Index: unbound-1.4.6/util/data/msgencode.c
===================================================================
--- unbound-1.4.6.orig/util/data/msgencode.c	2010-03-12 16:17:48.000000000 +0100
+++ unbound-1.4.6/util/data/msgencode.c	2012-02-06 17:34:46.477966753 +0100
@@ -445,7 +445,7 @@
 	int do_data, int do_sig, struct compress_tree_node** tree,
 	ldns_pkt_section s, uint16_t qtype, int dnssec)
 {
-	size_t i, owner_pos;
+	size_t i, j, rr, owner_pos;
 	int r, owner_labs;
 	uint16_t owner_ptr = 0;
 	struct packed_rrset_data* data = (struct packed_rrset_data*)
@@ -459,28 +459,30 @@
 	owner_pos = ldns_buffer_position(pkt);
 
 	if(do_data) {
+		rr = random();
 		const ldns_rr_descriptor* c = type_rdata_compressable(key);
 		for(i=0; i<data->count; i++) {
+			j = (i + rr) % data->count;
 			if((r=compress_owner(key, pkt, region, tree, 
 				owner_pos, &owner_ptr, owner_labs))
 				!= RETVAL_OK)
 				return r;
 			ldns_buffer_write(pkt, &key->rk.type, 2);
 			ldns_buffer_write(pkt, &key->rk.rrset_class, 2);
-			if(data->rr_ttl[i] < timenow)
+			if(data->rr_ttl[j] < timenow)
 				ldns_buffer_write_u32(pkt, 0);
 			else 	ldns_buffer_write_u32(pkt, 
-					data->rr_ttl[i]-timenow);
+					data->rr_ttl[j]-timenow);
 			if(c) {
-				if((r=compress_rdata(pkt, data->rr_data[i],
-					data->rr_len[i], region, tree, c))
+				if((r=compress_rdata(pkt, data->rr_data[j],
+					data->rr_len[j], region, tree, c))
 					!= RETVAL_OK)
 					return r;
 			} else {
-				if(ldns_buffer_remaining(pkt) < data->rr_len[i])
+				if(ldns_buffer_remaining(pkt) < data->rr_len[j])
 					return RETVAL_TRUNC;
-				ldns_buffer_write(pkt, data->rr_data[i], 
-					data->rr_len[i]);
+				ldns_buffer_write(pkt, data->rr_data[j],
+					data->rr_len[j]);
 			}
 		}
 	}