[ietf-dkim] Re: DNS wildcarding behavior scenarios

[Frank Ellermann]

Hector Santos wrote:

> Seems pretty clear in STD 13.
> What am I missing here?

Nothing, it's only not obvious, and Michael just stumbled over it:

Queries for this.is.a.wild.example won't "see" the wild.example
if it's "blocked" by an "existing" a.wild.example, where "existing"
means "any RR".  

He'd have to "reinsert" the blocked wildcard at is.a.wild.example.

I hope I got that right, because I've no way to verify it.  The
intuitive ideas would be "only the same RR can block a wildcard",
or "only a SoA can block a wildcard", but that's not how it works.

Please correct me, 

 Frank