[GH-ISSUE #2285] DNSSEC validation fails for `NS nameservers.com.` in test environment #953

New issue

Closed

opened 2026-03-16 01:04:53 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:04:53 +03:00

Owner

Originally created by @japaric on GitHub (Jul 5, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2285

Originally assigned to: @japaric on GitHub.

Describe the bug
what the title says

To Reproduce

cd conformance && DNS_TEST_VERBOSE_DOCKER_BUILD=1 DNS_TEST_SUBJECT="hickory $(dirname $(pwd))" cargo r --example explore -- --dnssec
connect to the client (see command-line output from step 1) container and run dig @$RESOLVER_IPV4_ADDR NS nameservers.com. (get the ipv4 address from the output of step 1)

dig output: AD flag is not set

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

hickory-dns logs

1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:176:validating message_response: 0, with 2 trust_anchors
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:314:verifying: . record_type: DNSKEY, rrsigs: 1
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:412:validated dnskey with trust_anchor: ., 256 3 8 <base64-data>
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:412:validated dnskey with trust_anchor: ., 257 3 8 <base64-data>
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: . record_type: DNSKEY
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:757:validated (com., DS) with (., 256 3 8 <base64-data>)
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: com. record_type: DS
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:447:validated dnskey (com., 257 3 8 <base64-data>) with com. 61384 8 2 <hex-data>
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: com. record_type: DNSKEY
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:757:validated (nameservers.com., DS) with (com., 256 3 8 <base64-data>)
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: nameservers.com. record_type: DS
1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:328:failed to verify: nameservers.com. record_type: NS: ds record should exist: nameservers.com.

Expected behavior
hickory-dns should be able to DNSSEC validate the query. Under the same conditions, unbound is able to do so: run the explore example with DNS_TEST_SUBJECT=unbound

System:

OS: Ubuntu
Architecture: x86_64
Version 22.04
rustc version: 1.79

Version:
Crate: hickory-dns
Version: 352e167bb1

Additional context

Other queries like SOA . and SOA nameservers.com. validate correctly. AD is set in the response of the resolver.

Originally created by @japaric on GitHub (Jul 5, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2285 Originally assigned to: @japaric on GitHub. **Describe the bug** what the title says **To Reproduce** 1. `cd conformance && DNS_TEST_VERBOSE_DOCKER_BUILD=1 DNS_TEST_SUBJECT="hickory $(dirname $(pwd))" cargo r --example explore -- --dnssec` 2. connect to the `client` (see command-line output from step 1) container and run `dig @$RESOLVER_IPV4_ADDR NS nameservers.com.` (get the ipv4 address from the output of step 1) `dig` output: AD flag is not set ``` console ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ``` `hickory-dns` logs ``` console 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:176:validating message_response: 0, with 2 trust_anchors 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:314:verifying: . record_type: DNSKEY, rrsigs: 1 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:412:validated dnskey with trust_anchor: ., 256 3 8 <base64-data> 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:412:validated dnskey with trust_anchor: ., 257 3 8 <base64-data> 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: . record_type: DNSKEY 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:757:validated (com., DS) with (., 256 3 8 <base64-data>) 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: com. record_type: DS 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:447:validated dnskey (com., 257 3 8 <base64-data>) with com. 61384 8 2 <hex-data> 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: com. record_type: DNSKEY 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:757:validated (nameservers.com., DS) with (com., 256 3 8 <base64-data>) 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:324:verified: nameservers.com. record_type: DS 1720186117:DEBUG:hickory_proto::xfer::dnssec_dns_handle:328:failed to verify: nameservers.com. record_type: NS: ds record should exist: nameservers.com. ``` **Expected behavior** `hickory-dns` should be able to DNSSEC validate the query. Under the same conditions, `unbound` is able to do so: run the `explore` example with `DNS_TEST_SUBJECT=unbound` **System:** - OS: Ubuntu - Architecture: x86_64 - Version 22.04 - rustc version: 1.79 **Version:** Crate: `hickory-dns` Version: 352e167bb14e03832662e82212a8595cf1e1a6b9 **Additional context** Other queries like `SOA .` and `SOA nameservers.com.` validate correctly. AD is set in the response of the resolver.

kerem

2026-03-16 01:04:53 +03:00

closed this issue
added the
bug

feature:dnsssec
labels

kerem commented

2026-03-16 01:05:09 +03:00

Author

Owner

@japaric commented on GitHub (Jul 5, 2024):

failed to verify: nameservers.com. record_type: NS: ds record should exist: nameservers.com.

interesting that it reports that it cannot find the DS record because this query works and even has the AD bit set

$ dig DS nameservers.com.
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; ANSWER SECTION:
nameservers.com.	85391	IN	DS	15485 8 2 624955629EEC967972B855818E6B21A76382B0A5AAF70DA00E2AC51D 732F07CF

and after that query gets cached, the original query gets DNSSEC validated (AD bit set):

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; ANSWER SECTION:
nameservers.com.	85934	IN	NS	primary1.nameservers.com.

@japaric commented on GitHub (Jul 5, 2024): > failed to verify: nameservers.com. record_type: NS: ds record should exist: nameservers.com. interesting that it reports that it cannot find the DS record because this query works and even has the AD bit set ``` console $ dig DS nameservers.com. ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; ANSWER SECTION: nameservers.com. 85391 IN DS 15485 8 2 624955629EEC967972B855818E6B21A76382B0A5AAF70DA00E2AC51D 732F07CF ``` and after that query gets cached, the original query gets DNSSEC validated (AD bit set): ``` console ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; ANSWER SECTION: nameservers.com. 85934 IN NS primary1.nameservers.com. ```

kerem referenced this issue

2026-03-16 02:27:15 +03:00

[PR #953] [MERGED] test some caching strategies in github workflows #1819