Zone09 (zone09)

Status: Final

Purpose

• Validate MX presence and consistency across authoritative nameservers, including null-MX and domain-class exceptions (root/TLD/.arpa).

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Nameserver addresses from methods.Method4and5.
  • SOA and MX responses per nameserver.
• Profile/config knobs that affect behavior:
  • resolver.defaults.parallel: parallel nameserver query fanout.
  • net.ipv4 and net.ipv6: disabled transports are skipped.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Collect nameservers from Method4and5, deduplicate probing list by IP address, and keep a name-to-IP grouping view for later reporting.
3. For each unique nameserver IP (parallelized):
   • Skip disabled transports.
   • Query apex SOA; continue only when response exists, RCODE=NOERROR, AA=true, and SOA answer exists.
   • Query apex MX over UDP with fallback=false; if truncated, retry with TCP (usevc=true, fallback=false).
   • Classify outcome into one bucket:
     • no response;
     • unexpected RCODE;
     • non-authoritative;
     • no MX RRset;
     • MX RRset data.
4. Emit aggregate operational tags:
   • Z09_NO_RESPONSE_MX_QUERY per no-response IP set;
   • Z09_UNEXPECTED_RCODE_MX per RCODE group;
   • Z09_NON_AUTH_MX_RESPONSE when non-authoritative responses exist.
5. If both “no MX” and “MX RRset” buckets are non-empty, emit:
   • Z09_INCONSISTENT_MX
   • Z09_NO_MX_FOUND
   • Z09_MX_FOUND
6. If MX RRset bucket is non-empty:
   • Compare RRset content across IPs using normalized lowercase wire-text ordering.
   • If inconsistent RRset content, emit Z09_INCONSISTENT_MX_DATA and emit one or more Z09_MX_DATA entries grouped by nameserver-name view.
   • If consistent RRset content:
     • evaluate null-MX conditions:
       • Z09_NULL_MX_WITH_OTHER_MX when . mailtarget is mixed with other MX RRs;
       • Z09_NULL_MX_NON_ZERO_PREF when null-MX preference is not zero;
     • if no null-MX:
       • emit Z09_ROOT_EMAIL_DOMAIN for root zone;
       • emit Z09_TLD_EMAIL_DOMAIN for TLD zone;
       • otherwise emit Z09_MX_DATA.
7. If MX RRset bucket is empty and “no MX” bucket is non-empty:
   • If zone is NOT root, TLD, or under .arpa: emit Z09_MISSING_MAIL_TARGET.
   • Otherwise (zone is root, TLD, or under .arpa): emit no tag.
8. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Upstream reference: zone09.md
• Differences (Upstream vs Gonemaster):
  • Upstream: defines Z09_NON_AUTH_MX_RESPONSE from the non-authoritative MX set. Gonemaster: currently populates addresses for this tag from the no-response set (noResponseMX), not the non-authoritative set (nonAuthoritativeMX).
  • Upstream: describes name server IP set processing. Gonemaster: deduplicates probing by IP before classification and separately keeps name-group reporting views.
  • Upstream: does not describe testcase boundary debug markers. Gonemaster: emits TEST_CASE_START and TEST_CASE_END.
• Potential upstream report:
  • no

Edge Cases And Limitations

• Z09_NON_AUTH_MX_RESPONSE currently reports the wrong source IP list due implementation behavior described above.
• Query results for transport-disabled nameservers are skipped; helper debug tags for skipped transports are outside this testcase metadata contract.
• Z09_MX_DATA can be emitted multiple times in the inconsistent-data branch and once in the consistent-data branch.