[GH-ISSUE #3142] Recursor does not handle error responses correctly #1141

New issue

Closed

opened 2026-03-16 01:43:03 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:43:03 +03:00

Owner

Originally created by @divergentdave on GitHub (Jul 22, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3142

PR #3141 changes DNSSEC validation of NXDOMAIN and no data responses in insecure zones. This revealed an issue in the recursor, as the not-auth.extended-dns-errors.com test started failing. The underlying issue is that incoming REFUSED responses get turned into ErrorKind::Negative, which in turn gets turned into an outgoing NOERROR response. I think we need to change ProtoError::from_response() to fix this, and possibly create one or more new ProtoErrorKind variants.

Originally created by @divergentdave on GitHub (Jul 22, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3142 PR #3141 changes DNSSEC validation of NXDOMAIN and no data responses in insecure zones. This revealed an issue in the recursor, as the `not-auth.extended-dns-errors.com` test started failing. The underlying issue is that incoming `REFUSED` responses get turned into `ErrorKind::Negative`, which in turn gets turned into an outgoing `NOERROR` response. I think we need to change `ProtoError::from_response()` to fix this, and possibly create one or more new `ProtoErrorKind` variants.

kerem closed this issue

2026-03-16 01:43:08 +03:00

kerem commented

2026-03-16 01:43:14 +03:00

Author

Owner

@divergentdave commented on GitHub (Jul 22, 2025):

I wonder if this is part of why the trust_negative_responses setting has been important to users. If we are treating REFUSED and other error response codes just like NXDOMAIN, then the unusual retry logic controlled by that setting may be more important.

Edit: nevermind, the conn.trust_negative_responses() branch is also guarded by matching on ResponseCode::NXDomain, so this is not related.

@divergentdave commented on GitHub (Jul 22, 2025): ~~I wonder if this is part of why the `trust_negative_responses` setting has been important to users. If we are treating REFUSED and other error response codes just like NXDOMAIN, then the unusual retry logic controlled by that setting may be more important.~~ Edit: nevermind, the `conn.trust_negative_responses()` branch is also guarded by matching on `ResponseCode::NXDomain`, so this is not related.

kerem referenced this issue

2026-03-16 04:24:19 +03:00

[PR #1141] [MERGED] No more master slave, in honor of Juneteenth #2003