[GH-ISSUE #2638] DAU option should not be used to filter RRSIGs #1031

New issue

Closed

opened 2026-03-16 01:20:06 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:20:06 +03:00

Owner

Originally created by @divergentdave on GitHub (Dec 5, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2638

RFC 6975 says that the DAU, DHU, and N3U options "MUST NOT trigger any special processing (e.g., RRSIG filtering in responses) on the server side." RecordSet::records_with_rrsigs() does so, and this gets invoked from LookupRecords. We should remove this functionality, instead returning all applicable RRSIG records, and fix up documentation about using SupportedAlgorithms to filter by requested algorithms. The DAU, DHU, and N3U options are only intended to be used as a feedback signal for authoritative server operators, and they should otherwise not play a part in a DNSSEC-aware nameserver.

Originally created by @divergentdave on GitHub (Dec 5, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2638 RFC 6975 says that the DAU, DHU, and N3U options "MUST NOT trigger any special processing (e.g., RRSIG filtering in responses) on the server side." `RecordSet::records_with_rrsigs()` does so, and this gets invoked from `LookupRecords`. We should remove this functionality, instead returning all applicable RRSIG records, and fix up documentation about using `SupportedAlgorithms` to filter by requested algorithms. The DAU, DHU, and N3U options are only intended to be used as a feedback signal for authoritative server operators, and they should otherwise not play a part in a DNSSEC-aware nameserver.