[GH-ISSUE #3153] Recursor: CNAME chasing results in duplicate records #1143

New issue

Closed

opened 2026-03-16 01:43:19 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:43:19 +03:00

Owner

Originally created by @divergentdave on GitHub (Jul 24, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3153

When the recursor resolves a query that involves following CNAME aliases, the resulting response may include CNAME records more than once, or include the queried records more than once in some situations. This is exacerbated by cache behavior, because a response that has been through resolve_cnames() once may get placed into the cache, fetched again, and then processed by resolve_cnames() a second time. The duplicate records can also lead to DNSSEC validation failures, since we do not do optional record deduplication during verification (see RFC 4034 section 6.3).

Originally created by @divergentdave on GitHub (Jul 24, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3153 When the recursor resolves a query that involves following CNAME aliases, the resulting response may include CNAME records more than once, or include the queried records more than once in some situations. This is exacerbated by cache behavior, because a response that has been through `resolve_cnames()` once may get placed into the cache, fetched again, and then processed by `resolve_cnames()` a second time. The duplicate records can also lead to DNSSEC validation failures, since we do not do optional record deduplication during verification (see [RFC 4034 section 6.3](https://datatracker.ietf.org/doc/html/rfc4034#section-6.3)).