Embed Notice

DNS peeps, I think I need clarification of SOA record placement.

RFC1035 section 5.2 says "Exactly one SOA RR should be present at the top of the zone", which I have always taken literally, i.e. at top of zone (minus $ORIGIN or $TTL et.al.)

It could also mean "at zone apex"

named-checkzone(1) and ldns-verify-zone(1) don't care; SOA can be anywhere.

But, validns(1) bails with "the first record in the zone must be an SOA record" https://github.com/tobez/validns/blob/a7e6b4f417c0bfadfd25629ecfc5bc449e3101e4/rr.c#L301

Is it top (in $EDITOR) or is it apex?