/etc/resolv.conf is an ordered list

[rharolde]

Under "RPZ and Trust Anchor Issues", it says "Add structure to current unordered "nameserver" list in /etc/resolv.conf, similar to SRV semantic mechanisms?"
But /etc/resolv.conf is an ordered list, at least in most operating systems, from what I have seen.

[brian-peter-dickson]

The important element is "Add structure".
Let me be more specific: In the standard linux/unix system, there are two places that impact name resolution: /etc/nsswitch.comf and /etc/resolv.conf.

nsswitch.conf allows multiple name resolution mechanisms to be applied, in a particular order. Those include such things as NIS+, LDAP, files, and any other add-on resolution mechanisms, in addition to dns.

The mechanisms controlling that sequencing have to do with return codes from respective resolution mechanisms.

I'm proposing augmenting the dns component of this, with a similar structure, whether it be a simple two-level scheme, or some kind of tree.

The reason for doing this is to allow partial resolution via an RPZ-only service (or services), followed by full resolver resolution if no positive (authoritative) RPZ response is returned.

It is less about ordered/unordered, than it is about providing more structure/control, to enable things currently not feasible.