Subject: [dnsext] rfc4035 & 5155 : order of RR's ?

From: "Marc Lampo" <[email-masked]>
Date: Wed, 30 May 2012 13:31:03 +0200 (CEST)

Hello,

A stupid question, perhaps, but ...

Both RFC4035 and RFC5155 talk in more or less global terms
on adding DNSSEC RR's to the reply (answer/authority/addition sections).

As an example of "global" term, a quote from RFC5155, section 7.2.3 :
"The server MUST include the NSEC3 RR that matches QNAME."

In RFC4035, section 3.1, the text states :
"... must include additional RRSIG, NSEC, ... RRs, ..."
(this is a paragraph of serving a DNSSEC'd zone,
 so I interpret "must include" as : must add them to the response)

Seems to me neither RFC states anything about "order" :
like first the RRset, followed by the RRSIG(s) over that RRset.
Or does it ?

Yet, in both RFC's the examples maintain that logical order.

I now stumble over an authoritative NS that does not implement
the order - but that does returns the correct type and number
of RRs in its answer -
and Bind (9.7) seems to have a problem with it.

Hence my question :
Are the RFC's somehow prescribing some "order" in RRset's and
the accompanying DNSSEC RRs ?

Thanks,

Marc Lampo
Security Officer
 
    EURid

---

From: Francis Dupont <[email-masked]>
Date: Wed, 30 May 2012 14:26:57 +0200

There is an order between sections but no order inside a section.
BTW DNSSEC RRs can go in a different section than the RRsets they protect.

Regards

[email-masked]