EDNS Client Subnet (ECS) : Can I receive the clients IPs by default?

Question

I'm setting up a Bind service version 9.9.5 as an authoritative only server. I would like to know if I receive EDNS Client Subnet (ECS) queries which includes clients IPS by default. I know that I can configure it to respond to specific prefixes (like this), but I'm not sure if the upstream DNS first checks that my NS can handle or not before sending the clients IPs/subnet. Is there anything like enabling ECS on the Bind server to receive such traffics?

Answer 1

As written in the very own page you reference:

The EDNS Client Subnet (ECS) option is used by a recursive resolver to inform an authoritative name server of the network address block from which the original query was received, enabling authoritative servers to give different answers to the same resolver for different resolver clients.

Said differently, the recursive resolver just adds that option to its queries, even upon its first message to a given nameserver, so even before even knowing what will happen with it. Hence authoritative nameservers have no way in advance to signal that.

But when the authoritative nameserver replies (see section 7.2.1 of RFC7871) it can signal basically which prefixes it used. And then for future queries the recursive nameserver can adapt itself and send a different prefix, as explained in the specification:

A SCOPE PREFIX-LENGTH value longer than SOURCE PREFIX-LENGTH indicates that the provided prefix length was not specific enough to select the most appropriate Tailored Response. Future queries for the name within the specified network SHOULD use the longer SCOPE PREFIX-LENGTH. Factors affecting whether the Recursive Resolver would use the longer length include the amount of privacy masking the operator wants to provide their users, and the additional resource implications for the cache.

Conversely, a shorter SCOPE PREFIX-LENGTH indicates that more bits than necessary were provided, and the answer is suitable for a broader range of addresses. This could be as short as 0, to indicate that the answer is suitable for all addresses in FAMILY.

Even with all of that, authoritative nameservers can not force recursive ones to send specific ECS prefix or even the option at all, it is still only at option controlled by the recursive nameservers.