Explicit DELEG queries should work

[RoyArends]

For the same reason explicit DS records need to work:

DS records are obscured when parent and child are hosted on the same server. Only an explicit DS request can establish a chain of trust. As an example, UK and CO.UK are hosted from the same server set, and explicit DS queries are needed to establish a chain of trust.

This can be made to work in the authoritative server by treating DELEG requests the same way as DS requests.

[shane-ns1]

IIRC DNAME also has language around explicit queries, possibly for similar reasons? :thinking:

[vttale]

Agreed, I've always expected that explicit DELEG queries would work. I'd also expect them to be returned in ANY queries, to the extent that the auth policy for ANY queries allows.