Select whole RRsets without inventing truncation
02A responder can send one available RRset or a larger subset. Choosing fewer types differs from cutting records out of a selected set or running out of packet space.
Separate signed-zone, DO=1 case: the selected A RRset travels with its appropriate RRSIG. RRSIG means resource record signature; the icon does not itself prove that a client has validated it.
Source for this drawing: RFC 8482 · Read RFC section 4.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A deliberately selected subset is not a complete zone inventory and does not by itself require TC.
- A responder MAY decline a conventional ANY response or MAY send a single RRset or larger subset of available RRsets. Where several exist, it SHOULD choose a small subset to reduce amplification potential.
- The RFC gives no signal that the returned subset is incomplete. The TC truncation bit SHOULD NOT be set merely for this subset behavior (§7); real transport-size constraints remain separate.
- If the zone is signed, appropriate RRSIG records MUST be included as specified in §4.1. The signed example here uses DO=1, the DNSSEC OK query bit. It does not depict a real cryptographic validation.
The two fictional A addresses belong to one RRset and are retained together. No packet-size arithmetic, signature generation or authoritative-zone implementation runs in this page. Selection is local policy, not a universal A-first rule.
Read the RFC section ↗