[GH-ISSUE #3160] Reuse of zone cuts in validating recursive resolver #1147

New issue

Open

opened 2026-03-16 01:43:40 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:43:40 +03:00

Owner

Originally created by @divergentdave on GitHub (Jul 25, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3160

When validating a response that lacks RRSIG RRs, we need to find the enclosing zone, and request the DS RRset from the parent zone. RFC 4035 section 4.2 mentions that a resolver may already have the parent zone's NS RRset. Instead, we always use the fallback algorithm listed below that, requresting NS RRsets of successively shorter names. If we could reuse the already-discovered zone cuts from the recursor, that would be good for performance and would help us gracefully handle authoritative name servers lacking a zone's apex NS RRset.

The challenging part of solving this is that DnssecDnsHandle currently communicates with its inner recursive resolver or client through the DnsHandle trait. Thus, we will need to somehow smuggle the relevant zone cuts through an argument or return value of an existing method, or add another method just for this purpose. We will also need to keep the fallback algorithm for non-recursive resolver use cases.

Originally posted by @divergentdave in https://github.com/hickory-dns/hickory-dns/issues/3156#issuecomment-3120127507

Originally created by @divergentdave on GitHub (Jul 25, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3160 When validating a response that lacks RRSIG RRs, we need to find the enclosing zone, and request the DS RRset from the parent zone. RFC 4035 section 4.2 mentions that a resolver may already have the parent zone's NS RRset. Instead, we always use the fallback algorithm listed below that, requresting NS RRsets of successively shorter names. If we could reuse the already-discovered zone cuts from the recursor, that would be good for performance and would help us gracefully handle authoritative name servers lacking a zone's apex NS RRset. The challenging part of solving this is that `DnssecDnsHandle` currently communicates with its inner recursive resolver or client through the `DnsHandle` trait. Thus, we will need to somehow smuggle the relevant zone cuts through an argument or return value of an existing method, or add another method just for this purpose. We will also need to keep the fallback algorithm for non-recursive resolver use cases. _Originally posted by @divergentdave in https://github.com/hickory-dns/hickory-dns/issues/3156#issuecomment-3120127507_