Draft: draft-ietf-dnsop-glue-is-not-optional

Commentary:  updates ..    section , and clarify that they MUST be included , and also subject to TC=1 if they do n't fit . Remove the cross parent zone cyclic dependency example , which does n't work ( I think we agreed to that , but I can be persuaded to add it back , if we want to point out a misconfiguration as a warning ) . Move the paragraph about non - optionality of types of additional section data into the tail end of the Intro . It deserves to be more prominently mentioned than buried at the end of the example of missing glue . Addressed  's comment that the " Why is Glue Required ? " section did not actually say why , but instead just gave examples . Instead , I a one phrase explaining why to the Intro section that defines glue records . I do n't think it requires a separate section . Removed  's comment about " I think the document should say that some servers might experience an increase in TCP if implementations require all glue or set TC=1 . If not in this section then somewhere else . _ " . I agree we should address this , so I 've made an " issue " for it . And we can add the relevant text in the next update , once we figure out where it goes ( an " Operational Considerations " section perhaps ? ) . 
 - your tweaks . Please review / approve !
The DNS uses glue records to allow iterative clients to find the
addresses of nameservers that are contained within a delegated zone.
Servers are expected to return available glue records in referrals.
If message size constraints prevent the inclusion of all glue records
in a UDP response, the server MUST set the TC flag to inform the
client that the response is incomplete, and that the client SHOULD
use TCP to retrieve the full response.
The Domain Name System (DNS) RFC1034, RFC1035 uses glue records to
allow iterative clients to find the addresses of nameservers that are
contained within a delegated zone.  Glue records are added to the
parent zone as part of the delegation process.  Servers are expected
to return all available glue records in referrals.  If message size
constraints prevent the inclusion of all glue records in a UDP
response, the server MUST set the TC flag to inform the client that
the response is incomplete, and that the client SHOULD use TCP to
retrieve the full response.  This document clarifies that
expectation.
The DNS uses glue records to allow iterative clients to find the
addresses of nameservers that are contained within a delegated zone.
Authoritative Servers are expected to return all available glue
records in referrals.  If message size constraints prevent the
inclusion of all glue records in a UDP response, the server MUST set
the TC flag to inform the client that the response is incomplete, and
that the client SHOULD use TCP to retrieve the full response.
The Domain Name System (DNS) RFC1034, RFC1035 uses glue records to
allow iterative clients to find the addresses of nameservers that are
contained within a delegated zone.  Glue records are added to the
parent zone as part of the delegation process and returned in
referral responses, otherwise a resolver following the referral has
no way of finding these addresses.  Authoritative servers are
expected to return all available glue records in referrals.  If
message size constraints prevent the inclusion of all glue records in
a UDP response, the server MUST set the TC (Truncated) flag to inform
the client that the response is incomplete, and that the client
SHOULD use TCP to retrieve the full response.  This document
clarifies that expectation.
While not common, real life examples of servers that fail to set TC=1
when glue records are available exist and they do cause resolution
failures.
While not common, real life examples of servers that fail to set TC=1
when glue records are available, exist and they do cause resolution
failures.
Sibling glue are glue records that are not contained in the
delegating zone itself, but in another delegated zone.  In many
cases, these are not strictly required for resolution, since the
resolver can make follow-on queries to the same zone to resolve the
nameserver addresses after following the referral to the sibling
zone.  However, most nameserver implementations provide them as an
optimization to obviate the need for extra traffic.
Question: if sibling glue from the same delegating zone does not fit
into the response, should we also recommend or require that TC=1 be
set?
Here is a more complex example of sibling glue that lives in another
zone, but is required to resolve a circular dependency in the zone
configuration.
When a zone is deleted but the parent notices that its NS glue
records are required for other zones, it MAY opt to take these (now
orphaned) glue records into its own zone to ensure that other zones
depending on this glue are not broken.  Technically, these NS records
are no longer glue records, but authoritative data of the parent
zone, and should be added to the DNS response similarly to regular
glue records.
Sibling glue are glue records that are not contained in the delegated
zone itself, but in another delegated zone from the same parent.  In
many cases, these are not strictly required for resolution, since the
resolver can make follow-on queries to the same zone to resolve the
nameserver addresses after following the referral to the sibling
zone.  However, most nameserver implementations today provide them as
an optimization to obviate the need for extra traffic from iterative
resolvers.
This document clarifies that sibling glue (being part of all
available glue records) MUST be returned in referral responses, and
that the requirement to set TC=1 applies to sibling glue that cannot
fit in the response too.
Here the delegating zone "test" contains 2 sub-delegations for the
subzones "bar.test" and "foo.test".
When a zone is deleted but the parent notices that its NS glue
records are required for other zones, it MAY opt to take these (now
orphaned) glue records into its own zone to ensure that other zones
depending on this glue are not broken.  Technically, these address
records are no longer glue records, but authoritative data of the
parent zone, and should be added to the DNS response similarly to
regular glue records.