Delegation01

Status: Final

Purpose

• Validate that delegation-side and child-side nameserver sets meet minimum-count requirements overall and per IP family.
• Flag any in-bailiwick delegation NS name that the parent referral ships without the required A/AAAA glue.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Delegation names from z.GlueNames(ctx) .
  • Child NS names from z.ApexNSNames(ctx) .
  • Delegation nameserver addresses from GlueNameservers .
  • Child nameserver addresses from ApexNameservers .
  • Raw delegation items from DelegationNameservers , which carry in-bailiwick NS names without an address when the referral has no glue for them.
• Profile/config knobs that affect behavior:
  • No direct profile knob in this testcase.
  • Minimum required nameserver count is fixed by constants.MinimumNumberOfNameservers.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Get delegation NS names (z.GlueNames ), sort names, and emit one of:
   • ENOUGH_NS_DEL when count is at least the minimum.
   • NOT_ENOUGH_NS_DEL otherwise.
3. Get child NS names (z.ApexNSNames ), sort names, and emit one of:
   • ENOUGH_NS_CHILD when count is at least the minimum.
   • NOT_ENOUGH_NS_CHILD otherwise.
4. Get child addressed NS (ApexNameservers ), split by IP family, count unique NS names per family, and emit per family:
   • IPv4: ENOUGH_IPV4_NS_CHILD, NOT_ENOUGH_IPV4_NS_CHILD, or NO_IPV4_NS_CHILD.
   • IPv6: ENOUGH_IPV6_NS_CHILD, NOT_ENOUGH_IPV6_NS_CHILD, or NO_IPV6_NS_CHILD.
5. Get delegation addressed NS (GlueNameservers ), split by IP family, count unique NS names per family, and emit per family:
   • IPv4: ENOUGH_IPV4_NS_DEL, NOT_ENOUGH_IPV4_NS_DEL, or NO_IPV4_NS_DEL.
   • IPv6: ENOUGH_IPV6_NS_DEL, NOT_ENOUGH_IPV6_NS_DEL, or NO_IPV6_NS_DEL.
6. Get raw delegation items (DelegationNameservers ). For each in-bailiwick NS name that has no address in any item (the referral shipped no glue for it), emit IN_BAILIWICK_GLUE_MISSING (one per name, sorted). Out-of-bailiwick names are out of scope here.
7. Emit TEST_CASE_END.

In-Bailiwick Glue Presence Check (step 6)

A delegation NS name that lies inside the zone (in-bailiwick) can only be reached if the parent referral carries its address as glue; otherwise a resolver holding only the referral cannot resolve the name (the address lives inside the very zone the name serves). The raw referral view from DelegationNameservers is used here rather than GlueNameservers , because the latter resolves the name through the recursor and would mask the missing glue.

items = DelegationNameservers(z)
for each in-bailiwick NS name with no addressed item:
   IN_BAILIWICK_GLUE_MISSING (ns)

Overall NS Count Checks (steps 2-3)

delegation NS names = sort(z.GlueNames)
   len >= constants.MinimumNumberOfNameservers -> ENOUGH_NS_DEL     (count, minimum, servers)
   otherwise                                   -> NOT_ENOUGH_NS_DEL (count, minimum, servers)

child NS names = sort(z.ApexNSNames)
   len >= constants.MinimumNumberOfNameservers -> ENOUGH_NS_CHILD     (count, minimum, servers)
   otherwise                                   -> NOT_ENOUGH_NS_CHILD (count, minimum, servers)

Per-Family Addressed NS Checks (steps 4-5)

Same shape runs four times: child IPv4, child IPv6, delegation IPv4, delegation IPv6.

Per side <SIDE> in {CHILD (ApexNameservers), DEL (GlueNameservers)}:
  Per family <V> in {IPV4, IPV6}:
    count = unique-NS-name count whose address is in that family

    count == 0                                      -> NO_<V>_NS_<SIDE>
    0 < count <  MinimumNumberOfNameservers         -> NOT_ENOUGH_<V>_NS_<SIDE>
    count >= MinimumNumberOfNameservers             -> ENOUGH_<V>_NS_<SIDE>

  All tags carry (count, minimum, servers)

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Differences (Upstream vs Gonemaster):
  • Upstream: describes delegation-side IPv4/IPv6 checks before child-side IPv4/IPv6 checks. Gonemaster: performs child-side family checks first, then delegation-side family checks.
  • Upstream: does not describe testcase boundary debug markers. Gonemaster: emits TEST_CASE_START and TEST_CASE_END.
  • Upstream: only counts NS names with at least one address in aggregate, so a single in-bailiwick name missing its glue is absorbed into the count and never flagged. Gonemaster: additionally flags each such name with IN_BAILIWICK_GLUE_MISSING.
• Potential upstream report:
  • yes (feature proposal: per-name in-bailiwick glue presence)

Edge Cases And Limitations

• Per-family counts are by unique NS name, not by count of IP addresses.
• A single NS name can contribute to both IPv4 and IPv6 counts when it has both address families.
• Any method error aborts testcase execution and can prevent later tags from being emitted.
• The glue-presence check uses the raw parent referral (DelegationNameservers), not GlueNameservers, so a name resolvable only via the recursor still counts as missing glue.
• Out-of-bailiwick NS names are out of scope for the glue-presence check; their resolvability is covered by other testcases.