Explainer: Clarify when checks are performed.

Fixed: #51
WICG · May 31, 2021 · a44c2a1 · a44c2a1
1 parent 3e2d9de
commit a44c2a1
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/explainer.md b/explainer.md
@@ -132,6 +132,15 @@ Private network requests are handled differently than others, like so:
  - The response must carry an additional
  `Access-Control-Allow-Private-Network: true` header.
 
+Because the Fetch spec does not yet integrate the details of DNS resolution,
+only defining an **obtain a connection** algorithm, Private Network Access
+checks are applied to the newly-obtained connection. Because of complexities
+such as Happy Eyeballs
+([RFC6555](https://datatracker.ietf.org/doc/html/rfc6555),
+[RFC8305](https://datatracker.ietf.org/doc/html/rfc8305), this means that these
+checks might pass or fail non-deterministically for hosts with multiple IP
+addresses that straddle IP address space boundaries.
+
 ### Integration with HTML
 
 `Document`s and `WorkerGlobalScope`s store an additional **address space**