Nameserver13 (nameserver13)

Status: Final

Purpose

  • Check truncated EDNS responses for missing OPT records.

Preconditions And Inputs

  • Preconditions:
    • A zone.Zone object is available.
  • Required inputs:
    • Nameserver addresses from methods.Method4and5.
    • DNSKEY responses to UDP EDNS query with DO=1 and EDNS size 512.
  • Profile/config knobs that affect behavior:
    • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
    • resolver.defaults.parallel: parallel nameserver query fanout.

Algorithm And Decision Flow

  1. Emit TEST_CASE_START.
  2. Read nameserver list from Method4and5.
  3. For each nameserver (parallelized, input-order merged logs):
    • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype DNSKEY, then skip.
    • Send DNSKEY query with options:
      • EDNS version 0
      • EDNS DO=true
      • EDNS size 512
      • UseVC=false
      • Fallback=false
    • If no response, emit NO_RESPONSE (ns, domain).
    • Else if RCODE=FORMERR and response has no EDNS OPT record, emit NO_EDNS_SUPPORT.
    • Else if response is truncated (TC=1) and has no EDNS OPT, emit MISSING_OPT_IN_TRUNCATED.
    • Else if response shape is (RCODE=NOERROR, EdnsVersion=0), emit no finding.
    • Else emit NS_ERROR.
  4. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

TagEmitted when
IPV4_DISABLEDIPv4 nameserver evaluation is skipped because IPv4 is disabled.
IPV6_DISABLEDIPv6 nameserver evaluation is skipped because IPv6 is disabled.
MISSING_OPT_IN_TRUNCATEDResponse was truncated but lacked EDNS OPT record.
NO_EDNS_SUPPORTResponse indicates FORMERR with no EDNS OPT record.
NO_RESPONSEQuery produced no DNS response.
NS_ERRORResponse did not fit expected success or explicit failure branches.
TEST_CASE_ENDTestcase completion marker is emitted.
TEST_CASE_STARTTestcase start marker is emitted.

Tag Arguments

TagArgument keyTypeMeaning
IPV4_DISABLEDnsstringNameserver identity (ns name only; use address for IP) skipped on IPv4.
IPV4_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV4_DISABLEDrrtypestringrrtype skipped (DNSKEY).
IPV6_DISABLEDnsstringNameserver identity (ns name only; use address for IP) skipped on IPv6.
IPV6_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV6_DISABLEDrrtypestringrrtype skipped (DNSKEY).
MISSING_OPT_IN_TRUNCATEDnsstringNameserver identity (ns name only; use address for IP) returning truncated response without OPT.
MISSING_OPT_IN_TRUNCATEDaddressstringNameserver IP address for the same endpoint.
NO_EDNS_SUPPORTnsstringNameserver identity (ns name only; use address for IP) treated as no-EDNS support path.
NO_EDNS_SUPPORTaddressstringNameserver IP address for the same endpoint.
NO_RESPONSEnsstringNameserver identity (ns name only; use address for IP) with no response.
NO_RESPONSEaddressstringNameserver IP address for the same endpoint.
NO_RESPONSEdomainstringTested zone name.
NS_ERRORnsstringNameserver identity (ns name only; use address for IP) with unexpected behavior.
NS_ERRORaddressstringNameserver IP address for the same endpoint.
TEST_CASE_ENDtestcasestringTestcase display name (Nameserver13).
TEST_CASE_STARTtestcasestringTestcase display name (Nameserver13).

Severity Levels Per Tag

TagLevelNotes
IPV4_DISABLEDDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
IPV6_DISABLEDDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
MISSING_OPT_IN_TRUNCATEDWARNINGDefault from share/profile.json (test_levels.NAMESERVER).
NO_EDNS_SUPPORTWARNINGDefault from share/profile.json (test_levels.NAMESERVER).
NO_RESPONSEDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
NS_ERRORWARNINGDefault from share/profile.json (test_levels.NAMESERVER).
TEST_CASE_ENDDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
TEST_CASE_STARTDEBUGDefault from share/profile.json (test_levels.NAMESERVER).

Differences From Upstream

  • Upstream reference: nameserver13.md
  • Differences (Upstream vs Gonemaster):
    • Upstream: iterates nameserver IP set. Gonemaster: iterates raw Method4and5 output (no testcase-local deduplication).
    • Upstream: does not explicitly describe testcase boundary and transport-disabled debug emissions. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
  • Resolved upstream issues:
    • Upstream engine bug (zonemaster#1468 ): upstream engine queried SOA instead of DNSKEY as specified. Gonemaster now queries DNSKEY matching the specification. Upstream has since fixed this in their engine.
    • Upstream engine bug: NO_EDNS_SUPPORT was emitted on any FORMERR; now requires FORMERR with no EDNS OPT record in the response (!HasEdns()).
    • Upstream engine bug: success branch checked edns_rcode == 0 in addition to NOERROR and EdnsVersion == 0; the edns_rcode check is now removed to match the specification.

Edge Cases And Limitations

  • Success branch does not explicitly require DNSKEY answer content.
  • MISSING_OPT_IN_TRUNCATED is checked before the generic success-shape branch.
  • Any behavior outside explicit branches collapses into NS_ERROR.