auth dnsproxy: document network ought to be trusted

[zeha]

Short description

We are reusing the source UDP port for a very long time. Cannot have people interfere or try to attack us with this design.

Checklist

I have:

• read the CONTRIBUTING.md document
• compiled this code
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)

[coveralls]

Pull Request Test Coverage Report for Build 10581875041

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 92 unchanged lines in 14 files lost coverage.
• Overall coverage decreased (-0.03%) to 64.643%

---

Files with Coverage Reduction	New Missed Lines	%
modules/gpgsqlbackend/gpgsqlbackend.cc	1	88.62%
pdns/misc.cc	1	63.32%
pdns/pollmplexer.cc	1	83.66%
pdns/backends/gsql/gsqlbackend.hh	2	97.71%
pdns/rcpgenerator.cc	2	90.05%
modules/godbcbackend/sodbc.cc	2	70.8%
modules/gpgsqlbackend/spgsql.cc	3	67.7%
pdns/recursordist/rec-tcp.cc	4	65.03%
pdns/dnsdistdist/dnsdist.cc	4	68.44%
pdns/recursordist/pdns_recursor.cc	4	72.64%

Totals
Change from base Build 10579511995:	-0.03%
Covered Lines:	124597
Relevant Lines:	162057

---

💛 - Coveralls

[rgacogne]

Perhaps?

Suggested change

	It is assumed that the network path to the recursive DNS server, and the recursive DNS server itself is trusted.
	It is assumed that the network path to the recursive DNS server, and the recursive DNS server itself, are trusted.

[zeha]

rewrote it, but lets see if we still need this after #14594

[Habbie]

rewrote it, but lets see if we still need this after #14594

we don't magically start validating DNSSEC or using TSIG in there, so the recommendation likely still makes sense then