Nameserver18

Status: Final

Purpose

• Query each authoritative nameserver for the zone and report any EDNS Extended DNS Error (RFC 8914, option code 15) option found in the response, classified by what the observed info-code implies about a directly-queried authoritative server.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Nameserver addresses from ZoneNameservers .
  • SOA responses to a plain (DO=0) apex query; any EDE option present is read off the response.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel nameserver query fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Initialize collectors:
   • observed EDE findings keyed by (info_code, sanitized extra_text)
   • clean nameserver set (NOERROR carrying no EDE)
   • no-response nameserver set
3. Read nameserver list from ZoneNameservers .
4. For each nameserver (parallelized, input-order merged logs):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype SOA, then skip.
   • Send a plain SOA query (DO=0) for the zone name. The DO=0 probe deduplicates against SOA queries other testcases already issue, so it adds no extra traffic.
   • If no response, collect nameserver for N18_NO_RESPONSE.
   • Else collect every EDE option present (a response MAY carry more than one). For each option, sanitize the EXTRA-TEXT and collect (info_code, extra_text, nameserver). EDE is collected irrespective of RCODE.
   • Else, only when RCODE == NOERROR and no EDE is present, collect nameserver for N18_NO_EXTENDED_ERROR. A non-NOERROR response without EDE is left to other testcases (basic/Nameserver16) and is not bucketed here.
5. For each unique (info_code, extra_text) pair, emit one finding using the class tag selected from the info-code (see classification), with sorted unique servers.
6. Emit N18_NO_EXTENDED_ERROR with sorted unique servers when non-empty.
7. Emit N18_NO_RESPONSE with sorted unique servers when non-empty.
8. Emit TEST_CASE_END.

Info-code classification

Each observed info-code maps to exactly one class tag. Coverage is complete and disjoint over IANA codes 0-33; codes >=34 (unassigned) and 49152-65535 (private use) fall to the benign default.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Upstream reference: none; this is a gonemaster testcase.

Edge Cases And Limitations

• EDE is purely diagnostic: it never changes the RCODE and never alters DNS protocol processing. This testcase ships with zero numeric penalty, but WARNING-level findings still suppress the A+ bonus.
• Findings are aggregated by (info_code, extra_text), so the same code with different text yields separate findings, and the same code+text across servers yields one finding listing all servers.
• The resolver-behavior class is a hypothesis, not a verdict: a resolver-oriented code from a delegated address can have legitimate or ambiguous sources (combined authoritative+recursive deployments, hidden primaries behind forwarders, anycast nodes). The message is phrased as a possibility and carries no numeric penalty.
• EXTRA-TEXT is free-form bytes from an arbitrary nameserver; it is sanitized to valid UTF-8, stripped of a trailing NUL, trimmed, and capped at 256 bytes with a truncation marker. It is never parsed for logic.
• Draft-assigned info-codes that the dns library registry does not name (e.g. 31, 32, 33) render as code <n> until a future library release names them; the classification is by numeric code and is unaffected.