Choose the query type and the correct delegation side
04A selected probe type is independent of the incoming type, and DS belongs on the parent side.
In this separate A foo.example.org case, equal cached foo.example.org NS data is eligible. CHILD already equals the original name, so normal resolution starts at the child.
Source for this drawing: RFC 9156 · Read RFC section 2.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
NS remains permitted, but suitable below-cut data QTYPEs such as A/AAAA may be used without relating the selection to the incoming type. This is a replacement publication, not a ban on NS.
Read the updated RFC section ↗The selected minimising QTYPE must have authority below the zone cut and must be selected without a relation to the incoming QTYPE (§2.1). A and AAAA are good candidates; this guide chooses A. A probe type may coincide with an incoming type without having been selected because of it.
- The selected minimising QTYPE must have authority below the zone cut and must be selected without a relation to the incoming QTYPE (§2.1). A and AAAA are good candidates; this guide chooses A. A probe type may coincide with an incoming type without having been selected because of it.
- NS is still allowed. RFC 9156 relaxes RFC 7816’s recommendation to use NS; it does not ban NS or require A. The excluded minimising types listed in §2.1 are DS, NSEC, NSEC3, OPT, TSIG, TKEY, ANY, MAILA, MAILB, AXFR and IXFR. Our helper accepts only a documented small subset of permitted data types, not the entire IANA registry.
- For an original parent-side query such as DS (Delegation Signer), find the closest usable cached NS owner matching QNAME with one label removed. Do not choose the equal child delegation merely because it is the longest textual match (§3 step 1a). This is original-query handling; it does not make DS an allowed probe type.
- With cached example.org and foo.example.org NS data, original DS foo.example.org uses ANCESTOR example.org. CHILD is already one label shorter than the original name, so normal DS resolution starts from the parent’s servers (§3 steps2–3). For original A foo.example.org, the equal foo delegation can be selected and normal resolution starts there (§3 step 1b).
- An NS record set names servers; getting their usable addresses is a separate ordinary DNS concern. Parent-side choice and query minimisation do not remove address lookups or DNSSEC validation work. This guide makes no trust verdict from a chosen suffix.
Documentation-domain examples. Suffixes, supplied response events and label budgets are bounded teaching models, not a DNS wire codec, validating resolver or live privacy measurement.
Read the RFC section ↗