DNSRR refinement:

Require a proof that the length field corresponds to payload length
(otherwise it's meaningless!)