[GH-ISSUE #2429] On 0.24.1, setting validate=true rejects domains that do not publish DNSSEC records #988

New issue

Closed

opened 2026-03-16 01:10:49 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 01:10:49 +03:00

Owner

Originally created by @msrd0 on GitHub (Sep 5, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2429

Describe the bug
I would expect that when I ask hickory-dns to validate DNSSEC, it only rejects those that failed validation (i.e. have bogus DNSSEC records), not also those that do not publish DNSSEC to begin with. For extremely paranoid ppl it might make sense to add an additional option, but I believe the default should be "check whenever possible".

To Reproduce
Start hickory-dns with the following config:

listen_port = 53
listen_addrs_ipv4 = ["127.0.0.1"]
listen_addrs_ipv6 = ["::1"]

[[zones]]
zone = "."
zone_type = "Forward"

[zones.stores]
type = "forward"

[zones.stores.options]
validate = true

[[zones.stores.name_servers]]
socket_addr = "1.1.1.1:853"
protocol = "tls"
tls_dns_name = "cloudflare-dns.com"
trust_nx_responses = false

[[zones.stores.name_servers]]
socket_addr = "1.0.0.1:853"
protocol = "tls"
tls_dns_name = "cloudflare-dns.com"
trust_nx_responses = false

Then, query any domain that does not publish DNSSEC records, e.g. github.com. Observe that no error indicator and no records are returned.

Expected behavior
I expect to receive the records of the domain I queried.

System:

OS: I use arch btw
Architecture: x86_64
Version: Linux 6.10.7-arch1-1
rustc version: 1.80.1 (376290515 2024-07-16)

Version:
Crate: hickory-dns binary
Version: 0.24.1

Originally created by @msrd0 on GitHub (Sep 5, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2429 **Describe the bug** I would expect that when I ask hickory-dns to validate DNSSEC, it only rejects those that failed validation (i.e. have bogus DNSSEC records), not also those that do not publish DNSSEC to begin with. For extremely paranoid ppl it might make sense to add an additional option, but I believe the default should be "check whenever possible". **To Reproduce** Start hickory-dns with the following config: ```toml listen_port = 53 listen_addrs_ipv4 = ["127.0.0.1"] listen_addrs_ipv6 = ["::1"] [[zones]] zone = "." zone_type = "Forward" [zones.stores] type = "forward" [zones.stores.options] validate = true [[zones.stores.name_servers]] socket_addr = "1.1.1.1:853" protocol = "tls" tls_dns_name = "cloudflare-dns.com" trust_nx_responses = false [[zones.stores.name_servers]] socket_addr = "1.0.0.1:853" protocol = "tls" tls_dns_name = "cloudflare-dns.com" trust_nx_responses = false ``` Then, query any domain that does not publish DNSSEC records, e.g. `github.com`. Observe that no error indicator and no records are returned. **Expected behavior** I expect to receive the records of the domain I queried. **System:** - OS: I use arch btw - Architecture: x86_64 - Version: Linux 6.10.7-arch1-1 - rustc version: 1.80.1 (376290515 2024-07-16) **Version:** Crate: hickory-dns binary Version: 0.24.1

kerem closed this issue

2026-03-16 01:10:54 +03:00

kerem commented

2026-03-16 01:11:00 +03:00

Author

Owner

@djc commented on GitHub (Sep 6, 2024):

I don't think there will be any more development of the 0.24.x range, so I suggest we focus discussion on #2428.

@djc commented on GitHub (Sep 6, 2024): I don't think there will be any more development of the 0.24.x range, so I suggest we focus discussion on #2428.

kerem commented

2026-03-16 01:11:05 +03:00

Author

Owner

@djc commented on GitHub (Sep 25, 2024):

Closing this for the stated reason.

@djc commented on GitHub (Sep 25, 2024): Closing this for the stated reason.

kerem referenced this issue

2026-03-16 02:29:11 +03:00

[PR #988] [MERGED] Remove failure dependency, only expose std::error impls #1845