[GH-ISSUE #3441] Provide iterator showing DNSSEC status directly on SrvLookup result. #1183

New issue

Open

opened 2026-03-16 01:49:41 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:49:41 +03:00

Owner

Originally created by @davidv1992 on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3441

Is your feature request related to a problem? Please describe.
Currently, to check that SRV records are signed with dnssec, the srv lookup result needs to be downgraded to a general lookup result, only after which the dnssec_iter() function is available. Then the items in that iterator need to be manually back-converted to references to SRV objects for use. The entire thing is a bit of a convoluted process.

Describe the solution you'd like
It would be very nice to have a direct dnssec_iter() on the SrvLookup type that provides access to dnssec validation results on the SRV record objects directly.

Describe alternatives you've considered
None

Additional context
SRV records can change the name which should be expected for TLS certificates. Because of this, validating that they were indeed DNSSEC signed can be critical for an applications security. This in particular is a problem for SRV style pools of NTS servers.

Note: this is for the hickory-resolver crate.

Originally created by @davidv1992 on GitHub (Jan 21, 2026). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3441 **Is your feature request related to a problem? Please describe.** Currently, to check that SRV records are signed with dnssec, the srv lookup result needs to be downgraded to a general lookup result, only after which the `dnssec_iter()` function is available. Then the items in that iterator need to be manually back-converted to references to `SRV` objects for use. The entire thing is a bit of a convoluted process. **Describe the solution you'd like** It would be very nice to have a direct `dnssec_iter()` on the `SrvLookup` type that provides access to dnssec validation results on the `SRV` record objects directly. **Describe alternatives you've considered** None **Additional context** SRV records can change the name which should be expected for TLS certificates. Because of this, validating that they were indeed DNSSEC signed can be critical for an applications security. This in particular is a problem for SRV style pools of NTS servers. Note: this is for the hickory-resolver crate.

kerem commented

2026-03-16 01:49:47 +03:00

Author

Owner

@cpu commented on GitHub (Feb 12, 2026):

It would be very nice to have a direct dnssec_iter() on the SrvLookup type that provides access to dnssec validation results on the SRV record objects directly.

That sounds pretty reasonable to me. Do you think you have cycles to contribute a patch? I'd be happy to review but would be unlikely to be able to prioritize implementing it myself relative to other commitments.

@cpu commented on GitHub (Feb 12, 2026): > It would be very nice to have a direct dnssec_iter() on the SrvLookup type that provides access to dnssec validation results on the SRV record objects directly. That sounds pretty reasonable to me. Do you think you have cycles to contribute a patch? I'd be happy to review but would be unlikely to be able to prioritize implementing it myself relative to other commitments.