[GH-ISSUE #82] AD bit is missing #58

New issue

Open

opened 2026-03-14 01:11:08 +03:00 by kerem · 0 comments

kerem commented

2026-03-14 01:11:08 +03:00

Owner

Originally created by @nl6720 on GitHub (May 29, 2025).
Original GitHub issue: https://github.com/ameshkov/dnslookup/issues/82

For queries with the DO bit set, the results don't contain the AD bit (i.e. there's no ad in flags):

$ DNSSEC=1 dnslookup go.dnscheck.tools tls://wikimedia-dns.org 185.71.138.138
dnslookup master
Server: tls://wikimedia-dns.org

dnslookup result (elapsed 164.97548ms):
;; opcode: QUERY, status: NOERROR, id: 27557
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;go.dnscheck.tools.     IN       A

;; ANSWER SECTION:
go.dnscheck.tools.      1       IN      A       116.203.95.251

Compare it with kdig, which returns ad in Flags:

$ kdig go.dnscheck.tools +dnssec +tls-hostname=wikimedia-dns.org @185.71.138.138
;; TLS session (TLS1.3)-(ECDHE-X25519)-(ECDSA-SECP256R1-SHA256)-(AES-128-GCM)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 12425
;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: ; UDP size: 512 B; ext-rcode: NOERROR
;; PADDING: 391 B

;; QUESTION SECTION:
;; go.dnscheck.tools.           IN      A

;; ANSWER SECTION:
go.dnscheck.tools.      1       IN      A       116.203.95.251

;; Received 457 B
;; Time 2025-05-29 13:25:23 EEST
;; From 185.71.138.138@853(TLS) in 148.4 ms

Originally created by @nl6720 on GitHub (May 29, 2025). Original GitHub issue: https://github.com/ameshkov/dnslookup/issues/82 For queries with the DO bit set, the results don't contain the AD bit (i.e. there's no `ad` in `flags`): ```sh $ DNSSEC=1 dnslookup go.dnscheck.tools tls://wikimedia-dns.org 185.71.138.138 dnslookup master Server: tls://wikimedia-dns.org dnslookup result (elapsed 164.97548ms): ;; opcode: QUERY, status: NOERROR, id: 27557 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;go.dnscheck.tools. IN A ;; ANSWER SECTION: go.dnscheck.tools. 1 IN A 116.203.95.251 ``` Compare it with `kdig`, which returns `ad` in `Flags`: ```sh $ kdig go.dnscheck.tools +dnssec +tls-hostname=wikimedia-dns.org @185.71.138.138 ;; TLS session (TLS1.3)-(ECDHE-X25519)-(ECDSA-SECP256R1-SHA256)-(AES-128-GCM) ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 12425 ;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1 ;; EDNS PSEUDOSECTION: ;; Version: 0; flags: ; UDP size: 512 B; ext-rcode: NOERROR ;; PADDING: 391 B ;; QUESTION SECTION: ;; go.dnscheck.tools. IN A ;; ANSWER SECTION: go.dnscheck.tools. 1 IN A 116.203.95.251 ;; Received 457 B ;; Time 2025-05-29 13:25:23 EEST ;; From 185.71.138.138@853(TLS) in 148.4 ms ```