Recursor return errror on an empty AAAA response, it is the correct behaviour ? #14763

soulbreak · 2024-10-10T05:43:40Z

soulbreak
Oct 10, 2024

Hello community,

I’m opening this thread because I couldn’t find a clear answer to my question. I’m quite sure it’s a bug, and my issue seems very similar to a past discussion here: #1344.

My test: A direct AAAA DNS query to a customer DNS returns an empty non-authoritative but valid AAAA response.
However, when the same AAAA query is made through the recursor, the response is changed into an error.
Further tests show that BIND does not change the response into an error.

Quick fix: I wrote a small Lua script to modify the recursor’s behavior and change the return code.
Long-term solution: Is this a bug in the recursor, or is there an RFC that proves the recursor is behaving correctly and BIND is not? I would like to understand where the correct behavior is clearly defined. In the old discussion, the developer seems to suggest that nothing can be done, but I don’t understand why.

Thank you very much for your help.

Habbie · 2024-10-10T08:23:29Z

Habbie
Oct 10, 2024
Maintainer

empty non-authoritative but valid AAAA response.

empty non-authoritative does not sound valid to me. Can you show us some unmodified dig output please?

5 replies

soulbreak Oct 10, 2024
Author

Unfortunately unmodified output is not possible as it contains private data.

I just did a simple substitution, the behaviour is still understable I think:

domain.org -> the zone asked
powerdns_ip -> the local recursor
remote_ip -> the remote dns

Direct dns query to the remote dns serveur returns no error with empty AAAA:

 dig    -b <powerdns_ip> @<remote_ip> domain.org AAAA

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> -b <powerdns_ip> @remote_dns domain.org AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: **NOERROR**, id: 49549
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;domain.org. IN AAAA

;; AUTHORITY SECTION:
test.domain.org 883 IN SOA test.domain.org. hostmaster.test.domain.org. 2024013102 10800 3600 604800 900

;; Query time: 12 msec
;; SERVER: remote_dns#53(remote_dns) (UDP)
;; WHEN: Thu Oct 10 13:14:08 CEST 2024
;; MSG SIZE  rcvd: 147

Same query through the recursor, change the rcode:

dig    @<powerdns_ip> domain.org AAAA

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> @<powerdns_ip> domain.org AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: **SERVFAIL**, id: 61331
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;domain.org. IN AAAA

;; Query time: 44 msec
;; SERVER: <powerdns_ip>#53(<powerdns_ip>) (UDP)
;; WHEN: Thu Oct 10 13:14:35 CEST 2024
;; MSG SIZE  rcvd: 71

Habbie Oct 10, 2024
Maintainer

Unfortunately unmodified output is not possible as it contains private data.

#13200

Habbie Oct 10, 2024
Maintainer

Same query through the recursor, change the rcode:

It's not really changing it. It's telling you SERVFAIL because it could not find a valid answer.

soulbreak Oct 10, 2024
Author

The content is unchanged but the rcode is changed.
Probably it should not be changed in this particular case with an empty AAAA record.

As bind differ on this particular point, I'm also trying to find where the expected behaviour is described (I did not find in a RFC).

I also find this related thread ; it seems that's other users are doing lua workaround with this unexpected behaviour : https://pdns-users.mailman.powerdns.narkive.com/v4DpGEBl/pdns-recursor-3-7-4-on-redhat-linux-always-returns-servfail-for-aaaa-lookups

rgacogne Oct 10, 2024
Maintainer

If we cannot test the behaviour ourselves because the related zones are not public, you will have to get us a lot more information, otherwise there is simply nothing we can do. Would you be able to run the recursor with the trace setting enabled (https://docs.powerdns.com/recursor/settings.html#trace), run your queries then share the content of the recursor's logs?

soulbreak · 2024-10-10T13:03:52Z

soulbreak
Oct 10, 2024
Author

Yes I know it is not easy to solve without a public example. I will check if I find one, it should exist.
Here is the anynomized trace. At the end we see Failed to resolve via any of the 2 offered NS at level 'sub2.sub1.domain.org', the problem should be in the logic to consider a record as resolved.

Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: msg="Question" subsystem="syncres" level="0" prio="Info" tid="3" ts="1728564320.918" ecs="" mtid="32" proto="udp" qname="sub5.sub4.sub3.sub2.sub1.domain.org" qtype="AAAA" remote="1.2.3.4:60168"
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'sub5.sub4.sub3.sub2.sub1.domain.org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'sub4.sub3.sub2.sub1.domain.org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'sub3.sub2.sub1.domain.org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'sub2.sub1.domain.org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'sub1.domain.org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'domain.org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : no TA found for 'org' among 1
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] : got TA for '.'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Wants NO DNSSEC processing, auth data in query for AAAA
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: No cache hit for 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA', trying to find an appropriate NS record
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'sub5.sub4.sub3.sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'sub5.sub4.sub3.sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'sub4.sub3.sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'sub4.sub3.sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'sub3.sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'sub3.sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for 'org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: no valid/useful NS in cache for 'org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Checking if we have NS in cache for '.'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: NS (with ip, or non-glue) in cache for '.' -> 'external.nameserver.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: within bailiwick: 1,  in cache, ttl=86398
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: We have NS in cache for '.' (flawedNSSet=0)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Cache consultations done, have 1 NS to contact
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org.: Nameservers: external.nameserver.org(7.72ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying to resolve NS 'external.nameserver.org' (1/1)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Nameserver external.nameserver.org IPs: 5.5.5.5(7.72ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Resolved '.' NS external.nameserver.org to: 5.5.5.5
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 5.5.5.5:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 7 answers from external.nameserver.org (5.5.5.5), rcode=0 (No Error), aa=0, in 7ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub2.sub1.domain.org|NS|sub01.sub3.sub2.sub1.domain.org.' from '.' nameservers? ttl=3600, place=2 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub2.sub1.domain.org|NS|sub02.sub3.sub2.sub1.domain.org.' from '.' nameservers? ttl=3600, place=2 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub01.sub3.sub2.sub1.domain.org|A|6.5.4.3' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub01.sub3.sub2.sub1.domain.org|A|8.7.6.5' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub02.sub3.sub2.sub1.domain.org|A|1.2.3.6' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub02.sub3.sub2.sub1.domain.org|A|1.2.3.5' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from '.' nameservers
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: determining status after receiving this packet
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: got NS record 'sub2.sub1.domain.org' -> 'sub01.sub3.sub2.sub1.domain.org.'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: got NS record 'sub2.sub1.domain.org' -> 'sub02.sub3.sub2.sub1.domain.org.'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: status=did not resolve, got 2 NS, looping to them
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org.: Nameservers: sub02.sub3.sub2.sub1.domain.org(0.00ms), sub01.sub3.sub2.sub1.domain.org(0.00ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying to resolve NS 'sub02.sub3.sub2.sub1.domain.org' (1/2)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Nameserver sub02.sub3.sub2.sub1.domain.org IPs: 1.2.3.5(0.00ms), 1.2.3.6(0.00ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Resolved 'sub2.sub1.domain.org' NS sub02.sub3.sub2.sub1.domain.org to: 1.2.3.5, 1.2.3.6
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 1.2.3.5:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 2 answers from sub02.sub3.sub2.sub1.domain.org (1.2.3.5), rcode=0 (No Error), aa=0, in 11ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Removing irrelevant record 'sub4.sub3.sub2.sub1.domain.org|SOA|anonym.sub8.sub1.gprs. hostmaster.anonym.sub8.sub1.gprs. 2024013102 10800 3600 604800 900' in the AUTHORITY section received from sub2.sub1.domain.org
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from 'sub2.sub1.domain.org' nameservers
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: determining status after receiving this packet
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 1.2.3.6:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 2 answers from sub02.sub3.sub2.sub1.domain.org (1.2.3.6), rcode=0 (No Error), aa=0, in 11ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Removing irrelevant record 'sub4.sub3.sub2.sub1.domain.org|SOA|anonym.sub8.sub1.gprs. hostmaster.anonym.sub8.sub1.gprs. 2024013102 10800 3600 604800 900' in the AUTHORITY section received from sub2.sub1.domain.org
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from 'sub2.sub1.domain.org' nameservers
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: determining status after receiving this packet
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying to resolve NS 'sub01.sub3.sub2.sub1.domain.org' (2/2)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Nameserver sub01.sub3.sub2.sub1.domain.org IPs: 6.5.4.3(0.00ms), 8.7.6.5(0.00ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Resolved 'sub2.sub1.domain.org' NS sub01.sub3.sub2.sub1.domain.org to: 6.5.4.3, 8.7.6.5
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 6.5.4.3:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 2 answers from sub01.sub3.sub2.sub1.domain.org (6.5.4.3), rcode=0 (No Error), aa=0, in 11ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Removing irrelevant record 'sub4.sub3.sub2.sub1.domain.org|SOA|anonym.sub8.sub1.gprs. hostmaster.anonym.sub8.sub1.gprs. 2024013102 10800 3600 604800 900' in the AUTHORITY section received from sub2.sub1.domain.org
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from 'sub2.sub1.domain.org' nameservers
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: determining status after receiving this packet
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 8.7.6.5:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 2 answers from sub01.sub3.sub2.sub1.domain.org (8.7.6.5), rcode=0 (No Error), aa=0, in 11ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Removing irrelevant record 'sub4.sub3.sub2.sub1.domain.org|SOA|anonym.sub8.sub1.gprs. hostmaster.anonym.sub8.sub1.gprs. 2024013102 10800 3600 604800 900' in the AUTHORITY section received from sub2.sub1.domain.org
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from 'sub2.sub1.domain.org' nameservers
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: determining status after receiving this packet
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Failed to resolve via any of the 2 offered NS at level 'sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Failure, but we have a saved parent NS set, trying that one
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Cache consultations done, have 3 NS to contact
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org.: Nameservers: a.root-servers.net(0.00ms), c.root-servers.net(6.22ms), b.root-servers.net(13.64ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Resolved '.' NS a.root-servers.net to: 9.8.7.6
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 9.8.7.6:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 7 answers from a.root-servers.net (9.8.7.6), rcode=0 (No Error), aa=0, in 15ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub2.sub1.domain.org|NS|sub01.sub3.sub2.sub1.domain.org.' from '.' nameservers? ttl=3600, place=2 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub2.sub1.domain.org|NS|sub02.sub3.sub2.sub1.domain.org.' from '.' nameservers? ttl=3600, place=2 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub01.sub3.sub2.sub1.domain.org|A|6.5.4.3' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub01.sub3.sub2.sub1.domain.org|A|8.7.6.5' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub02.sub3.sub2.sub1.domain.org|A|1.2.3.5' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: accept answer 'sub02.sub3.sub2.sub1.domain.org|A|1.2.3.6' from '.' nameservers? ttl=3600, place=3 YES!
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from '.' nameservers
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: determining status after receiving this packet
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: got NS record 'sub2.sub1.domain.org' -> 'sub01.sub3.sub2.sub1.domain.org.'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: got NS record 'sub2.sub1.domain.org' -> 'sub02.sub3.sub2.sub1.domain.org.'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: status=did not resolve, got 2 NS, looping to them
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org.: Nameservers: sub02.sub3.sub2.sub1.domain.org(11.57ms), sub01.sub3.sub2.sub1.domain.org(11.90ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying to resolve NS 'sub02.sub3.sub2.sub1.domain.org' (1/2)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Nameserver sub02.sub3.sub2.sub1.domain.org IPs: 1.2.3.5(11.57ms), 1.2.3.6(11.58ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Resolved 'sub2.sub1.domain.org' NS sub02.sub3.sub2.sub1.domain.org to: 1.2.3.5, 1.2.3.6
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 1.2.3.5:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: query throttled 1.2.3.5, sub5.sub4.sub3.sub2.sub1.domain.org; AAAA
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 1.2.3.6:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: query throttled 1.2.3.6, sub5.sub4.sub3.sub2.sub1.domain.org; AAAA
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying to resolve NS 'sub01.sub3.sub2.sub1.domain.org' (2/2)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Nameserver sub01.sub3.sub2.sub1.domain.org IPs: 6.5.4.3(11.90ms), 8.7.6.5(11.92ms)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Resolved 'sub2.sub1.domain.org' NS sub01.sub3.sub2.sub1.domain.org to: 6.5.4.3, 8.7.6.5
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 6.5.4.3:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: query throttled 6.5.4.3, sub5.sub4.sub3.sub2.sub1.domain.org; AAAA
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 8.7.6.5:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: query throttled 8.7.6.5, sub5.sub4.sub3.sub2.sub1.domain.org; AAAA
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Failed to resolve via any of the 2 offered NS at level 'sub2.sub1.domain.org'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: failed (res=-1)
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: msg="Answer" subsystem="syncres" level="0" prio="Info" tid="3" ts="1728564320.990" additional="1" answers="0" dotout="0" ecs="" mtid="32" netms="70.867000" outqueries="6" proto="udp" qname="sub5.sub4.sub3.sub2.sub1.domain.org" qtype="AAAA" rcode="2" rd="1" remote="1.2.3.4:60168" tcpout="0" throttled="4" timeouts="0" totms="71.213000" validationState="Indeterminate"

5 replies

rgacogne Oct 10, 2024
Maintainer

Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Trying IP 8.7.6.5:53, asking 'sub5.sub4.sub3.sub2.sub1.domain.org|AAAA'
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: Got 2 answers from sub01.sub3.sub2.sub1.domain.org (8.7.6.5), rcode=0 (No Error), aa=0, in 11ms
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] Removing irrelevant record 'sub4.sub3.sub2.sub1.domain.org|SOA|anonym.sub8.sub1.gprs. hostmaster.anonym.sub8.sub1.gprs. 2024013102 10800 3600 604800 900' in the AUTHORITY section received from sub2.sub1.domain.org
Oct 10 14:45:20 powerdns-recursor pdns-recursor[3202052]: [32] sub5.sub4.sub3.sub2.sub1.domain.org: OPT answer '.' from 'sub2.sub1.domain.org' nameservers

So the authoritative server at 8.7.6.5:53 replies with a NODATA answer, but without the AA bit set? I'm afraid this is indeed not a valid response, either the server is authoritative and AA should be set, or it's not and we should get a referral.

soulbreak Oct 10, 2024
Author

First, thank you very much for reviewing my trace. I'm confident it will also help other users.

From your response, I understand that the recursor follows this matrix behavior:

AA=1 with data => valid
AA=1 without data => valid
AA=0 with data => valid
AA=0 without data => invalid
So, do you believe this is intentional and not a side effect? Should AAAA have an exceptional or different behavior in this case? Does this suggest that the bind is too permissive in this scenario?

rgacogne Oct 10, 2024
Maintainer

AA=1 with data => valid
AA=1 without data => valid
AA=0 with data => valid

AA=0 with data is invalid as well, unless the data is a referral.

AA=0 without data => invalid

So, do you believe this is intentional and not a side effect?

Yes, this is intentional.

Should AAAA have an exceptional or different behavior in this case?

The requested type does not matter, the response from a server authoritative for the zone should have AA=1.

Does this suggest that the bind is too permissive in this scenario?

If Bind is happy to accept a response with AA=0 then yes, I believe this is too permissive. My guess is that they allow it to deal with broken authoritative servers that exist in the wild, but in my opinion this mostly makes debugging these issues painful because they work with some servers and not with others.

soulbreak Oct 10, 2024
Author

Ok, I understand the point about Bind.

The root servers point to this server, so it acts as a referral in my case.
Does this mean that the empty response takes precedence over the fact that it is a referral ?

rgacogne Oct 11, 2024
Maintainer

Does this mean that the empty response takes precedence over the fact that it is a referral ?

No, a referral is:

rcode is "No Error"
AA is 0
the answer section is empty
there are NS records in the authority section pointing to other, more specific, authoritative nameservers handling a zone the initially requested name is part of

soulbreak · 2024-10-14T06:09:13Z

soulbreak
Oct 14, 2024
Author

Ok I think I better understand now.

Thank you for your response and time.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Recursor return errror on an empty AAAA response, it is the correct behaviour ? #14763

{{title}}

Replies: 3 comments 10 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Recursor return errror on an empty AAAA response, it is the correct behaviour ? #14763

soulbreak Oct 10, 2024

Replies: 3 comments · 10 replies

Habbie Oct 10, 2024 Maintainer

soulbreak Oct 10, 2024 Author

Habbie Oct 10, 2024 Maintainer

Habbie Oct 10, 2024 Maintainer

soulbreak Oct 10, 2024 Author

rgacogne Oct 10, 2024 Maintainer

soulbreak Oct 10, 2024 Author

rgacogne Oct 10, 2024 Maintainer

soulbreak Oct 10, 2024 Author

rgacogne Oct 10, 2024 Maintainer

soulbreak Oct 10, 2024 Author

rgacogne Oct 11, 2024 Maintainer

soulbreak Oct 14, 2024 Author

soulbreak
Oct 10, 2024

Replies: 3 comments 10 replies

Habbie
Oct 10, 2024
Maintainer

soulbreak Oct 10, 2024
Author

Habbie Oct 10, 2024
Maintainer

Habbie Oct 10, 2024
Maintainer

soulbreak Oct 10, 2024
Author

rgacogne Oct 10, 2024
Maintainer

soulbreak
Oct 10, 2024
Author

rgacogne Oct 10, 2024
Maintainer

soulbreak Oct 10, 2024
Author

rgacogne Oct 10, 2024
Maintainer

soulbreak Oct 10, 2024
Author

rgacogne Oct 11, 2024
Maintainer

soulbreak
Oct 14, 2024
Author