On Thu, Nov 02, 2023 at 04:09:24PM +1100, Mark Andrews <ma...@isc.org> wrote a message of 90 lines which said:
> I also see QNAME minimisation in action as the QTYPE is NS. This > could just be a open recursive servers using QNAME minimisation. > With QNAME minimisation working correctly all parent zones should > see is NS queries with the occasional DNSKEY and DS query. Both > BIND and Knot use NS queries for QNAME minimisation. I disagree. NS queries were used in the first RFC about QNAME minimisation (which was experimental) but the current one (which is on the standards track) now recommends A or AAAA queries <https://www.rfc-editor.org/info/rfc9156>, specially section 2.1. > Other query types and/or prefixes do not work as they have > undesirable side effects. Rather the contrary, some broken firewalls in front of authoritative name servers were crashing when using NS queries. Hence the choice of address queries. (Also, it improves privacy since it makes more difficult to see you are doing QNAME minimisation.) > I would not like anyone to take seeing mostly NS queries as any > evidence of bad practice. We agree here.
