[GH-ISSUE #2501] [resolver] v0.25.0-alpha.2 vs. v0.24.1 DNSSEC validation difference #1004

New issue

Closed

opened 2026-03-16 01:14:39 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 01:14:39 +03:00

Owner

Originally created by @kolbma on GitHub (Oct 8, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2501

With v0.24.1:

If a domain has not setup DNSSEC and
ResolverOpts::validate == true
there will be an error in e.g. lookup_ip(): "proto error: rrsigs are not present for record set".

With v0.25.0-alpha.2:

The lookup is successful. Not sure if this is intended or there is some problem in handling the responses.
There are collected some RRSIG for SOA and the corresponding NSEC3 from the top-level domain with the recursive query for DS on the domain. Answer count for the domain-DS is 0.
So not sure why it is continuing to query for DS of top-level-domain.

So should this work like in v0.24.1 and there needs to be some error if DNSSEC is not setup or is it intended that the lookup succeeds?

Originally created by @kolbma on GitHub (Oct 8, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2501 * With __v0.24.1__: If a domain has not setup __DNSSEC__ and `ResolverOpts::validate == true` there will be an error in e.g. `lookup_ip()`: `"proto error: rrsigs are not present for record set"`. * With __v0.25.0-alpha.2__: The lookup is __successful__. Not sure if this is __intended__ or there is some problem in handling the responses. There are collected some _RRSIG_ for _SOA_ and the corresponding _NSEC3_ from the __top-level domain__ with the recursive query for __DS__ on the __domain__. Answer count for the domain-DS is 0. So not sure why it is continuing to query for DS of top-level-domain. So should this work like in __v0.24.1__ and there needs to be some error if DNSSEC is not setup or is it intended that the lookup succeeds?

kerem

2026-03-16 01:14:39 +03:00

closed this issue
added the
unclear
label

kerem commented

2026-03-16 01:14:55 +03:00

Author

Owner

@bluejekyll commented on GitHub (Mar 2, 2025):

I think this is working more correctly in 0.25 based on this report. @divergentdave , thoughts?

@bluejekyll commented on GitHub (Mar 2, 2025): I think this is working more correctly in 0.25 based on this report. @divergentdave , thoughts?

kerem commented

2026-03-16 01:15:01 +03:00

Author

Owner

@divergentdave commented on GitHub (Mar 2, 2025):

Yes, based on the description, this sounds like correct application of the "insecure" validation result. If there are no DS records, and that DS RRset is authenticated, then a validating resolver should determine that the zone is not secured, and return the records in a response with AD=0.

@divergentdave commented on GitHub (Mar 2, 2025): Yes, based on the description, this sounds like correct application of the "insecure" validation result. If there are no DS records, and that DS RRset is authenticated, then a validating resolver should determine that the zone is not secured, and return the records in a response with AD=0.