Skip to content

DNAME case handling in RDATA

There are still some problems in DNAMEs handling in RDATA.

Comparison of RR sets is currenlty case insensitive (e.g., knot_rrset_equal ). As a result, DNSSEC signing can create bogus signatures in some cases.

Following zone will be signed incorrectly:

foo.  3600    IN      SOA     ns. root. 2 60 60 2419200 3600
foo.  3600    NS      B.foo.
foo.  3600    NS      a.foo.

B.foo. sorts before a.foo. when doing binary comparison. In canonical format, the ordering is reverse.

Also, uppercase letters in Next domain name in NSEC/NSEC3 records causes Knot to resign the zone, even if the existing signatures are valid.