Subject: [DNSOP] Order of DNS records...

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 11 Jan 2016 22:20:36 +0100

Interesting: it sends the signature before the SOA (and it breaks at
least one DNS program - one of mine, shame):

% dig @ns02.one.com. SOA masters-consultants.fr. 

; <<>> DiG 9.9.5-9+deb8u3-Debian <<>> @ns02.one.com. SOA masters-consultants.fr.
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51995
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1680
;; QUESTION SECTION:
;masters-consultants.fr.	IN SOA

;; ANSWER SECTION:
masters-consultants.fr.	14400 IN RRSIG SOA 8 2 14400 (
				20160121000000 20151231000000 58536 masters-consultants.fr.
				FOZbAQLnjdq9GPIvAJWUi5LURWMBubbFAMj6q/GVn2mu
				jdU8IjNL+9+pxY/hZCEFd2Fpubkslvl161q6eYXR3Po0
				xbI54ZDVvGOvUG/7zhHhwZKTYfoksjQdGjrwfyvdg8F0
				JcMV8v0jd8433Vm+d7VkSeomfbMXOlImKIUutQ1KqlBR
				rP0tiuhzXWNZmb8jL4nPg46kc/sqmObbQW2Ujg== )
masters-consultants.fr.	14400 IN SOA ns01.one.com. hostmaster.one.com. (
				2016010811 ; serial
				14400      ; refresh (4 hours)
				3600       ; retry (1 hour)
				1209600    ; expire (2 weeks)
				900        ; minimum (15 minutes)
				)

;; Query time: 154 msec
;; SERVER: 2001:67c:28cc::138#53(2001:67c:28cc::138)
;; WHEN: Mon Jan 11 22:19:03 CET 2016
;; MSG SIZE  rcvd: 324

---

From: Mark Andrews <[email-masked]>
Date: Tue, 12 Jan 2016 11:36:05 +1100

Perfectly legal. The order of the record and signatures is undefined.

Mark

On 12/01/2016, at 8:20, Stephane Bortzmeyer <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Brett <[email-masked]>
Date: Tue, 12 Jan 2016 14:39:39 +0000

> ;; WHEN: Mon Jan 11 22:19:03 CET 2016

Strangely returns the SOA first over ipv4 though:

-- 
Brett

---

From: Dick Franks <[email-masked]>
Date: Tue, 12 Jan 2016 14:43:46 +0000

Attempt to repeat your result using

 #!/usr/bin/perl -w
 #
 use Net::DNS 1.01;

 my $resolver = new Net::DNS::Resolver( nameserver => 'ns02.one.com.',
dnssec => 1 );
 $resolver->send(qw( masters-consultants.fr SOA ))->print;
 #

returned RRSIG first for 44% of my statistically dubious sample.

Dick Franks
________________________

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 12 Jan 2016 15:47:16 +0100

On Tue, Jan 12, 2016 at 02:43:46PM +0000,
 Dick Franks <[email-masked]> wrote 

> returned RRSIG first for 44% of my statistically dubious sample.

It is said that PowerDNS does it at random, on purpose, to break
erroneous programs.

---

From: bert hubert <[email-masked]>
Date: Tue, 12 Jan 2016 16:08:58 +0100

> It is said that PowerDNS does it at random, on purpose, to break

Let me clarify that. PowerDNS Authoritative has always randomized record
order in responses.  We did not change that when DNSSEC came along, so
frequently you'll get the RRSIG record before the A record (for example).

When I pondered special casing that ordering, I took into account that no
one can rely on DNS records arriving in a specific order.  So I felt no
need to throw a bunch of special casing in there to protect weak
implementations, as I would not actually be helping them. It would not make
the world more robust.

So that's how this came to be. 

Incidentally, we were not quite as sentimental about CNAME ordering because
we estimated that stub resolvers would not be able to deal with anything
that looked not absolutely canonical. Since stubs are such founts of
quality.

	Bert