Nameserver02

Status: Final

Purpose

• Validate EDNS(0) handling on authoritative nameservers.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Nameserver addresses from ZoneNameservers .
  • SOA responses to queries with and without EDNS.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel nameserver query fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Read nameserver list from ZoneNameservers , deduplicate by name/ip, preserving first-seen order.
3. For each deduplicated nameserver (parallelized, input-order merged logs):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype SOA, mark not included in summary, and skip.
   • Mark nameserver as included in summary.
   • Send SOA query with EDNS version 0.
   • If response exists:
     • If RCODE=FORMERR and response has no OPT, emit NO_EDNS_SUPPORT.
     • Else if RCODE=NOERROR, EdnsRcode=0, answer contains SOA, and EdnsVersion=0, treat as compliant and emit no per-server error tag.
     • Else if RCODE=NOERROR and response has no OPT, emit EDNS_RESPONSE_WITHOUT_EDNS.
     • Else if RCODE=NOERROR, response has OPT, and EdnsVersion!=0, emit EDNS_VERSION_ERROR.
     • Else emit NS_ERROR.
   • If response is missing or query failed:
     • Send fallback SOA query without EDNS.
     • If fallback responds, emit BREAKS_ON_EDNS.
     • Else emit NO_RESPONSE and mark the nameserver not included in summary.
4. Count included nameservers and included nameservers with errors.
5. If at least one nameserver was included and none had errors, emit EDNS0_SUPPORT with sorted included name/ip list.
6. Emit TEST_CASE_END.

Per-NS EDNS Probe and Aggregation (steps 2-6)

ns list = ZoneNameservers; dedupe by ns.String() ("name/ip"), preserve first-seen order

For each nameserver (parallel; fan-out = resolver.defaults.parallel):

   transport disabled for SOA -> IPV4_DISABLED / IPV6_DISABLED;
                                 not included in summary; skip
   mark included

   query SOA at z.Name with EDNS version 0
    +- resp present:
       RCODE == FORMERR AND no OPT
                                  -> NO_EDNS_SUPPORT (ns) (one error)
       RCODE == NOERROR AND EdnsRcode == 0 AND SOA in answer AND EdnsVersion == 0
                                  -> compliant (no error)
       RCODE == NOERROR AND no OPT
                                  -> EDNS_RESPONSE_WITHOUT_EDNS (ns, domain)
       RCODE == NOERROR AND has OPT AND EdnsVersion != 0
                                  -> EDNS_VERSION_ERROR (ns, domain)
       otherwise                  -> NS_ERROR (ns)
    +- resp missing / query error:
       fallback query SOA without EDNS
         response present         -> BREAKS_ON_EDNS (ns, domain)
         no response              -> NO_RESPONSE (ns, domain); not included

After all tasks:
  included > 0 AND no included ns had any error tag
     -> EDNS0_SUPPORT (servers = sorted included)

emit TEST_CASE_END

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Differences (Upstream vs Gonemaster):
  • Upstream: outcome table focuses on per-server error findings. Gonemaster: emits additional summary tag EDNS0_SUPPORT when all included nameservers pass; a nameserver without any response is not included.
  • Upstream: describes iterating the nameserver IP set. Gonemaster: deduplicates nameservers by name/ip before evaluation.
  • Upstream: does not explicitly describe testcase boundary and transport-disabled debug emissions. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
• Potential upstream report:
  • no

Edge Cases And Limitations

• A nameserver emits at most one per-server error tag in this testcase due early-return branch logic.
• EDNS0_SUPPORT is not emitted if every nameserver is skipped for a disabled transport or returns no response.
• The testcase relies on generic query defaults for EDNS payload size and DO bit when those fields are not explicitly set in testcase logic.