<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2/28/21 3:24 AM, Paul Hoffman wrote:<br>
</div>
<blockquote type="cite"
cite="mid:88F4504E-6040-4170-888A-C4DFDFFACAD8@icann.org">
<pre class="moz-quote-pre" wrap="">On Feb 27, 2021, at 5:32 PM, Mark Andrews <a class="moz-txt-link-rfc2396E" href="mailto:marka@isc.org" moz-do-not-send="true"><marka@isc.org></a> wrote:
</pre>
<blockquote type="cite" style="color: #999999;">
<pre class="moz-quote-pre" wrap="">It says that RRSIGs exist at that name.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Could you say more? I don't understand the context here.
For example, "dig @f.root-servers.net -4 nl rrsig" gives a reply with no Answer section.</pre>
</blockquote>
<p>Explicit QTYPE=RRSIG is a gray area, I believe. In some cases it
could be a DoS vector [1], and I don't know of a use case for such
a query, so it makes sense not to answer (in full). In your
particular example, if you ask for DS nl, you will get all RRSIGs
for that name-type pair. Overall, it's even explicitly
standardized that RRSIGs do not form an RRset; they're more like
an appendage to the RRset they sign.</p>
<p>[1] <a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/rfc8482#section-7">https://tools.ietf.org/html/rfc8482#section-7</a><br>
</p>
<p>--Vladimir<br>
</p>
</body>
</html>