On 20 aug 2013, at 09:14, Dave Crocker <dhc@xxxxxxxxxxxx> wrote: > On 8/19/2013 11:33 PM, Patrik Fältström wrote: >> Reason for this is that the RR with an underscored prefix MIGHT end up in a different zone than the record without. > > Patrik, > > Please clarify. I don't know what you mean by the 'with' and 'without' references. The two following records MUST be in the same zone: foo.example. IN X RDATAX foo.example. IN Y RDATAY The two following MIGHT NOT be in the same zone: foo.example. IN X RDATAX _bar.foo.example. IN TXT RDATAY > And as long as I'm asking for more explanation, given the number of years of use the construct has had and for the number of different applications, where has the problem (whatever you mean specifically) been seen? When using DNSSEC if the _bar.foo.example record in the 2nd example above is unsigned, while the foo.example in the first example is. Patrik