Bailiwick and "Sibling domain" definition

If I do the following command dig allcosts.net @g.gtld-servers.net, I will get:

;; QUESTION SECTION:
;allcosts.net.          IN  A

;; AUTHORITY SECTION:
allcosts.net.       172800  IN  NS  ns-22.awsdns-02.com.
allcosts.net.       172800  IN  NS  ns-912.awsdns-50.net.
allcosts.net.       172800  IN  NS  ns-1834.awsdns-37.co.uk.
allcosts.net.       172800  IN  NS  ns-1233.awsdns-26.org.

;; ADDITIONAL SECTION:
ns-912.awsdns-50.net.   172800  IN  A   205.251.195.144

According to amazon (link here) ".net customers actually get the benefit of two in-bailiwick glue records", meaning the ADDITIONAL is considered as in-bailiwick.

I'm trying to understand why "ns-912.awsdns-50.net." is in-bailiwick here.

The RFC 8499 show an example if a similar situation:

   Delegation |Parent|Name Server Name  | Type
   -----------+------+------------------+-----------------------------
   example.org| org  |ns.ietf.org       |in-bailiwick / sibling domain

The delegation is for allcosts.net, the parent is net and the name server ns-912.awsdns-50.net.. Following the example from the RFC, that would mean it is a sibling domain.

Here is the definition of a sibling domain:

Sibling domain: a name server's name that is either subordinate
         to or (rarely) the same as the zone origin and not subordinate
         to or the same as the owner name of the NS resource records.
         Glue records for sibling domains are allowed, but not
         necessary.

If I understand, they both have the same zone origin (net) and not subordinate/same owner (allcosts.net vs ns-912.awsdns-50.net), making them sibling. Did I make correct assumptions here?


I'm trying to understand why "ns-912.awsdns-50.net." is in-bailiwick here.

Because it is under .net TLD and you are asking for a .net domain name.

But even then, as the RFC states, the glues are not strictly necessary because the nameserver name, while under .net is under a different domain name than the one you queried for. There is hence no logical problem in doing another query to retrieve this nameserver IP address, but the authoritative nameserver is trying to be helpful by providing it to you immediately in ADDITIONAL section.

This may not be similar in other TLDs.

Your assumptions are correct, except maybe this part which is unclear at least:

meaning the ADDITIONAL is considered as in-bailiwick.

It is not because something is in ADDITIONAL that it is in-bailiwick or not.

ADDITIONAL section was designed to carry whatever useful extra data the resolver wish to send without having it considered authoritative (and not signed by DNSSEC). Lot of things could be there, but past events showed that recursive nameservers should be very cautious to take information from that section, so it should be used only when strictly necessary because no other path, which means basically this is for glues (in-bailiwick and not sibling). So glues will be in ADDITIONAL section, but not everything in ADDITIONAL section is necessarily glues all the time.