Expressive Boundedness of Authoritative DNS Response Selection
Authoritative Domain Name System (DNS) response-selection semantics determine query-time outcomes from resolver-visible query context, authoritative candidate data, and associated metadata. Although widely deployed as traffic steering, these semantics have not been formalized independently of particular configuration languages or implementations. We show that authoritative DNS response selection inhabits a bounded semantic domain induced by protocol constraints, including finiteness, RRset atomicity, totality, termination, cacheability, and restriction to resolver-visible query context and materialized candidate data and metadata available at evaluation time. Together, these constraints determine the admissible input domain, outcome space, and function class. We formalize response selection as DNS-admissible functions over finite structured candidate domains comprising individual answers and finite answer groupings. Every such function admits a finite compositional normal form that distinguishes observationally relevant combinations of query context and metadata, then restricts and selects over the corresponding candidate domain. Here, "normal form" asserts existence, not uniqueness, canonicalization, or minimality. These normal forms expose an intrinsic compositional structure with a natural semiring interpretation. This supports principled reasoning about equivalence, expressiveness, approximation, semantic collapse, representability, and portability. Authoritative systems, configuration models, and serialized encodings are modeled uniformly as semantic restrictions of the shared bounded domain, grounded in protocol semantics rather than implementation detail.