[GH-ISSUE #1275] Query matching empty wildcard node returned with NXDOMAIN instead of NOERROR #638

New issue

Open

opened 2026-03-15 23:35:22 +03:00 by kerem · 1 comment

kerem commented

2026-03-15 23:35:22 +03:00

Owner

Originally created by @SivaKesava1 on GitHub (Nov 4, 2020).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1275

Hi again,

I found a not so commonly used case where the authoritative DNS server does something slightly off.
Consider the following example zone file:


example.com.	500	SOA	ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800
example.com.	500	NS	ns1.outside.com.
f.*.e.example.com.	500	A	2.2.2.2
t.e.example.com.	500	A	1.1.1.1

For the query <something.e.example.com. , A>, the server returns the following response:

          "opcode QUERY",
          "rcode NXDOMAIN",
          "flags QR AA",
          ";QUESTION",
          "something.e.example.com. IN A",
          ";ANSWER",
          ";AUTHORITY",
          "example.com. 500 IN SOA ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800",
          ";ADDITIONAL"

Expected behavior
The query name something.e.example.com. will match the empty wildcard node, so the rcode should be NOERROR instead of NXDOMAIN. The other implementations like BIND, NSD, PowerDNS, Knot return NOERROR code with everything else being the same.

System:

OS: Ubuntu
Architecture: x86_64
Version: 18
rustc version: cargo 1.47.0

@bluejekyll, sorry for just filing issues and not contributing to the codebase currently as I have to pick up Rust.

Originally created by @SivaKesava1 on GitHub (Nov 4, 2020). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1275 Hi again, I found a not so commonly used case where the authoritative DNS server does something slightly off. Consider the following example zone file: | | | | | |- |- |- |- | | example.com. | 500 | SOA | ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800 | | example.com. | 500 | NS | ns1.outside.com. | | f.*.e.example.com. | 500 | A| 2.2.2.2 | | t.e.example.com. | 500| A | 1.1.1.1 | For the query _<something.e.example.com. , A>_, the server returns the following response: ``` "opcode QUERY", "rcode NXDOMAIN", "flags QR AA", ";QUESTION", "something.e.example.com. IN A", ";ANSWER", ";AUTHORITY", "example.com. 500 IN SOA ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800", ";ADDITIONAL" ``` **Expected behavior** The query name _something.e.example.com._ will match the empty wildcard node, so the rcode should be `NOERROR` instead of `NXDOMAIN.` The other implementations like BIND, NSD, PowerDNS, Knot return `NOERROR` code with everything else being the same. **System:** - OS: Ubuntu - Architecture: x86_64 - Version: 18 - rustc version: cargo 1.47.0 @bluejekyll, sorry for just filing issues and not contributing to the codebase currently as I have to pick up Rust.

kerem added the

crate:server

compliance

labels

2026-03-15 23:35:22 +03:00

kerem commented

2026-03-15 23:35:33 +03:00

Author

Owner

@bluejekyll commented on GitHub (Nov 4, 2020):

I'm going to create a new category for this... they're more about DNS compliance than bugs, so going to move them in that direction.

@bluejekyll commented on GitHub (Nov 4, 2020): I'm going to create a new category for this... they're more about DNS compliance than bugs, so going to move them in that direction.