IETF Logo Mail Archive

[DNSOP] Re: ordering of RRSets in the answer section of a DNS response

Joe Abley <jabley@strandkip.nl> Sat, 17 January 2026 09:58 UTC

Return-Path: <jabley@strandkip.nl>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id BAACBA8F7599 for <dnsop@mail2.ietf.org>; Sat, 17 Jan 2026 01:58:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.799
X-Spam-Level:
X-Spam-Status: No, score=-2.799 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=strandkip.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vxZhOtsZzpTp for <dnsop@mail2.ietf.org>; Sat, 17 Jan 2026 01:58:27 -0800 (PST)
Received: from outbound.soverin.net (outbound.soverin.net [185.233.34.146]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 178E5A8F7594 for <dnsop@ietf.org>; Sat, 17 Jan 2026 01:58:27 -0800 (PST)
Received: from smtp.soverin.net (unknown [10.10.4.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by outbound.soverin.net (Postfix) with ESMTPS id 4dtXGp22BCz77; Sat, 17 Jan 2026 09:58:26 +0000 (UTC)
Received: from smtp.soverin.net (smtp.soverin.net [10.10.4.99]) by soverin.net (Postfix) with ESMTPSA id 4dtXGp0Hltz1f; Sat, 17 Jan 2026 09:58:26 +0000 (UTC)
Authentication-Results: smtp.soverin.net; dkim=pass (2048-bit key; unprotected) header.d=strandkip.nl header.i=@strandkip.nl header.a=rsa-sha256 header.s=soverin1 header.b=QSDbnM1O; dkim-atps=neutral
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=strandkip.nl; s=soverin1; t=1768643906; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=g+2c2dUIu4p4JSbsNGycDZW7z/f1fNaxBZhyYxpQ84k=; b=QSDbnM1O/lPpQIVHqLQIbrHT10QSqHfNchRvXkRoMSCzcGnoOFGZrOT58b5R0TDD2AK2oL ZNf0ZO63cHcohWYhKUewMCvYTO0Rm7wX5Vw86THhdUGjYfwI3ouZ76i1QoS69W3CN4iigh 9d3kfnfjL9GXvMAAibNng4sH5Ji36XBgO/2Vzy4G9O/of/zGuVMY5IUiwaFk9JUNyAsyWR WoJaYNgzJln/yoqiglCNtWfnr+9HEt3/OeHZfzaweF788yTf52cymWYG7eDdVCmcpMgCsk GCzHhhGEOL/Vu4GN7UwW5wXOHf2seR2f5t2C9naiuyrDvWEMXqc4vBiusgk6Cg==
X-CMAE-Score: 0
X-CM-Analysis: v=2.4 cv=d/oPyQjE c=1 sm=1 tr=0 ts=696b5d42 a=nL7U2rnaIQmLSekU6168Mg==:617 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=lX2lzekpAAAA:8 a=NwzHTesS97KtjuQIIewA:9 a=QEXdDO2ut3YA:10 a=7aq_tVx3WGWherrlYClH:22 a=ADiJHLWpjGBBXEl7-v_j:22
X-CM-Envelope: MS4xfCnNI7pV2Xarv9XDPNgkbVV6s56vRS6gysTNgUt7NtTQ0c/H1wp8ejmWaDFRHFEmM6sNXwNs33EnXLYLWTx+9TK1LXhlJNDE2k29yWmoUP6tw4SyoVWE oObaITnMcoNxqdOYudU8eCfLfHNT7HBEDtrB1VqNZTKDV0efyRzS0drgpXRHEf8yUvR+qHqnGbg7tkB7k2O0lXwlX0P3j0CvTKjPxJTb3Iobr/iSlO4NaRv9 G8MmvHck2XhoqmDFh1hlyVBgLxEwTOV5qGlUxx0LCdo=
X-Soverin-Id: 019bcb64-49d0-7715-a19d-0bed2cd83bf5
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Joe Abley <jabley@strandkip.nl>
Mime-Version: 1.0 (1.0)
Date: Sat, 17 Jan 2026 10:58:15 +0100
Message-Id: <55B4C096-6442-4A2C-B0B8-8F1229E78910@strandkip.nl>
References: <0d331ac59d031b27845dac7511586de95b46ee78.camel@16bits.net>
In-Reply-To: <0d331ac59d031b27845dac7511586de95b46ee78.camel@16bits.net>
To: Ángel <angel@16bits.net>
X-Spampanel-Class: ham
Message-ID-Hash: H5YGF6DNBYWLDVTNAIF5BXRWEJPOM3QR
X-Message-ID-Hash: H5YGF6DNBYWLDVTNAIF5BXRWEJPOM3QR
X-MailFrom: jabley@strandkip.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: dnsop@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: ordering of RRSets in the answer section of a DNS response
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/4jKiRCOsHalk4n4_PjoF0IcNowM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

Hey,

On 17 Jan 2026, at 03:59, Ángel <angel@16bits.net> wrote:

> My first comment to the draft is that we should add a reference to CVE-
> 2002-0400 as a relevant precedent.

Thank you, we will do that.

> Second, regarding the current wording of the draft, I am against the
> way it is phrased. When it states:
>> the section MUST be treated as an ordered list of RRSets
> 
> [...]
> 
> However, I am in favor of adding a text such as the following:
> 
> [...]

I quite like your formulation, and I think I agree that it's better than what we suggested initially. Thanks for taking the time to write that up. I think based on other comments consensus was already tilted towards making more tightly-scoped advice around CNAME and DNAME and being more explicit about not changing the packaging of DNSSEC RRs, and your text does this quite elegantly.

I am interested to hear whether anybody else thinks differently.


Joe

v2.46.0 | Report a Bug | By Email | System Status