[dnsext] rfc4035 & 5155 : order of RR's ?

["Marc Lampo" <[e-mail]>]

Hello,

A stupid question, perhaps, but ...

Both RFC4035 and RFC5155 talk in more or less global terms
on adding DNSSEC RR's to the reply (answer/authority/addition sections).

As an example of "global" term, a quote from RFC5155, section 7.2.3 :
"The server MUST include the NSEC3 RR that matches QNAME."

In RFC4035, section 3.1, the text states :
"... must include additional RRSIG, NSEC, ... RRs, ..."
(this is a paragraph of serving a DNSSEC'd zone,
 so I interpret "must include" as : must add them to the response)

Seems to me neither RFC states anything about "order" :
like first the RRset, followed by the RRSIG(s) over that RRset.
Or does it ?

Yet, in both RFC's the examples maintain that logical order.


I now stumble over an authoritative NS that does not implement
the order - but that does returns the correct type and number
of RRs in its answer -
and Bind (9.7) seems to have a problem with it.

Hence my question :
Are the RFC's somehow prescribing some "order" in RRset's and
the accompanying DNSSEC RRs ?

Thanks,


Marc Lampo
Security Officer
 
    EURid
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext