Re: [dnsext] Possible DNSSECbis clarifications

[Michael Graff <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 3/28/11 4:19 PM, Marc Lampo wrote:
> But then, how to link a RRSIG(SOA) with *its* SOA ?

They are the same SOA in an AXFR.  Identical in every way.

In an IXFR, the delta change IS the data as well, with each section
delimited by an SOA.

So, you have the removed RRSIG(SOA) in the delete section and the new
RRSIG(SIG) in the add section.

There is no guarantee on record order in an AXFR other than the
delimiters.  You could receive:

  example.com SOA
  example.com A
  asdasd.example.com A
  example.com MX
  asdasd.example.com AAAA
  example.com SOA

IMHO, the first SOA could be followed by its RRSIG(SOA), but this is not
required.  The final SOA cannot have any data after it, as per AXFR
spec.  Don't treat the RRSIG as special; for an AXFR or IXFR they are
just records.

- --Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNkKDUAAoJEDRzoY2A7tzbahEH/R7oxD0WzxQmgH3pSwh3b3Fn
MpZ0ItbN9bpTVUmYwTpXHFYYw9IZRIaymOnxIRIvnsWKEZEktfYdZp1dnlCBfexQ
u/RUHC4tPYkAAHHVZj2Iecape0bFRBMoSku4Rd7BgJKGPTDWRY86ufqEK0f8bRR7
rW2W0EcjganyMe+4fK2tnUBCwhIefmrnL9MNHoWEYLcKDnzK7d5ZzArg30d7iARw
vy/gYQUYwIX45aaPijOs3siDEBp1vOMeS5MsYASA0qu71bDNIPebNayt0bXs3fhH
EirpaMDrJtwpEPe0P/WGhJx/mX724euXoQbRAi2PKlMiXwe3xu0vphle+CnxfyQ=
=3uvB
-----END PGP SIGNATURE-----