starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 03:05:51 +03:00

[GH-ISSUE #2514] DNSSEC Not Working as Expected #1009

New issue

Open

opened 2026-03-16 01:15:21 +03:00 by kerem · 11 comments

kerem commented

2026-03-16 01:15:21 +03:00

Owner

Originally created by @ngocnha on GitHub (Oct 17, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2514

Upon successful DNSSEC configuration on my hickory-dns server, I anticipated receiving an NSEC record in response to a query for a non-existent RRset. However, the server is only returning an SOA record.
I'm certain DNSSEC is configured correctly. I'm using the latest hickory-dns version pulled from the git repository. What could I be missing?

Originally created by @ngocnha on GitHub (Oct 17, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2514 Upon successful DNSSEC configuration on my hickory-dns server, I anticipated receiving an NSEC record in response to a query for a non-existent RRset. However, the server is only returning an SOA record. I'm certain DNSSEC is configured correctly. I'm using the latest hickory-dns version pulled from the git repository. What could I be missing?

kerem added the

docs

has workaround

labels

2026-03-16 01:15:21 +03:00

kerem commented

2026-03-16 01:15:33 +03:00

Author

Owner

@djc commented on GitHub (Oct 17, 2024):

Do you have a minimal reproduction?

@djc commented on GitHub (Oct 17, 2024): Do you have a minimal reproduction?

kerem commented

2026-03-16 01:15:38 +03:00

Author

Owner

@ngocnha commented on GitHub (Oct 17, 2024):

The parameters I used to build hickory-dns are in this command line

cargo build --target x86_64-unknown-linux-musl --release -p hickory-dns --no-default-features --features sqlite,dnssec,dnssec-ring,dns-over-quic

I've configured a server on ip addr 45.63.4.93. You can query it to verify.

dig @45.63.4.93 -p 1053 abcdef.pro-service.top A +dnssec +multiline

@ngocnha commented on GitHub (Oct 17, 2024): The parameters I used to build hickory-dns are in this command line cargo build --target x86_64-unknown-linux-musl --release -p hickory-dns --no-default-features --features sqlite,dnssec,dnssec-ring,dns-over-quic I've configured a server on ip addr 45.63.4.93. You can query it to verify. dig @45.63.4.93 -p 1053 abcdef.pro-service.top A +dnssec +multiline

kerem commented

2026-03-16 01:15:43 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 18, 2024):

This is related to the issue(s) addressed in #2502. Right now, the recursor does not do any dnssec processing of any error response (which include negative responses.)

There are also some bugs related to nsec3 record validation that are not addressed in that PR, but for the basic case of properly delegated secure zone returning a nodata response with an nsec proof, 2502 should provide a complete fix.

@marcus0x62 commented on GitHub (Oct 18, 2024): This is related to the issue(s) addressed in #2502. Right now, the recursor does not do any dnssec processing of any error response (which include negative responses.) There are also some bugs related to nsec3 record validation that are not addressed in that PR, but for the basic case of properly delegated secure zone returning a nodata response with an nsec proof, 2502 should provide a complete fix.

kerem commented

2026-03-16 01:15:48 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 20, 2024):

Hi @ngocnha, I've merged #2502 into our main branch. Please check this out and see if it fixes the problem you are seeing. Note: the domain you included in your example does not appear to return NSEC records, at least not for abcdef.pro-service.top. If you query against google dns, it will return an EDE error code 12 - NSEC Missing. I rebuilt a server from the current main branch and verified a query against that server did return NSEC records for another domain which I know is configured correctly.

@marcus0x62 commented on GitHub (Oct 20, 2024): Hi @ngocnha, I've merged #2502 into our main branch. Please check this out and see if it fixes the problem you are seeing. Note: the domain you included in your example does not appear to return NSEC records, at least not for abcdef.pro-service.top. If you query against google dns, it will return an EDE error code 12 - NSEC Missing. I rebuilt a server from the current main branch and verified a query against that server *did* return NSEC records for another domain which I know is configured correctly.

kerem commented

2026-03-16 01:15:53 +03:00

Author

Owner

@ngocnha commented on GitHub (Oct 21, 2024):

I pulled the code from the main branch and built it. I configured DNSSEC according to the example template, and it can automatically generate RRSIG records, but I don't know why it still can't automatically generate NSEC records.

@ngocnha commented on GitHub (Oct 21, 2024): I pulled the code from the main branch and built it. I configured DNSSEC according to the example template, and it can automatically generate RRSIG records, but I don't know why it still can't automatically generate NSEC records.

kerem commented

2026-03-16 01:15:58 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 21, 2024):

Can you post your named.toml file?

@marcus0x62 commented on GitHub (Oct 21, 2024): Can you post your named.toml file?

kerem commented

2026-03-16 01:16:03 +03:00

Author

Owner

@ngocnha commented on GitHub (Oct 21, 2024):

This is my config file

[[zones]]
zone = "localhost"
zone_type = "Primary"
file = "default/localhost.zone"

[[zones]]
zone = "0.0.127.in-addr.arpa"
zone_type = "Primary"
file = "default/127.0.0.1.zone"

[[zones]]
zone = "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
zone_type = "Primary"
file = "default/ipv6_1.zone"

[[zones]]
zone = "255.in-addr.arpa"
zone_type = "Primary"
file = "default/255.zone"

[[zones]]
zone = "0.in-addr.arpa"
zone_type = "Primary"
file = "default/0.zone"

[[zones]]
zone = "pro-service.top"
zone_type = "Primary"
enable_dnssec = true
stores = { type = "sqlite", zone_file_path = "pro-service.top.zone", journal_file_path = "pro-service.top_dnssec_update.jrnl", allow_update = true }

[[zones.keys]]
key_path = "dnssec/zsk_rsa_2048.pem"
algorithm = "RSASHA256"
is_zone_signing_key = true
is_zone_update_auth = false

[[zones.keys]]
# Requires --features=ring
key_path = "dnssec/update/ed25519.priv.pk8"
algorithm = "ED25519"
is_zone_signing_key = false
is_zone_update_auth = true

pro-service.top.zone

@                   IN SOA   ns1.pro-service.top. hostmaster.pro-service.top. 2024100805 10000 2400 604800 600

                    IN NS    ns1.pro-service.top.
                    IN NS    ns2.pro-service.top.

ns1                 IN CNAME m2410.pro-service.top.
ns2                 IN CNAME m2410.pro-service.top.

@                   IN A     45.63.4.93
m2410               IN A     45.63.4.93

mail                IN CNAME m2410.pro-service.top.
autoconfig          IN CNAME m2410.pro-service.top.
autodiscover        IN CNAME m2410.pro-service.top.
mta-sts             IN CNAME m2410.pro-service.top.

@                   IN MX    10 m2410.pro-service.top.

@                   IN TXT   "v=spf1 mx ra=postmaster -all"
m2410               IN TXT   "v=spf1 a ra=postmaster -all"

202410e._domainkey  IN TXT   "v=DKIM1; s=email; k=ed25519; p=LAMT7C3N7PkvZH/zoU+79aTPw/LAb5JmsYWYSPzH+Rc="
202410r._domainkey  IN TXT   "v=DKIM1; s=email; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx1V5nnaxWFaFzBbZ621yIFAyYh8eViXKxDObYxHZ31VljVWgIOEBBA7th4F8cOLP1WET9ZopH4cFVbfQcQt1XSCI>

_dmarc              IN TXT   "v=DMARC1; p=reject; rua=mailto:postmaster@pro-service.top; ruf=mailto:postmaster@pro-service.top; aspf=s; adkim=s"

_mta-sts            IN TXT   "v=STSv1; id=13664471781970075432"
_smtp._tls          IN TXT   "v=TLSRPTv1; rua=mailto:postmaster@pro-service.top"

@                   IN CAA   0 issue "letsencrypt.org"
@                   IN CAA   0 issuewild "letsencrypt.org"

_25._tcp.m2410      IN TLSA  3 0 1 f6d46814195160a1b65b911c6846a6a2e02e0deef01f1e406ac0906eea2be0e1
_25._tcp.m2410      IN TLSA  3 0 2 8200bdaa7618fbe720051f58da39789bed74a567c19de86c04c01e08477f47f5d0bcafa103a5cfc030a50816257880b82f11f47aad489b4910b1c3947ac55bfb
_25._tcp.m2410      IN TLSA  3 1 1 2687653821943f6012010a6950219afeccc79667a15527d6372c55cb2a02e237
_25._tcp.m2410      IN TLSA  3 1 2 1fb999f1270c683154d8d5d4e9da34f8a92a81ad393a1adb81cd33dbe99a4df04a232cbec8f14315b2c2632b881e45668b907972fadf32a10cf39f04a7f2057d
_25._tcp.m2410      IN TLSA  2 0 1 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb
_25._tcp.m2410      IN TLSA  2 0 2 4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd
_25._tcp.m2410      IN TLSA  2 1 1 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
_25._tcp.m2410      IN TLSA  2 1 2 a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402

and my build command

cargo build --target x86_64-unknown-linux-musl --release -p hickory-dns \
--no-default-features \
--features sqlite,dnssec,dnssec-openssl,dnssec-ring

@ngocnha commented on GitHub (Oct 21, 2024): ### This is my config file ``` [[zones]] zone = "localhost" zone_type = "Primary" file = "default/localhost.zone" [[zones]] zone = "0.0.127.in-addr.arpa" zone_type = "Primary" file = "default/127.0.0.1.zone" [[zones]] zone = "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" zone_type = "Primary" file = "default/ipv6_1.zone" [[zones]] zone = "255.in-addr.arpa" zone_type = "Primary" file = "default/255.zone" [[zones]] zone = "0.in-addr.arpa" zone_type = "Primary" file = "default/0.zone" [[zones]] zone = "pro-service.top" zone_type = "Primary" enable_dnssec = true stores = { type = "sqlite", zone_file_path = "pro-service.top.zone", journal_file_path = "pro-service.top_dnssec_update.jrnl", allow_update = true } [[zones.keys]] key_path = "dnssec/zsk_rsa_2048.pem" algorithm = "RSASHA256" is_zone_signing_key = true is_zone_update_auth = false [[zones.keys]] # Requires --features=ring key_path = "dnssec/update/ed25519.priv.pk8" algorithm = "ED25519" is_zone_signing_key = false is_zone_update_auth = true ``` ### pro-service.top.zone ``` @ IN SOA ns1.pro-service.top. hostmaster.pro-service.top. 2024100805 10000 2400 604800 600 IN NS ns1.pro-service.top. IN NS ns2.pro-service.top. ns1 IN CNAME m2410.pro-service.top. ns2 IN CNAME m2410.pro-service.top. @ IN A 45.63.4.93 m2410 IN A 45.63.4.93 mail IN CNAME m2410.pro-service.top. autoconfig IN CNAME m2410.pro-service.top. autodiscover IN CNAME m2410.pro-service.top. mta-sts IN CNAME m2410.pro-service.top. @ IN MX 10 m2410.pro-service.top. @ IN TXT "v=spf1 mx ra=postmaster -all" m2410 IN TXT "v=spf1 a ra=postmaster -all" 202410e._domainkey IN TXT "v=DKIM1; s=email; k=ed25519; p=LAMT7C3N7PkvZH/zoU+79aTPw/LAb5JmsYWYSPzH+Rc=" 202410r._domainkey IN TXT "v=DKIM1; s=email; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx1V5nnaxWFaFzBbZ621yIFAyYh8eViXKxDObYxHZ31VljVWgIOEBBA7th4F8cOLP1WET9ZopH4cFVbfQcQt1XSCI> _dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:postmaster@pro-service.top; ruf=mailto:postmaster@pro-service.top; aspf=s; adkim=s" _mta-sts IN TXT "v=STSv1; id=13664471781970075432" _smtp._tls IN TXT "v=TLSRPTv1; rua=mailto:postmaster@pro-service.top" @ IN CAA 0 issue "letsencrypt.org" @ IN CAA 0 issuewild "letsencrypt.org" _25._tcp.m2410 IN TLSA 3 0 1 f6d46814195160a1b65b911c6846a6a2e02e0deef01f1e406ac0906eea2be0e1 _25._tcp.m2410 IN TLSA 3 0 2 8200bdaa7618fbe720051f58da39789bed74a567c19de86c04c01e08477f47f5d0bcafa103a5cfc030a50816257880b82f11f47aad489b4910b1c3947ac55bfb _25._tcp.m2410 IN TLSA 3 1 1 2687653821943f6012010a6950219afeccc79667a15527d6372c55cb2a02e237 _25._tcp.m2410 IN TLSA 3 1 2 1fb999f1270c683154d8d5d4e9da34f8a92a81ad393a1adb81cd33dbe99a4df04a232cbec8f14315b2c2632b881e45668b907972fadf32a10cf39f04a7f2057d _25._tcp.m2410 IN TLSA 2 0 1 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb _25._tcp.m2410 IN TLSA 2 0 2 4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd _25._tcp.m2410 IN TLSA 2 1 1 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8 _25._tcp.m2410 IN TLSA 2 1 2 a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402 ``` ### and my build command ``` cargo build --target x86_64-unknown-linux-musl --release -p hickory-dns \ --no-default-features \ --features sqlite,dnssec,dnssec-openssl,dnssec-ring ```

kerem commented

2026-03-16 01:16:08 +03:00

Author

Owner

@divergentdave commented on GitHub (Oct 21, 2024):

I think you may need to add nx_proof_kind = "nsec" or nx_proof_kind = { nsec3 = { iterations = 0 } } below enable_dnssec = true to generate those records. (I haven't tested this myself FWIW)

@divergentdave commented on GitHub (Oct 21, 2024): I think you may need to add `nx_proof_kind = "nsec"` or `nx_proof_kind = { nsec3 = { iterations = 0 } }` below `enable_dnssec = true` to generate those records. (I haven't tested this myself FWIW)

kerem commented

2026-03-16 01:16:13 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 21, 2024):

I just tested it. @divergentdave is correct.

@marcus0x62 commented on GitHub (Oct 21, 2024): I just tested it. @divergentdave is correct.

kerem commented

2026-03-16 01:16:18 +03:00

Author

Owner

@ngocnha commented on GitHub (Oct 21, 2024):

Thank @marcus0x62 and @divergentdave for your support. I think I'm missing something, but I couldn't find this option in the document and examples. I just tried searching based on your suggestion and found it somewhere in the testing code.

@ngocnha commented on GitHub (Oct 21, 2024): Thank @marcus0x62 and @divergentdave for your support. I think I'm missing something, but I couldn't find this option in the document and examples. I just tried searching based on your suggestion and found it somewhere in the testing code.

kerem commented

2026-03-16 01:16:24 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 21, 2024):

@ngocnha I don't think you missed anything. I think our documentation is a bit behind the code, and for this case we should probably have a default instead of requiring a selection for each zone. Sorry for the confusion.

@marcus0x62 commented on GitHub (Oct 21, 2024): @ngocnha I don't think you missed anything. I think our documentation is a bit behind the code, and for this case we should probably have a default instead of requiring a selection for each zone. Sorry for the confusion.

kerem referenced this issue

2026-03-16 02:36:56 +03:00

[PR #1009] [MERGED] Make the field public to make creating a custom ResolverOpts easier #1864

kerem referenced this issue

2026-03-16 02:51:45 +03:00

[PR #1009] [MERGED] Make the field public to make creating a custom ResolverOpts easier #1868

kerem referenced this issue

2026-03-16 02:52:36 +03:00

[PR #1025] [MERGED] Bring over master updates for 0.19 #1882

kerem referenced this issue

2026-03-16 03:10:18 +03:00

[PR #1025] [MERGED] Bring over master updates for 0.19 #1889