starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 03:05:51 +03:00

[GH-ISSUE #2633] Subdomain SOA Record Query Failure via Public DNS Servers #1033

New issue

Open

opened 2026-03-16 01:20:06 +03:00 by kerem · 3 comments

kerem commented

2026-03-16 01:20:06 +03:00

Owner

Originally created by @ngocnha on GitHub (Dec 1, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2633

Describe the bug
Public DNS servers like 8.8.8.8 and 9.9.9.9 are unable to retrieve the SOA record for a subdomain from hickory.

To Reproduce
Direct query to hickory works fine:
dig @45.63.4.93 m2410.pro-service.top SOA

But indirect query via a public DNS server fails:
dig @8.8.8.8 m2410.pro-service.top SOA

Expected behavior
The SOA record should be returned correctly through public DNS servers, similar to how querying www.google.com.vn works:
dig @9.9.9.9 www.google.com.vn SOA

The issue lies in the ;; AUTHORITY SECTION:
Hickory returns the NS records
Other returns the SOA record

The similar problem with CNAME record
Because there is no A record in the ANSWER SECTION, then 9.9.9.9 return SERVFAIL

I expect the correct result to be as follows.

System:

OS: Alpine Linux
Architecture: x86_64

Version:
Crate: server
Version: main branch commit 1d74677

Originally created by @ngocnha on GitHub (Dec 1, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2633 **Describe the bug** Public DNS servers like 8.8.8.8 and 9.9.9.9 are unable to retrieve the SOA record for a subdomain from hickory. **To Reproduce** Direct query to hickory works fine: dig @45.63.4.93 m2410.pro-service.top SOA But indirect query via a public DNS server fails: dig @8.8.8.8 m2410.pro-service.top SOA **Expected behavior** The SOA record should be returned correctly through public DNS servers, similar to how querying www.google.com.vn works: dig @9.9.9.9 www.google.com.vn SOA **The issue lies in the ;; AUTHORITY SECTION:** Hickory returns the NS records Other returns the SOA record ![image](https://github.com/user-attachments/assets/0cd87125-d71b-45f5-9bb3-217a6d99cb7b) The similar problem with CNAME record Because there is no A record in the ANSWER SECTION, then 9.9.9.9 return SERVFAIL ![image](https://github.com/user-attachments/assets/209ac2f4-6cbf-418e-a60e-643f38124810) I expect the correct result to be as follows. ![image](https://github.com/user-attachments/assets/2bd5d99b-fdbd-4147-87d4-2b780928e7be) **System:** - OS: Alpine Linux - Architecture: x86_64 **Version:** Crate: server Version: main branch commit 1d74677

kerem added the

crate:server

label

2026-03-16 01:20:06 +03:00

kerem commented

2026-03-16 01:20:17 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Dec 2, 2024):

Please attach your server config file.

@marcus0x62 commented on GitHub (Dec 2, 2024): Please attach your server config file.

kerem commented

2026-03-16 01:22:47 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Dec 2, 2024):

Please attach your server config file.

@marcus0x62 commented on GitHub (Dec 2, 2024): Please attach your server config file.

kerem commented

2026-03-16 01:22:53 +03:00

Author

Owner

@ngocnha commented on GitHub (Dec 2, 2024):

This is my config

[[zones]]
zone = "localhost"
zone_type = "Primary"
file = "default/localhost.zone"

[[zones]]
zone = "0.0.127.in-addr.arpa"
zone_type = "Primary"
file = "default/127.0.0.1.zone"

[[zones]]
zone = "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
zone_type = "Primary"
file = "default/ipv6_1.zone"

[[zones]]
zone = "255.in-addr.arpa"
zone_type = "Primary"
file = "default/255.zone"

[[zones]]
zone = "0.in-addr.arpa"
zone_type = "Primary"
file = "default/0.zone"

[[zones]]
zone = "pro-service.top"
zone_type = "Primary"
enable_dnssec = true
nx_proof_kind = { nsec3 = { iterations = 0 } }
file = "pro-service.top.zone"

[[zones.keys]]
key_path = "dnssec/pro-service.top/ecdsa.256.priv.pk8"
algorithm = "ECDSAP256SHA256"
is_zone_signing_key = true
is_zone_update_auth = false

[[zones.keys]]
key_path = "dnssec/update/ed25519.priv.pk8"
algorithm = "ED25519"
is_zone_signing_key = false
is_zone_update_auth = true

@ngocnha commented on GitHub (Dec 2, 2024): This is my config ``` [[zones]] zone = "localhost" zone_type = "Primary" file = "default/localhost.zone" [[zones]] zone = "0.0.127.in-addr.arpa" zone_type = "Primary" file = "default/127.0.0.1.zone" [[zones]] zone = "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" zone_type = "Primary" file = "default/ipv6_1.zone" [[zones]] zone = "255.in-addr.arpa" zone_type = "Primary" file = "default/255.zone" [[zones]] zone = "0.in-addr.arpa" zone_type = "Primary" file = "default/0.zone" [[zones]] zone = "pro-service.top" zone_type = "Primary" enable_dnssec = true nx_proof_kind = { nsec3 = { iterations = 0 } } file = "pro-service.top.zone" [[zones.keys]] key_path = "dnssec/pro-service.top/ecdsa.256.priv.pk8" algorithm = "ECDSAP256SHA256" is_zone_signing_key = true is_zone_update_auth = false [[zones.keys]] key_path = "dnssec/update/ed25519.priv.pk8" algorithm = "ED25519" is_zone_signing_key = false is_zone_update_auth = true ```

kerem referenced this issue

2026-03-16 03:10:43 +03:00

[PR #1033] [MERGED] Balboah fix/missing cname records #1894

kerem referenced this issue

2026-03-16 04:00:20 +03:00

[PR #1069] [MERGED] 0.19.4 release #1944

kerem referenced this issue

2026-03-16 05:42:36 +03:00

[PR #1218] [MERGED] update unreadable comment with proper RFC link and text #2094