[dnsext] duplicate RRs and resulting RRSIG

[bert hubert <[e-mail]>]

Hi everybody,

As part of a recent very big PowerDNS deployment as a DNSSEC signer,
we've encountered an interesting issue. I'm sharing this here in hopes
of hearing your wisdom, plus possibly to warn you about this happening
in your code or deployments too.

In a zone there are three MX RRs for a name, of which 2 are identical.
PowerDNS signs all three records in canonical order when the zone is
transferred to BIND (at least I think it is BIND).

That server subsequently drops one of the two identical records, and
serves only two MX RRs to the world, BUT with the RRSIG that was
calculated from all three records. Bad data ensues, and bounced
emails, since this is in the country that actually validates.

Now, there are at least 3 places where we might call 'bug': 1) the
process that put duplicate RRs in the database 2) PowerDNS for signing
the 3 RRs or 3) the 'outer' server for silently dropping one of the
RRs, in the assumption that the RRSIG will survice this process.

RFC 2181, section 5, says that servers should (lower case) 'suppress'
duplicate RRSIGs, which would argue that at least PowerDNS is
partially to blame, and should've dropped the duplicate record.
However, the outer server I think should also not feel free to drop
records on an DNSSEC signed zone.

What do you think?

    Bert