[GH-ISSUE #2095] Querying a non-existant record doesn't return NoRecordsFound with DNSSEC validation turned on. #883

New issue

Closed

opened 2026-03-16 00:44:46 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 00:44:46 +03:00

Owner

Originally created by @teythoon on GitHub (Nov 22, 2023).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2095

Describe the bug

Querying a non-existant domain returns NoRecordsFound, but when I turn on DNSSEC validation, a different, free-form protocol error is returned. It'd be nice to return NoRecordsFound so that we can robustly match on that.

To Reproduce
Steps to reproduce the behavior:

Lookup a domain that doesn't exist with DNSSEC validation turned on:

[net/src/dane.rs:77] resolver.lookup(fqdn, RecordType::OPENPGPKEY).await = Err(
    ResolveError {
        kind: Proto(
            ProtoError {
                kind: Message(
                    "no results to verify",
                ),
            },
        ),
    },
)

Expected behavior

In contrast, when I disable DNSSEC validation and do the same query, I get:

[net/src/dane.rs:77] resolver.lookup(fqdn, RecordType::OPENPGPKEY).await = Err(
    ResolveError {
        kind: NoRecordsFound {
            query: Query {
                name: Name("676a989abb4d264309c15467c3c796116911b9b4d69362025f9a603a._openpgpkey.i-dont-exist.awk."),
                query_type: OPENPGPKEY,
                query_class: IN,
            },
            soa: Some(
                Record {
                    name_labels: Name("."),
                    rr_type: SOA,
                    dns_class: IN,
                    ttl: 86380,
                    rdata: Some(
                        SOA {
                            mname: Name("a.root-servers.net."),
                            rname: Name("nstld.verisign-grs.com."),
                            serial: 2023112200,
                            refresh: 1800,
                            retry: 900,
                            expire: 604800,
                            minimum: 86400,
                        },
                    ),
                },
            ),
            negative_ttl: Some(
                86380,
            ),
            response_code: NXDomain,
            trusted: true,
        },
    },
)

A clear and concise description of what you expected to happen.

System:

OS: Debian Linux
Architecture: x86_64
Version 12
rustc version: 1.70

Version:
Crate: hickory-{client,server,resolver}
Version: 0.24.0

Originally created by @teythoon on GitHub (Nov 22, 2023). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2095 **Describe the bug** Querying a non-existant domain returns NoRecordsFound, but when I turn on DNSSEC validation, a different, free-form protocol error is returned. It'd be nice to return NoRecordsFound so that we can robustly match on that. **To Reproduce** Steps to reproduce the behavior: 1. Lookup a domain that doesn't exist with DNSSEC validation turned on: ``` [net/src/dane.rs:77] resolver.lookup(fqdn, RecordType::OPENPGPKEY).await = Err( ResolveError { kind: Proto( ProtoError { kind: Message( "no results to verify", ), }, ), }, ) ``` **Expected behavior** In contrast, when I disable DNSSEC validation and do the same query, I get: ``` [net/src/dane.rs:77] resolver.lookup(fqdn, RecordType::OPENPGPKEY).await = Err( ResolveError { kind: NoRecordsFound { query: Query { name: Name("676a989abb4d264309c15467c3c796116911b9b4d69362025f9a603a._openpgpkey.i-dont-exist.awk."), query_type: OPENPGPKEY, query_class: IN, }, soa: Some( Record { name_labels: Name("."), rr_type: SOA, dns_class: IN, ttl: 86380, rdata: Some( SOA { mname: Name("a.root-servers.net."), rname: Name("nstld.verisign-grs.com."), serial: 2023112200, refresh: 1800, retry: 900, expire: 604800, minimum: 86400, }, ), }, ), negative_ttl: Some( 86380, ), response_code: NXDomain, trusted: true, }, }, ) ``` A clear and concise description of what you expected to happen. **System:** - OS: Debian Linux - Architecture: x86_64 - Version 12 - rustc version: 1.70 **Version:** Crate: hickory-{client,server,resolver} Version: 0.24.0

kerem

2026-03-16 00:44:46 +03:00

closed this issue
added the
crate:resolver

feature:dnsssec
labels

kerem commented

2026-03-16 00:45:01 +03:00

Author

Owner

@bluejekyll commented on GitHub (Nov 26, 2023):

I'm doing a fairly big change to how DNSSEC is evaluated in this PR: #2084, which I think should resolve this issue, if I understand it correctly. Rather than returning an error, we're going to return records in all cases and associate a proof with the value.

@bluejekyll commented on GitHub (Nov 26, 2023): I'm doing a fairly big change to how DNSSEC is evaluated in this PR: #2084, which I think should resolve this issue, if I understand it correctly. Rather than returning an error, we're going to return records in all cases and associate a proof with the value.

kerem referenced this issue

2026-03-16 02:24:23 +03:00

[PR #883] [MERGED] Allow parsing DNSSEC record types #1769