AWS DNS services break qname minimization
AWS Engineer here. I haven&#x27;t worked directly on Route 53 in a few years, but I wrote most of the DNS answering logic back when we built Route 53. Route 53 is a so-called &quot;child centric&quot; DNS server, in that it considers the child zone to be fully-authoritative for its own NS records. That&#x27;s why the name servers for a parent zone reply with a referral, rather than in the answer, because from their perspective, they don&#x27;t really &quot;know&quot; the answer. The proper thing a resolver should do is follow the referral and ask the child name servers.<p>I don&#x27;t think that&#x27;s in violation of what the DNS RFCs specify (though the older DNS RFCs are not great at being specific), and I remember making the decision based on what would work best, and be least likely to poison resolvers, in the event of domains being moved between customers, providers, or across accounts for some reason. Setting up the child name servers to say &quot;have moved here ...&quot; can speed those processes up.<p>I&#x27;m sure the Route 53 team will look at this and make whatever change is best, but I also strongly suspect that QNAME minimization may rest on under-specified or un-specified ideas about what authoritative name servers should do. I&#x27;d have it follow referrals if it doesn&#x27;t already.<p>In any event, I think what&#x27;s going in this case is more subtle but simpler, basically &quot;ws.fdmg.org.&quot; isn&#x27;t occluding &quot;prod.ws.fdmg.org&quot; when it should, but that takes a very convoluted edge-case set up involving two over-lapping delegations from the same parent zone.