Hi Simon,
we've found a bug where locally-configured hostnames (from /etc/hosts,
DHCP leases, or host-record) can return NXDOMAIN to clients instead of
the expected local answer. The attached patch fixes this.
The problem has two parts:
1) When a client queries a local hostname for a record type that has no
local answer (e.g. AAAA when only an A record exists in /etc/hosts),
answer_request() returns 0 and the query is forwarded upstream. Since
the domain only exists locally, upstream returns NXDOMAIN. The correct
response would be NODATA -- the domain exists, it just doesn't have a
record of the requested type.
This is particularly visible with modern Linux resolvers like
systemd-resolved as they routinely send AAAA and A queries independently
at the same time. Most often, modern versions also issue HTTPS queries.
The NXDOMAIN response to the AAAA/HTTPS query can cause the client to
treat the entire domain as non-existent, even though the A answer comes
back correctly.
2) There is already a safety net in process_reply() that converts
upstream NXDOMAIN to NODATA for locally-known domains. However, this
conversion is inside the !bogusanswer gate (line 793 on current master),
so it is skipped when DNSSEC validation fails. For local hostnames under
publicly-signed domains, the upstream NXDOMAIN proof can fail
validation, bypassing the safety net.
The fix:
- In answer_request(): before the final `return 0`, check whether the
domain has any local record with F_HOSTS/F_DHCP/F_CONFIG. If so, return
NODATA instead of forwarding. This prevents the upstream query entirely.
- In process_reply(): move the NXDOMAIN-to-NODATA conversion for
locally-known domains before the bogusanswer check, so it applies
regardless of DNSSEC validation status. Local host records are
authoritative for domain existence.
Originally reported and investigated by me in
https://github.com/pi-hole/FTL/issues/2841
Cheers,
Dominik
From bb1f182beeb5ca5c8ecc4638d302cb6ed183acc8 Mon Sep 17 00:00:00 2001
From: Dominik <[email protected]>
Date: Sun, 12 Apr 2026 13:17:53 +0200
Subject: [PATCH] Fix local host records being overridden by upstream NXDOMAIN
When a locally-configured hostname (from /etc/hosts, DHCP, or
host-record) is queried for a record type with no local answer
(e.g. AAAA when only A exists), the query is forwarded upstream.
If the domain only exists locally, upstream returns NXDOMAIN,
which incorrectly overrides the local host record's existence.
Fix in two places:
1. answer_request(): When no answer is found for the requested
type but the domain has local host/DHCP/config records, return
NODATA instead of forwarding. The domain exists locally, just
not for the requested type.
2. process_reply(): Move the NXDOMAIN-to-NODATA conversion for
locally-known domains before the DNSSEC bogus-answer gate.
Local host records are authoritative for domain existence
regardless of upstream DNSSEC validation status.
---
src/forward.c | 24 +++++++++++++-----------
src/rfc1035.c | 21 +++++++++++++++++++++
2 files changed, 34 insertions(+), 11 deletions(-)
diff --git a/src/forward.c b/src/forward.c
index 1a7c586..501d8e4 100644
--- a/src/forward.c
+++ b/src/forward.c
@@ -788,21 +788,23 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server
return resize_packet(header, n, pheader, plen);
}
+ /* Convert NXDOMAIN to NODATA for locally-known domains. This must happen
+ unconditionally, even for DNSSEC BOGUS answers, since local host records
+ are authoritative for domain existence. */
+ if (!(header->hb3 & HB3_TC) && rcode == NXDOMAIN &&
+ extract_name(header, n, NULL, daemon->namebuff, EXTR_NAME_EXTRACT, 0) &&
+ (check_for_local_domain(daemon->namebuff, now) || lookup_domain(daemon->namebuff, F_CONFIG, NULL, NULL)))
+ {
+ header->hb3 |= HB3_AA;
+ SET_RCODE(header, NOERROR);
+ rcode = NOERROR;
+ cache_secure = 0;
+ }
+
if (header->hb3 & HB3_TC)
log_query(F_UPSTREAM, NULL, NULL, "truncated", 0);
else if (!bogusanswer || (header->hb4 & HB4_CD))
{
- if (rcode == NXDOMAIN && extract_name(header, n, NULL, daemon->namebuff, EXTR_NAME_EXTRACT, 0) &&
- (check_for_local_domain(daemon->namebuff, now) || lookup_domain(daemon->namebuff, F_CONFIG, NULL, NULL)))
- {
- /* if we forwarded a query for a locally known name (because it was for
- an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
- since we know that the domain exists, even if upstream doesn't */
- header->hb3 |= HB3_AA;
- SET_RCODE(header, NOERROR);
- cache_secure = 0;
- }
-
if (daemon->doctors && do_doctor(header, n, daemon->namebuff))
cache_secure = 0;
diff --git a/src/rfc1035.c b/src/rfc1035.c
index 0e31b83..4714d3f 100644
--- a/src/rfc1035.c
+++ b/src/rfc1035.c
@@ -2302,6 +2302,27 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
}
}
+ /* If we couldn't answer (e.g. AAAA query with only A host record, or an
+ unsupported RR type) but the domain has local records from /etc/hosts
+ or DHCP, return NODATA instead of forwarding upstream. This prevents
+ upstream NXDOMAIN responses from overriding local domain existence. */
+ if (!ans)
+ {
+ struct crec *local;
+
+ for (local = cache_find_by_name(NULL, name, now, F_IPV4 | F_IPV6 | F_CNAME);
+ local;
+ local = cache_find_by_name(local, name, now, F_IPV4 | F_IPV6 | F_CNAME))
+ if (local->flags & (F_HOSTS | F_DHCP | F_CONFIG))
+ {
+ ans = 1;
+ sec_data = 0;
+ auth = 0;
+ log_query(F_NEG | F_CONFIG | (qtype == T_A ? F_IPV4 : F_IPV6), name, NULL, NULL, 0);
+ break;
+ }
+ }
+
if (!ans)
return 0; /* failed to answer a question */
--
2.43.0
_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
