[GH-ISSUE #3128] Validating resolver returns SERVFAIL when an insecure zone name server doesn't return SOA in no data response #1139

New issue

Closed

opened 2026-03-16 01:43:03 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:43:03 +03:00

Owner

Originally created by @divergentdave on GitHub (Jul 17, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3128

I found another name server from the same domain parker as in #2814, and found that the same behavior causes a different bug when DNSSEC validation is enabled. (My previous reproduction test case did not enable DNSSEC) The issue is that check_nsec() will throw an error if the SOA RR is missing, even if the answer has been found to be insecure already. This may be easier to fix after other planned DNSSEC changes.

Originally created by @divergentdave on GitHub (Jul 17, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3128 I found another name server from the same domain parker as in #2814, and found that the same behavior causes a different bug when DNSSEC validation is enabled. (My previous reproduction test case did not enable DNSSEC) The issue is that `check_nsec()` will throw an error if the SOA RR is missing, even if the answer has been found to be insecure already. This may be easier to fix after other planned DNSSEC changes.