[GH-ISSUE #3146] DNSSEC verification: Simplify fetching DNSKEY RRset #1142

New issue

Open

opened 2026-03-16 01:43:19 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:43:19 +03:00

Owner

Originally created by @divergentdave on GitHub (Jul 22, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3146

I would like to clean up the code around DNSKEY fetching, but maybe in a separate PR. One question I've had is whether we can presume that any RRset will have RRSIGs from only one signer name in a response. Typically any zone should only contain RRSIGs with the zone name as the signer name, but I'm not sure if there are exceptional cases when splitting zones, etc., that verifiers need to support. If not, we could require that there only be one signer, and make only one DNSKEY query.

Originally posted by @divergentdave in https://github.com/hickory-dns/hickory-dns/pull/3134#discussion_r2223695161

Originally created by @divergentdave on GitHub (Jul 22, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3146 I would like to clean up the code around DNSKEY fetching, but maybe in a separate PR. One question I've had is whether we can presume that any RRset will have RRSIGs from only one signer name in a response. Typically any zone should only contain RRSIGs with the zone name as the signer name, but I'm not sure if there are exceptional cases when splitting zones, etc., that verifiers need to support. If not, we could require that there only be one signer, and make only one DNSKEY query. _Originally posted by @divergentdave in https://github.com/hickory-dns/hickory-dns/pull/3134#discussion_r2223695161_