[GH-ISSUE #2395] dnssec: hickory responds with SERVFAIL when dealing with Insecure zones #978

New issue

Closed

opened 2026-03-16 01:09:15 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:09:15 +03:00

Owner

Originally created by @japaric on GitHub (Aug 30, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2395

Describe the bug
What the title says.

To Reproduce
Send the query A unsigned.extended-dns-errors.com. to hickory. Hickory responds with SERVFAIL.

Expected behavior
The answer should be status=NOERROR with the AD flag not set.

System:

OS: Ubuntu
Architecture: x86_64
Version 22.04
rustc version: 1.80.1

Version:
Crate: hickory-dns
Version: d80c172061

Additional context
This should be relatively easy to fix on the server side of things. This check needs to consider a third Insecure scenario. However, before doing that more bugs in the DNSSEC validation code need to be ironed out

Originally created by @japaric on GitHub (Aug 30, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2395 **Describe the bug** What the title says. **To Reproduce** Send the query `A unsigned.extended-dns-errors.com.` to hickory. Hickory responds with SERVFAIL. **Expected behavior** The answer should be status=NOERROR with the AD flag *not* set. **System:** - OS: Ubuntu - Architecture: x86_64 - Version 22.04 - rustc version: 1.80.1 **Version:** Crate: `hickory-dns` Version: d80c1720618b309830b3de894f84de97c2672a02 **Additional context** This should be relatively easy to fix on the server side of things. [This check](https://github.com/hickory-dns/hickory-dns/blob/77bd54e2ca98973b40210f20772d5f7f2de18143/crates/server/src/authority/catalog.rs#L758) needs to consider a third Insecure scenario. However, before doing that more bugs in the DNSSEC validation code need to be ironed out