[GH-ISSUE #478] HOSTNAMES Env dont work if kernel option ipv6.disable=1 #170

Closed
opened 2026-02-26 04:34:16 +03:00 by kerem · 11 comments
Owner

Originally created by @sh3bang on GitHub (Jun 19, 2024).
Original GitHub issue: https://github.com/mageddo/dns-proxy-server/issues/478

http://mageddo.github.io/dns-proxy-server/latest/en/2-features/docker-solving/#hostnames-env

Note: noRemoteServers = false

Originally created by @sh3bang on GitHub (Jun 19, 2024). Original GitHub issue: https://github.com/mageddo/dns-proxy-server/issues/478 http://mageddo.github.io/dns-proxy-server/latest/en/2-features/docker-solving/#hostnames-env Note: noRemoteServers = false
Author
Owner

@mageddo commented on GitHub (Jun 19, 2024):

@sh3bang does you have a minimal example Of How to create a Linux env with that kernel option?

<!-- gh-comment-id:2178942046 --> @mageddo commented on GitHub (Jun 19, 2024): @sh3bang does you have a minimal example Of How to create a Linux env with that kernel option?
Author
Owner

@sh3bang commented on GitHub (Jun 19, 2024):

i am wondering how this answer can happen:

root@e40361db30e2:/app# nslookup coupon.dev
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
Name:	coupon.dev
Address: 10.5.0.6
** server can't find coupon.dev: NXDOMAIN

NXDOMAIN should be No Answer because domain is existing, but Zone have no AAAA record

DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first.

Correct DNS answer (just ask for A):

root@e40361db30e2:/app# nslookup -type=A coupon.dev
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
Name:	coupon.dev
Address: 10.5.0.6

Also correct (A existing, but no AAAA):

root@e40361db30e2:/app# nslookup -type=AAAA hussmedien.de
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
*** Can't find hussmedien.de: No answer

DPS config.json

{
  "version" : 2,
  "activeEnv" : "",
  "webServerPort" : 5380,
  "dnsServerPort" : 53,
  "defaultDns" : null,
  "logLevel" : "INFO",
  "logFile" : "console",
  "registerContainerNames" : true,
  "hostMachineHostname" : "host.dev",
  "domain" : "dev",
  "dpsNetwork" : false,
  "dpsNetworkAutoConnect" : false,
  "serverProtocol" : "UDP_TCP",
  "dockerHost" : null,
  "resolvConfOverrideNameServers" : true,
  "noRemoteServers" : false,
  "noEntriesResponseCode" : 3,
  "remoteDnsServers" : [ "10.22.0.31", "10.22.0.32" ],
  "envs" : [ {
    "name" : "",
    "hostnames" : [ {
      "id" : 1,
      "hostname" : "dps-sample.dev",
      "ip" : "192.168.0.254",
      "target" : null,
      "ttl" : 30,
      "type" : "A"
    } ]
  } ]
}

docker-compose.yml

name: docker
services:
  dps:
    container_name: dps
    restart: unless-stopped
    image: defreitas/dns-proxy-server:3.19.5-snapshot
    networks:
      develop:
        ipv4_address: 10.5.0.2
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ~/Projekte/.container/dps/config.json:/app/conf/config.json
  nginx:
    container_name: nginx
    image: nginx:latest
    environment:
      TZ: Europe/Berlin
      HOSTNAMES: coupon.dev
    depends_on:
      - dps
networks:
  develop:
    driver: bridge
    ipam:
      driver: default
      config:
       - subnet: 10.5.0.0/16
         gateway: 10.5.0.1

if you are disable IPv6 completely nothing work as expected ;)

<!-- gh-comment-id:2178988328 --> @sh3bang commented on GitHub (Jun 19, 2024): i am wondering how this answer can happen: ``` root@e40361db30e2:/app# nslookup coupon.dev Server: 10.5.0.2 Address: 10.5.0.2#53 Non-authoritative answer: Name: coupon.dev Address: 10.5.0.6 ** server can't find coupon.dev: NXDOMAIN ``` **NXDOMAIN** should be **No Answer** because domain is existing, but Zone have no AAAA record DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first. Correct DNS answer (just ask for A): ``` root@e40361db30e2:/app# nslookup -type=A coupon.dev Server: 10.5.0.2 Address: 10.5.0.2#53 Non-authoritative answer: Name: coupon.dev Address: 10.5.0.6 ``` Also correct (A existing, but no AAAA): ``` root@e40361db30e2:/app# nslookup -type=AAAA hussmedien.de Server: 10.5.0.2 Address: 10.5.0.2#53 Non-authoritative answer: *** Can't find hussmedien.de: No answer ``` DPS config.json ``` { "version" : 2, "activeEnv" : "", "webServerPort" : 5380, "dnsServerPort" : 53, "defaultDns" : null, "logLevel" : "INFO", "logFile" : "console", "registerContainerNames" : true, "hostMachineHostname" : "host.dev", "domain" : "dev", "dpsNetwork" : false, "dpsNetworkAutoConnect" : false, "serverProtocol" : "UDP_TCP", "dockerHost" : null, "resolvConfOverrideNameServers" : true, "noRemoteServers" : false, "noEntriesResponseCode" : 3, "remoteDnsServers" : [ "10.22.0.31", "10.22.0.32" ], "envs" : [ { "name" : "", "hostnames" : [ { "id" : 1, "hostname" : "dps-sample.dev", "ip" : "192.168.0.254", "target" : null, "ttl" : 30, "type" : "A" } ] } ] } ``` docker-compose.yml ``` name: docker services: dps: container_name: dps restart: unless-stopped image: defreitas/dns-proxy-server:3.19.5-snapshot networks: develop: ipv4_address: 10.5.0.2 volumes: - /var/run/docker.sock:/var/run/docker.sock - ~/Projekte/.container/dps/config.json:/app/conf/config.json nginx: container_name: nginx image: nginx:latest environment: TZ: Europe/Berlin HOSTNAMES: coupon.dev depends_on: - dps networks: develop: driver: bridge ipam: driver: default config: - subnet: 10.5.0.0/16 gateway: 10.5.0.1 ``` if you are disable IPv6 completely nothing work as expected ;)
Author
Owner

@mageddo commented on GitHub (Jun 19, 2024):

So the behavior below is the one you understand as the unexpected behavior?

i am wondering how this answer can happen:

root@e40361db30e2:/app# nslookup coupon.dev
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
Name:	coupon.dev
Address: 10.5.0.6
** server can't find coupon.dev: NXDOMAIN

NXDOMAIN should be No Answer because domain is existing, but Zone have no AAAA record

DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first.

<!-- gh-comment-id:2179075268 --> @mageddo commented on GitHub (Jun 19, 2024): So the behavior below is the one you understand as the unexpected behavior? > i am wondering how this answer can happen: > > ``` > root@e40361db30e2:/app# nslookup coupon.dev > Server: 10.5.0.2 > Address: 10.5.0.2#53 > > Non-authoritative answer: > Name: coupon.dev > Address: 10.5.0.6 > ** server can't find coupon.dev: NXDOMAIN > ``` > > **NXDOMAIN** should be **No Answer** because domain is existing, but Zone have no AAAA record > > DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first. >
Author
Owner

@mageddo commented on GitHub (Jun 19, 2024):

I didn't get if "if you are disable IPv6 completely nothing work as expected ;)" suggests another unexpected behavior which wasn't explained, in this case can you describe what happens in this scenario?

<!-- gh-comment-id:2179077306 --> @mageddo commented on GitHub (Jun 19, 2024): I didn't get if "if you are disable IPv6 completely nothing work as expected ;)" suggests another unexpected behavior which wasn't explained, in this case can you describe what happens in this scenario?
Author
Owner

@mageddo commented on GitHub (Jun 19, 2024):

That's the expected behavior because NSLOOKUP query for both A and AAAA records at the same execution

This result says "I found answer for A but didn't for the AAAA"

root@e40361db30e2:/app# nslookup coupon.dev
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
Name:	coupon.dev
Address: 10.5.0.6
** server can't find coupon.dev: NXDOMAIN

This another one says "I found no answer at all"

root@e40361db30e2:/app# nslookup -type=AAAA hussmedien.de
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
*** Can't find hussmedien.de: No answer

So the behavior below is the one you understand as the unexpected behavior?

i am wondering how this answer can happen:

root@e40361db30e2:/app# nslookup coupon.dev
Server:		10.5.0.2
Address:	10.5.0.2#53

Non-authoritative answer:
Name:	coupon.dev
Address: 10.5.0.6
** server can't find coupon.dev: NXDOMAIN

NXDOMAIN should be No Answer because domain is existing, but Zone have no AAAA record
DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first.

<!-- gh-comment-id:2179091346 --> @mageddo commented on GitHub (Jun 19, 2024): That's the expected behavior because NSLOOKUP query for both A and AAAA records at the same execution This result says "I found answer for A but didn't for the AAAA" ``` root@e40361db30e2:/app# nslookup coupon.dev Server: 10.5.0.2 Address: 10.5.0.2#53 Non-authoritative answer: Name: coupon.dev Address: 10.5.0.6 ** server can't find coupon.dev: NXDOMAIN ``` This another one says "I found no answer at all" ``` root@e40361db30e2:/app# nslookup -type=AAAA hussmedien.de Server: 10.5.0.2 Address: 10.5.0.2#53 Non-authoritative answer: *** Can't find hussmedien.de: No answer ``` > So the behavior below is the one you understand as the unexpected behavior? > > > i am wondering how this answer can happen: > > ``` > > root@e40361db30e2:/app# nslookup coupon.dev > > Server: 10.5.0.2 > > Address: 10.5.0.2#53 > > > > Non-authoritative answer: > > Name: coupon.dev > > Address: 10.5.0.6 > > ** server can't find coupon.dev: NXDOMAIN > > ``` > > > > > > > > > > > > > > > > > > > > > > > > **NXDOMAIN** should be **No Answer** because domain is existing, but Zone have no AAAA record > > DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first.
Author
Owner

@mageddo commented on GitHub (Jun 19, 2024):

DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first.

The A and AAAA are two different queries made to DPS from the nslookup client, so yes, DPS can solve A record from docker,local db and solve AAAA from the remote solver.

Actually I understand that as OK.

The hostname entry existence at the docker solver is not enough criterium to make DPS stop the resolution and don't forward the query to the remote solver.

Maybe this current criterium can be questionable, maybe if the hostname entry exists at the docker solver and even if no IP exists DPS should stop the resolution and answer NXDOMAIN

<!-- gh-comment-id:2179105393 --> @mageddo commented on GitHub (Jun 19, 2024): > DPS is obviously mixing none existing DNS Zones on remote DNS with existing Zones on local/DPS Server by querying always the upstream DNS first. The A and AAAA are two different queries made to DPS from the nslookup client, so yes, DPS can solve A record from docker,local db and solve AAAA from the remote solver. Actually I understand that as OK. The hostname entry existence at the docker solver is not enough criterium to make DPS stop the resolution and don't forward the query to the remote solver. Maybe this current criterium can be questionable, maybe if the hostname entry exists at the docker solver and even if no IP exists DPS should stop the resolution and answer NXDOMAIN
Author
Owner

@github-actions[bot] commented on GitHub (Aug 7, 2024):

This issue is stale because it has been waiting-feedback for 15 days with no activity.

<!-- gh-comment-id:2272818105 --> @github-actions[bot] commented on GitHub (Aug 7, 2024): This issue is stale because it has been waiting-feedback for 15 days with no activity.
Author
Owner

@github-actions[bot] commented on GitHub (Aug 15, 2024):

This issue was closed because it has been inactive for 7 days since being marked as stale, you can reopen it at any time.

<!-- gh-comment-id:2290820912 --> @github-actions[bot] commented on GitHub (Aug 15, 2024): This issue was closed because it has been inactive for 7 days since being marked as stale, you can reopen it at any time.
Author
Owner

@aricooperdavis commented on GitHub (Nov 26, 2024):

Maybe this current criterium can be questionable, maybe if the hostname entry exists at the docker solver and even if no IP exists DPS should stop the resolution and answer NXDOMAIN.

I am requesting that this be re-opened, as currently the resolver doesn't meet DNS standards. The logic should be:

  • if the domain exists in any solver then that solver should handle the response.
  • if a record of the requested type doesn't exist under that solver then it should return RCODE 0 ("No Error"/"NODATA").

Here are the relevant RFC standards:

  • RFC 1035 states that the "Name Error" RCODE (i.e. 3, "NXDOMAIN") "signifies that the domain name referenced in the query does not exist".
  • RFC 2308 clarifies that the more appropriate RCODE would be "No Error" (i.e. 0, "NODATA"), "which indicates that the name is valid, for the given class, but [there] are no records of the given type.".

Here are some other sources that indicate that this is incorrect and problematic behaviour (because of NXDOMAIN response cacheing):

<!-- gh-comment-id:2500986674 --> @aricooperdavis commented on GitHub (Nov 26, 2024): > Maybe this current criterium can be questionable, maybe if the hostname entry exists at the docker solver and even if no IP exists DPS should stop the resolution and answer NXDOMAIN. I am requesting that this be re-opened, as currently the resolver doesn't meet DNS standards. The logic should be: - if the domain exists in any solver then that solver should handle the response. - if a record of the requested type doesn't exist under that solver then it should return RCODE 0 ("No Error"/"NODATA"). Here are the relevant RFC standards: - [RFC 1035](https://www.rfc-editor.org/rfc/rfc1035#section-4.1.1) states that the "Name Error" RCODE (i.e. 3, "NXDOMAIN") "signifies that the domain name referenced in the query does not exist". - [RFC 2308](https://www.rfc-editor.org/rfc/rfc2308) clarifies that the more appropriate RCODE would be "No Error" (i.e. 0, "NODATA"), "which indicates that the name is valid, for the given class, but [there] are no records of the given type.". Here are some other sources that indicate that this is incorrect and problematic behaviour (because of NXDOMAIN response cacheing): - https://serverfault.com/questions/1121447/nslookup-finds-ip-address-but-still-claims-nxdomain
Author
Owner

@mageddo commented on GitHub (Nov 27, 2024):

@aricooperdavis

Thanks for the evidences, it makes sense for me, creating #611 to treat this behavior.

<!-- gh-comment-id:2504684972 --> @mageddo commented on GitHub (Nov 27, 2024): @aricooperdavis Thanks for the evidences, it makes sense for me, creating #611 to treat this behavior.
Author
Owner

@cmiguelcabral commented on GitHub (Dec 19, 2025):

I'm also experiencing the same issue when resolving docker containers.
The only way to have it working is to enable and configure IPv6 on docker, othewise we get a response like this:

/ # nslookup artifactory.docker 172.28.0.2
Server:         172.28.0.2
Address:        172.28.0.2:53

Non-authoritative answer:
Name:   artifactory.docker
Address: 172.25.0.2

** server can't find artifactory.docker: NXDOMAIN

I'm guessing the error ** server can't find artifactory.docker: NXDOMAIN happens because it cannot find the container's IPv6. I'm saying this because if IPv6 is enabled, we get both IPs instead of an IPv4 and an error.
Some services, like nginx, don't work this way.

Can we just turn off IPv6 in dns-proxy-server?
I don't want to enable and configure IPv6 on docker just to have this working...

<!-- gh-comment-id:3676935264 --> @cmiguelcabral commented on GitHub (Dec 19, 2025): I'm also experiencing the same issue when resolving docker containers. The only way to have it working is to enable and configure IPv6 on docker, othewise we get a response like this: ```` / # nslookup artifactory.docker 172.28.0.2 Server: 172.28.0.2 Address: 172.28.0.2:53 Non-authoritative answer: Name: artifactory.docker Address: 172.25.0.2 ** server can't find artifactory.docker: NXDOMAIN ```` I'm guessing the error `** server can't find artifactory.docker: NXDOMAIN` happens because it cannot find the container's IPv6. I'm saying this because if IPv6 is enabled, we get both IPs instead of an IPv4 and an error. Some services, like nginx, don't work this way. Can we just turn off IPv6 in dns-proxy-server? I don't want to enable and configure IPv6 on docker just to have this working...
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/dns-proxy-server-mageddo#170
No description provided.