[GH-ISSUE #2284] add DNSSEC validation to the recursive resolver tool #955

New issue

Open

opened 2026-03-16 01:04:53 +03:00 by kerem · 3 comments

kerem commented

2026-03-16 01:04:53 +03:00

Owner

Originally created by @yonas on GitHub (Jul 4, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2284

Is your feature request related to a problem? Please describe.
It would be great if the recursive resolver tool (not the server) supported DNSSEC.

Originally created by @yonas on GitHub (Jul 4, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2284 **Is your feature request related to a problem? Please describe.** It would be great if the recursive resolver tool (not the server) supported DNSSEC.

kerem added the

labels

2026-03-16 01:04:53 +03:00

kerem commented

2026-03-16 01:05:04 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 5, 2024):

This work is in progress. It's targeted for delivering by year end.

@bluejekyll commented on GitHub (Jul 5, 2024): This work is in progress. It's targeted for delivering by year end.

kerem commented

2026-03-16 01:05:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 5, 2024):

see: #1718

@bluejekyll commented on GitHub (Jul 5, 2024): see: #1718

kerem commented

2026-03-16 01:05:14 +03:00

Author

Owner

@japaric commented on GitHub (Jul 10, 2024):

@bluejekyll I think yonas is specifically referring to adding DNSSEC validation support to the recurse.

it would not be too hard to conditionally set the DNSSEC policy here (RecursorBuilder::dnssec_policy) and that should do the trick but I don't think this tool has much in the way of tests (+). OTOH, it's going to reuse the Recursor code which is being tested by the conformance test suite so maybe that's fine.

(+) in principle, it would be possible to set up a dns-test-based test and do some snapshot testing of the tool's output

@japaric commented on GitHub (Jul 10, 2024): @bluejekyll I think yonas is specifically referring to adding DNSSEC validation support to the [`recurse`](https://github.com/hickory-dns/hickory-dns/blob/dab09034dde8120e902b4786e4ff9024697736f1/util/src/bin/recurse.rs). it would not be too hard to conditionally set the DNSSEC policy [here](https://github.com/hickory-dns/hickory-dns/blob/dab09034dde8120e902b4786e4ff9024697736f1/util/src/bin/recurse.rs#L160) (`RecursorBuilder::dnssec_policy`) and that should do the trick but I don't think this tool has much in the way of tests (+). OTOH, it's going to reuse the `Recursor` code which is being tested by the conformance test suite so maybe that's fine. (+) in principle, it would be possible to set up a `dns-test`-based test and do some snapshot testing of the tool's output

kerem referenced this issue

2026-03-16 02:27:15 +03:00

[PR #955] [MERGED] Bump rusqlite from 0.20.0 to 0.21.0 #1818