[GH-ISSUE #2814] Resolver returns SERVFAIL when no data response lacks SOA #1066

New issue

Closed

opened 2026-03-16 01:30:18 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:30:18 +03:00

Owner

Originally created by @divergentdave on GitHub (Feb 28, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2814

I found the following name server used by a domain parker that does not include any NS or SOA records in the following no data response's authority section.

$ dig +norec @ns1.parkingcrew.net TXT _acme-challenge.www.hittinghub.chilli2shop.com.

; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> +norec @ns1.parkingcrew.net TXT _acme-challenge.www.hittinghub.chilli2shop.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59602
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_acme-challenge.www.hittinghub.chilli2shop.com.	IN TXT

;; Query time: 36 msec
;; SERVER: 13.248.158.159#53(ns1.parkingcrew.net) (UDP)
;; WHEN: Fri Feb 28 12:26:50 CST 2025
;; MSG SIZE  rcvd: 64

When I try to perform this query via Hickory DNS as a validating recursive resolver, I get a SERVFAIL and see the following error: DEBUG:hickory_server::authority::catalog:835:error resolving RecursiveError(Error { kind: Proto(ProtoError { kind: Msg("proto error missing ns and soa") }) }). Unbound can handle this query, and it verifies that the response is insecure.

We should handle this edge case, but I haven't looked into how the lack of these records impacts resolver algorithms yet.

Originally created by @divergentdave on GitHub (Feb 28, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2814 I found the following name server used by a domain parker that does not include any NS or SOA records in the following no data response's authority section. ``` $ dig +norec @ns1.parkingcrew.net TXT _acme-challenge.www.hittinghub.chilli2shop.com. ; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> +norec @ns1.parkingcrew.net TXT _acme-challenge.www.hittinghub.chilli2shop.com. ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59602 ;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;_acme-challenge.www.hittinghub.chilli2shop.com. IN TXT ;; Query time: 36 msec ;; SERVER: 13.248.158.159#53(ns1.parkingcrew.net) (UDP) ;; WHEN: Fri Feb 28 12:26:50 CST 2025 ;; MSG SIZE rcvd: 64 ``` When I try to perform this query via Hickory DNS as a validating recursive resolver, I get a SERVFAIL and see the following error: `DEBUG:hickory_server::authority::catalog:835:error resolving RecursiveError(Error { kind: Proto(ProtoError { kind: Msg("proto error missing ns and soa") }) })`. Unbound can handle this query, and it verifies that the response is insecure. We should handle this edge case, but I haven't looked into how the lack of these records impacts resolver algorithms yet.