AA-only.

I see +aaonly for dig.  Not finding a reference.

Am I missing it or is this only an informal convention?

Thanks,
-Phil

---

From: "George Barwood" <[email-masked]>
Date: Tue, 8 Feb 2011 08:28:20 -0000

----- Original Message ----- 
From: "Phil Pennock" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, February 08, 2011 6:37 AM
Subject: [dnsext] Spec for AA in query meaning AA-only?

> which states that AA in a query means AA-only.

The meaning of the AA flag bit in a query is not defined by the standard.
General principles dictate that senders should leave the bit zero, receivers should ignore it.

> I see +aaonly for dig.  Not finding a reference.

This is apparently an historic relic. I presume that at some point in the distant past some
servers must have assigned a meaning to AA being set in a query.
 
> Am I missing it or is this only an informal convention?

I don't think you have missed anything.

Regards,
George
 
> Thanks,
> -Phil
> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext

---

From: bert hubert <[email-masked]>
Date: Tue, 8 Feb 2011 10:56:19 +0100

On Tue, Feb 8, 2011 at 7:37 AM, Phil Pennock <[email-masked]
> wrote:

> which states that AA in a query means AA-only.

I've never thought it meant that in a query. So even if this is an informal
convention, it is not implemented universally, at least not in PowerDNS.

   Bert

---

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 08 Feb 2011 07:23:04 -0500

> Am I missing it or is this only an informal convention?

It is an artifact of an idea that Paul Vixie had many years ago
to mean "Authoritative Answers Only".
The idea did not gain traction with the DNS protocol community, but the 
experimental code is still in dig after all these years  (look for
aaonly in bin/dig directory. I do not think the code is in the name-server.

If I recall correctly this was intended to force resolvers to go back to 
authoritative servers and get answer from them rather than give answer 
from cache.

IMHO it is perfectly acceptable for a resolver to reject a query with AA 
bit set as "malformed".

	Olafur

---

From: Evan Hunt <[email-masked]>
Date: Tue, 8 Feb 2011 19:35:39 +0000

> This is apparently an historic relic. I presume that at some point in the
> distant past some servers must have assigned a meaning to AA being set in
> a query.

dig is a DNS debugging tool; it's capable of sending oddly-formed queries
so as to find out how servers respond.  Just because dig can do something
doesn't mean it's a good idea. :)

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.