[PR #3344] [MERGED] Zone cut identification in the recursor #3761

New issue

Closed

opened 2026-03-16 12:01:18 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 12:01:18 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3344
Author: @marcus0x62
Created: 11/9/2025
Status: ✅ Merged
Merged: 11/11/2025
Merged by: @marcus0x62

Base: main ← Head: zone-cut-identification

📝 Commits (4)

bb23ef1 recursor: identify and return zone cut to caller
0594408 conformance: update conformance tests for zone cut changes
48e9e68 recursor: make ns_pool_for_zone less recursive
8636129 recursor: unit tests for ns_pool_for_name changes

📊 Changes

6 files changed (+337 additions, -183 deletions)

View changed files

📝 conformance/e2e-tests/src/recursor/delegation/scenarios.rs (+4 -4)
📝 conformance/e2e-tests/src/recursor/rfc9539/scenarios.rs (+6 -17)
📝 crates/recursor/src/recursor_dns_handle.rs (+181 -160)
📝 crates/recursor/src/tests.rs (+130 -1)
📝 crates/resolver/src/name_server_pool.rs (+14 -1)
📝 tests/test-support/src/lib.rs (+2 -0)

📄 Description

This changes ns_pool_for_zone (changed to ns_pool_for_name to better reflect what it does) to associate an accurate zone name with each nameserverpool it creates and make that information accessible to the caller.

Previously, if you searched for a.b.c.example.com, ns_pool_for_zone would identify the name servers for that name, but not tell the caller (resolve) if it last found NS delegations, for example, at example.com. Resolve would operate on the assumption that the zone for a.b.c.example.com was a.b.c.example.com.

For most queries, this isn't a practical problem, but while working on #2882, I found the recursor sometimes discarded NSEC wildcard records (failing bailiwick filter checks) needed to properly validate responses.

This also removes some of the recursion from ns_pool_for_name by creating a list of zones to resolve and iterating over that list rather than calling itself recursively.

@cpu - I had to update a couple of opportunistic encryption tests that were expecting to see NS queries to the root zone, which we shouldn't be sending (we have the root hints cached and use those for NS queries for .) That didn't seem to be really important for the test, but if you need to see NS queries for whatever reason, I think we'll need to use a subdomain in those tests.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3344 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 11/9/2025 **Status:** ✅ Merged **Merged:** 11/11/2025 **Merged by:** [@marcus0x62](https://github.com/marcus0x62) **Base:** `main` ← **Head:** `zone-cut-identification` --- ### 📝 Commits (4) - [`bb23ef1`](https://github.com/hickory-dns/hickory-dns/commit/bb23ef1c193f213cb03dac32aff7a00513df81c9) recursor: identify and return zone cut to caller - [`0594408`](https://github.com/hickory-dns/hickory-dns/commit/05944083ab5cdeff1a43b75cbd9d265d401a9ea2) conformance: update conformance tests for zone cut changes - [`48e9e68`](https://github.com/hickory-dns/hickory-dns/commit/48e9e6870e9302700a9903712ff99a262df920ab) recursor: make ns_pool_for_zone less recursive - [`8636129`](https://github.com/hickory-dns/hickory-dns/commit/86361298383e1310b90f5a37ca68a80ddbdf7718) recursor: unit tests for ns_pool_for_name changes ### 📊 Changes **6 files changed** (+337 additions, -183 deletions) <details> <summary>View changed files</summary> 📝 `conformance/e2e-tests/src/recursor/delegation/scenarios.rs` (+4 -4) 📝 `conformance/e2e-tests/src/recursor/rfc9539/scenarios.rs` (+6 -17) 📝 `crates/recursor/src/recursor_dns_handle.rs` (+181 -160) 📝 `crates/recursor/src/tests.rs` (+130 -1) 📝 `crates/resolver/src/name_server_pool.rs` (+14 -1) 📝 `tests/test-support/src/lib.rs` (+2 -0) </details> ### 📄 Description This changes ns_pool_for_zone (changed to ns_pool_for_name to better reflect what it does) to associate an accurate zone name with each nameserverpool it creates and make that information accessible to the caller. Previously, if you searched for a.b.c.example.com, ns_pool_for_zone would identify the name servers for that name, but not tell the caller (resolve) if it last found NS delegations, for example, at example.com. Resolve would operate on the assumption that the zone for a.b.c.example.com was a.b.c.example.com. For most queries, this isn't a practical problem, but while working on #2882, I found the recursor sometimes discarded NSEC wildcard records (failing bailiwick filter checks) needed to properly validate responses. This also removes some of the recursion from ns_pool_for_name by creating a list of zones to resolve and iterating over that list rather than calling itself recursively. @cpu - I had to update a couple of opportunistic encryption tests that were expecting to see NS queries to the root zone, which we shouldn't be sending (we have the root hints cached and use those for NS queries for .) That didn't seem to be really important for the test, but if you need to see NS queries for whatever reason, I think we'll need to use a subdomain in those tests. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>