And rename the test to match the keyword.
Add ticket reference to README.
--- /dev/null
+Test the 'dns.response.rrname' sticky buffer.
+
+This test verifies that data in a name field or an rdata field
+of a DNS response will trigger a signature.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/7012
--- /dev/null
+# Will alert on name field of Query section in response
+alert dns any any -> any any (dns.response.rrname; content: "dne.oisf.net"; sid:1; rev:1;)
+
+# Will alert on rdata field of Authority section in response
+alert dns any any -> any any (dns.response.rrname; content: "ns-110.awsdns-13.com"; sid:2; rev:1;)
+++ /dev/null
-Test the 'dns.response' sticky buffer.
-
-This test verifies that data in a name field or an rdata field
-of a DNS response will trigger a signature.
\ No newline at end of file
+++ /dev/null
-# Will alert on name field of Query section in response
-alert dns any any -> any any (dns.response; content: "dne.oisf.net"; sid:1; rev:1;)
-
-# Will alert on rdata field of Authority section in response
-alert dns any any -> any any (dns.response; content: "ns-110.awsdns-13.com"; sid:2; rev:1;)