[GH-ISSUE #2288] `dig DS .` / `dig A .` return zero records instead of some authority records #954

New issue

Open

opened 2026-03-16 01:04:53 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:04:53 +03:00

Owner

Originally created by @japaric on GitHub (Jul 8, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2288

Describe the bug
what the title says

To Reproduce

cd conformance && DNS_TEST_SUBJECT="hickory $(dirname $(pwd))" cargo r --example explore
in the client container run:

NOTE: DNSSEC validation is disabled so there's no DS . record in the zone files.

$ dig @RESOLVER_IP_ADDR DS .
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48960
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

$ dig @RESOLVER_IP_ADDR A .
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62523
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

Expected behavior
Under the same conditions (i.e. same setup for the test environment), both BIND and unbound return a SOA record that matches the queried domain name

$ dig DS .
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24233
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; AUTHORITY SECTION:
.			10800	IN	SOA	primary3.nameservers.com. admin3.nameservers.com. 2024010101 1800 900 604800 86400

$ dig A .
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31444
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; AUTHORITY SECTION:
.			10800	IN	SOA	primary3.nameservers.com. admin3.nameservers.com. 2024010101 1800 900 604800 86400

Outside the test environment and in the real world, the cloudflare server also responds to the A . query with a SOA record

$ dig @1.1.1.1 A .
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61685
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; AUTHORITY SECTION:
.			86221	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2024070800 1800 900 604800 86400

System:

OS: Ubuntu
Architecture: x86_64
Version 22.04
rustc version: 1.79

Version:
Crate: hickory-dns
Version: 9fcf88c2b6

Additional context

I'm not familiar with the DNS specification but I think the divergence from the behavior of other DNS implementations warrants further investigation.

Originally created by @japaric on GitHub (Jul 8, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2288 **Describe the bug** what the title says **To Reproduce** 1. `cd conformance && DNS_TEST_SUBJECT="hickory $(dirname $(pwd))" cargo r --example explore` 2. in the client container run: NOTE: DNSSEC validation is *dis*abled so there's no `DS .` record in the zone files. ``` console $ dig @RESOLVER_IP_ADDR DS . ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48960 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 $ dig @RESOLVER_IP_ADDR A . ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62523 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ``` **Expected behavior** Under the same conditions (i.e. same setup for the test environment), both BIND and `unbound` return a `SOA` record that matches the queried domain name ``` console $ dig DS . ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24233 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; AUTHORITY SECTION: . 10800 IN SOA primary3.nameservers.com. admin3.nameservers.com. 2024010101 1800 900 604800 86400 $ dig A . ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31444 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; AUTHORITY SECTION: . 10800 IN SOA primary3.nameservers.com. admin3.nameservers.com. 2024010101 1800 900 604800 86400 ``` Outside the test environment and in the real world, the cloudflare server also responds to the `A .` query with a SOA record ``` console $ dig @1.1.1.1 A . ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61685 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; AUTHORITY SECTION: . 86221 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2024070800 1800 900 604800 86400 ``` **System:** - OS: Ubuntu - Architecture: x86_64 - Version 22.04 - rustc version: 1.79 **Version:** Crate: `hickory-dns` Version: 9fcf88c2b68b13c77f15b7abfe1f95df93d5db60 **Additional context** I'm not familiar with the DNS specification but I think the divergence from the behavior of other DNS implementations warrants further investigation.