Expressive Boundedness of Authoritative DNS Response Selection

Abstract: Authoritative Domain Name System (DNS) response selection defines query-time response selection based on resolver-visible context and per-answer metadata, yielding different observable outcomes for the same query under different conditions. Although such behavior is widely deployed and often described informally as traffic steering, its semantics have not been formalized independently of particular configuration languages or implementations. This paper shows that authoritative DNS response selection inhabits a bounded semantic domain determined directly by DNS protocol constraints. Requirements such as finiteness of responses, RRset atomicity, termination, cacheability, and restriction to resolver-visible inputs jointly limit the expressive power of any query-time selection mechanism. We formalize authoritative response selection as a class of DNS-admissible functions and prove that every such function admits a finite normal form consisting of conditional restriction over observable context followed by selection among a finite candidate set. We further show that this bounded semantic domain carries intrinsic algebraic structure induced by DNS semantics, enabling principled reasoning about composition, expressiveness loss, and semantic collapse. Concrete authoritative systems, configuration models, and serialized encodings are modeled uniformly as semantic restrictions of this domain. This framework supports precise reasoning about equivalence, representability, and approximation across heterogeneous authoritative DNS systems, grounded directly in protocol semantics rather than implementation detail.