[PR #2369] [MERGED] Add "do not query" configuration to recursor #2986

New issue

Closed

opened 2026-03-16 11:19:02 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:19:02 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2369
Author: @divergentdave
Created: 8/21/2024
Status: ✅ Merged
Merged: 9/1/2024
Merged by: @bluejekyll

Base: main ← Head: david/do-not-query

📝 Commits (3)

ad7a425 Block recursive queries to configured networks
0da6f60 dns-test: Add option to override config file
c33f88b Add end-to-end tests

📊 Changes

14 files changed (+353 additions, -30 deletions)

View changed files

📝 Cargo.lock (+2 -0)
📝 conformance/packages/dns-test/src/resolver.rs (+20 -8)
📝 crates/recursor/Cargo.toml (+2 -0)
📝 crates/recursor/src/recursor.rs (+13 -0)
📝 crates/recursor/src/recursor_dns_handle.rs (+69 -18)
📝 crates/server/src/config/mod.rs (+12 -0)
📝 crates/server/src/store/recursor/authority.rs (+2 -1)
📝 crates/server/src/store/recursor/config.rs (+5 -0)
📝 tests/e2e-tests/Cargo.lock (+1 -0)
📝 tests/e2e-tests/Cargo.toml (+1 -0)
📝 tests/e2e-tests/src/resolver.rs (+1 -0)
➕ tests/e2e-tests/src/resolver/do_not_query.rs (+204 -0)
➕ tests/e2e-tests/src/resolver/do_not_query.toml.jinja (+13 -0)
📝 tests/test-data/test_configs/example_recursor.toml (+8 -3)

📄 Description

This adds a do_not_query configuration option to the recursor, and in server configuration files. When resolving names, the recursor will filter out any nameserver addresses that fall into the configured networks, and never send them DNS requests. This implements the IP address part of #1723. The intended use of this is to prevent a recursive resolver from trying to do lookups against itself, or other DNS servers on a private network, regardless of the referrals found in other zones.

End-to-end tests are included, to check that no requests are made to a specified name server when it is either the only nameserver returned in a referral, or one of two referrals.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2369 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 8/21/2024 **Status:** ✅ Merged **Merged:** 9/1/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `david/do-not-query` --- ### 📝 Commits (3) - [`ad7a425`](https://github.com/hickory-dns/hickory-dns/commit/ad7a425535e328d58afd6176269fa72ed486fed2) Block recursive queries to configured networks - [`0da6f60`](https://github.com/hickory-dns/hickory-dns/commit/0da6f60f6bab5073948deb3fc98ecf5423b96512) dns-test: Add option to override config file - [`c33f88b`](https://github.com/hickory-dns/hickory-dns/commit/c33f88bf7c6a8f1c43bd5746f53b18dafc9b65a1) Add end-to-end tests ### 📊 Changes **14 files changed** (+353 additions, -30 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+2 -0) 📝 `conformance/packages/dns-test/src/resolver.rs` (+20 -8) 📝 `crates/recursor/Cargo.toml` (+2 -0) 📝 `crates/recursor/src/recursor.rs` (+13 -0) 📝 `crates/recursor/src/recursor_dns_handle.rs` (+69 -18) 📝 `crates/server/src/config/mod.rs` (+12 -0) 📝 `crates/server/src/store/recursor/authority.rs` (+2 -1) 📝 `crates/server/src/store/recursor/config.rs` (+5 -0) 📝 `tests/e2e-tests/Cargo.lock` (+1 -0) 📝 `tests/e2e-tests/Cargo.toml` (+1 -0) 📝 `tests/e2e-tests/src/resolver.rs` (+1 -0) ➕ `tests/e2e-tests/src/resolver/do_not_query.rs` (+204 -0) ➕ `tests/e2e-tests/src/resolver/do_not_query.toml.jinja` (+13 -0) 📝 `tests/test-data/test_configs/example_recursor.toml` (+8 -3) </details> ### 📄 Description This adds a `do_not_query` configuration option to the recursor, and in server configuration files. When resolving names, the recursor will filter out any nameserver addresses that fall into the configured networks, and never send them DNS requests. This implements the IP address part of #1723. The intended use of this is to prevent a recursive resolver from trying to do lookups against itself, or other DNS servers on a private network, regardless of the referrals found in other zones. End-to-end tests are included, to check that no requests are made to a specified name server when it is either the only nameserver returned in a referral, or one of two referrals. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>