From: Ondřej Surý <ondrej@sury.org>
Date: Sat, 15 Aug 2026 16:46:15 +0000 (+0200)
Subject: Correct RPZ NSDNAME precedence documentation
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a3d59633694e603e69e3fcf3473d26f6b9602a47;p=thirdparty%2Fbind9.git

Correct RPZ NSDNAME precedence documentation

The implementation intentionally prefers the name appearing last in
DNSSEC canonical order. Align the ARM and source comment with the RPZ
specification.
---

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index cbe42d6913a..76e0afa4f00 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -5113,8 +5113,8 @@ rewriting in the following order:
    response-policy option.
 2. Prefer CLIENT-IP to QNAME to IP to NSDNAME to NSIP triggers in a
    single zone.
-3. Among NSDNAME triggers, prefer the trigger that matches the smallest
-   name under the DNSSEC ordering.
+3. Among NSDNAME triggers, prefer the trigger whose matched name server
+   domain name appears last in the DNSSEC canonical ordering.
 4. Among IP or NSIP triggers, prefer the trigger with the longest
    prefix.
 5. Among triggers with the same prefix length, prefer the IP or NSIP
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 65c92f5371e..2059619a21c 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -3583,7 +3583,8 @@ rpz_rewrite_name(ns_client_t *client, dns_name_t *trig_name,
 			 * With more than one applicable policy, prefer
 			 * the earliest configured policy,
 			 * client-IP over QNAME over IP over NSDNAME over NSIP,
-			 * and the smallest name.
+			 * and the name that appears last in DNSSEC canonical
+			 * order.
 			 * We known st->m.rpz->num >= rpz->num  and either
 			 * st->m.rpz->num > rpz->num or st->m.type >= rpz_type
 			 */