[PR #2203] [MERGED] recursor: send DS queries to the parent zone #2875

New issue

Closed

opened 2026-03-16 11:13:04 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:13:04 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2203
Author: @japaric
Created: 4/29/2024
Status: ✅ Merged
Merged: 5/18/2024
Merged by: @bluejekyll

Base: main ← Head: ja-ds-query

📝 Commits (1)

49ef34c recursor: send DS query to the parent zone

📊 Changes

1 file changed (+2 additions, -1 deletions)

View changed files

📝 crates/recursor/src/recursor.rs (+2 -1)

📄 Description

the DS records have to be signed by the parent so they are stored in the parent zone. therefore, the resolver needs to send the query to the parent zone.

this fixes the conformance tests added in https://github.com/ferrous-systems/dnssec-tests/pull/54

with this change, delv works with hickory-dns:

$ delv -p 1053 @127.0.0.1 +rtrace www.example.com.
;; fetch: www.example.com/A
;; fetch: example.com/DNSKEY
;; fetch: example.com/DS
;; fetch: com/DNSKEY
;; fetch: com/DS
;; fetch: ./DNSKEY
; fully validated

this PR builds on top of #2196 so I'm going to leave in draft state until that one is merged

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2203 **Author:** [@japaric](https://github.com/japaric) **Created:** 4/29/2024 **Status:** ✅ Merged **Merged:** 5/18/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `ja-ds-query` --- ### 📝 Commits (1) - [`49ef34c`](https://github.com/hickory-dns/hickory-dns/commit/49ef34cb3e7571c035893fbe71af54d38f2018dc) recursor: send DS query to the parent zone ### 📊 Changes **1 file changed** (+2 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `crates/recursor/src/recursor.rs` (+2 -1) </details> ### 📄 Description the DS records have to be signed by the parent so they are stored in the parent zone. therefore, the resolver needs to send the query to the parent zone. this fixes the conformance tests added in https://github.com/ferrous-systems/dnssec-tests/pull/54 with this change, `delv` works with `hickory-dns`: ``` console $ delv -p 1053 @127.0.0.1 +rtrace www.example.com. ;; fetch: www.example.com/A ;; fetch: example.com/DNSKEY ;; fetch: example.com/DS ;; fetch: com/DNSKEY ;; fetch: com/DS ;; fetch: ./DNSKEY ; fully validated ``` this PR builds on top of #2196 so I'm going to leave in draft state until that one is merged --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>