[GH-ISSUE #2301] implement RFC 8914 (Extended DNS errors) #963

New issue

Open

opened 2026-03-16 01:06:13 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:06:13 +03:00

Owner

Originally created by @japaric on GitHub (Jul 10, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2301

Is your feature request related to a problem? Please describe.
Currently all queries that fail DNSSEC validation get a generic status=SERVFAIL response which includes no information about why the query could not be validated.

Describe the solution you'd like
Implement RFC8914.

RFC 8914 extends the resolver logic to include an error code (in the OPT record / section) when DNSSEC validation fails. this is meant to help the client identify / debug the issue that prevents DNSSEC validation from being successfully completed, e.g. the problem could be due to a wrongly configured (record in a) name server.

Describe alternatives you've considered
None. This is the IETF (proposed) standard that addresses this diagnostics issue. Other DNS implementations, namely unbound, already implement this feature.

Additional context
The conformance test suite already includes tests for this feature.

Originally created by @japaric on GitHub (Jul 10, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2301 **Is your feature request related to a problem? Please describe.** Currently all queries that fail DNSSEC validation get a generic status=SERVFAIL response which includes no information about why the query could not be validated. **Describe the solution you'd like** Implement [RFC8914](https://datatracker.ietf.org/doc/rfc8914/). RFC 8914 extends the resolver logic to include an error code (in the OPT record / section) when DNSSEC validation fails. this is meant to help the client identify / debug the issue that prevents DNSSEC validation from being successfully completed, e.g. the problem could be due to a wrongly configured (record in a) name server. **Describe alternatives you've considered** None. This is the IETF (proposed) standard that addresses this diagnostics issue. Other DNS implementations, namely [`unbound`](https://blog.nlnetlabs.nl/extended-dns-error-support-for-unbound/), already implement this feature. **Additional context** [The conformance test suite already includes tests for this feature.](https://github.com/hickory-dns/hickory-dns/blob/dab09034dde8120e902b4786e4ff9024697736f1/conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/ede.rs)