[musl] AD bit in outgoing DNS queries

[musl] AD bit in outgoing DNS queries

[Rich Felker]

In order to obtain information on whether the result is in a DNSSEC
signed zone, which is needed for some applications including
RFC-conforming use of DANE records, the AD bit must be set in the
outgoing DNS query, indicating support by the client.

musl's resolver library does not presently set the AD bit, and
historically (~5+ years ago) at least there were compatibility
problems with broken nameservers/firewalls/etc. failing to reply or
dropping packets if it was set. I'd really really like to just set it
unconditionally, since it's the modern, resonable, Right Thing to do,
and since making it configurable/stateful is nasty -- depending on how
you do it, it turns into either a:

- layer violation, if config affects res_mkquery rather than just
  res_query, or a

- least-surprise violation, if config only affects res_send and causes
  it to rewrite the header bits of the query at send-time.

We already don't support incredibly-broken nameservers like the
notorious ones on some home router appliances that drop concurrent A
and AAAA requests. But I don't want this to turn into some kinda big
regression if there are actually still broken setups in the wild.

Can anyone dig up information on whether this is non-issue like I hope
it is? So far I haven't turned up much reliable/recent information
either way.

Rich