Re: [dnsext] RFC 3484 section 6 rule 9 causing more operational problems

[Chris Thompson <cet1 at cam.ac.uk>]

On Mar 4 2009, Ondřej Surý wrote:

> On Wed, Mar 4, 2009 at 6:57 PM, <bmanning at vacation.karoshi.com> wrote:
[...]
> >         DNSSEC does reorder RRSets within a zone.  Which is a new feature.
>
> When we started talking about order of RRSets?  This is purely discussion
> about order of RRs in RRSet. Order of RRSets in zone is irrelevant before
> DNSSEC and also after DNSSEC. Nothing depends on order of RRSets
> at least in my best knowledge.

I took Bill to mean "DNSSEC does reorder RRs within an RRset" anyway, as
I don't know in what other sense DNSSEC is relevant at all.

But the canonical ordering of RRs within an RRset for signing purposes
says nothing about the presentation order in the answers to DNS queries.
And in fact a certain well-known nameserver implementation not unassociated
with Paul still supports all the rrset-order and sortlist controls, which
work for secured zones as well as unsecured ones.

--
Chris Thompson
Email: cet1 at cam.ac.uk