Hi all, A recent change in the BIND 9 development branch makes the resolver answer SERVFAIL on RD=0 queries if the answer isn't in the cache or other local data.
Behavior of different implementations varies: - Google DNS returns SERVFAIL; - Quad9 returns REFUSED; - CloudFlare returns SERVFAIL (with EDE 0 "no local cache to fulfill non recursion (RD=0) request"); - CZ.NIC ODVR returns REFUSED (with EDE 20); - BIND >= 9.21.26 now returns SERVFAIL; - older BIND returned a referral to the closest available zone cut in cache/local data, or to the root. Thinking about this, REFUSED makes sense because the server could answer by recursing, and it refused to do that. However, the reason it isn't recursing is because the client specified RD=0, not because of a locally configured policy. Alternatively, SERVFAIL makes sense because the server isn't able to answer this query with the data it has available. Any thoughts about what would be the more "correct" return code here? If this is not already specified in an RFC, should it be? Thanks! -- Colin Vidal -- [email protected] Internet Systems Consortium _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
