prometheus metrics: understanding of SERVFAILS with RFC8914 Extended DNS Error counters

[appliedprivacy]

• Program: Recursor
• Issue type: Feature request

related: #9733

Short description

When looking at Recursor prometheus metrics SERVFAIL graphs the obvious question comes up: What is the root cause behind them? A recently published RFC aims to help with that: https://datatracker.ietf.org/doc/rfc8914/ https://blog.cloudflare.com/unwrap-the-servfail/

Usecase

Better understanding of the root cause behind SERVFAILs (if EDE data is available)

Description

Would be nice if each EDE case would be counted and published in prometheus metrics individually if the information is available.

Current metrics

• pdns_recursor_servfail_answers

could be extended with a EDE label containing the codes:

ede= https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#extended-dns-error-codes

 Other
 Unsupported DNSKEY Algorithm
 Unsupported DS Digest Type
 Stale Answer
 Forged Answer
 DNSSEC Indeterminate
 DNSSEC Bogus
 Signature Expired
 Signature Not Yet Valid
 DNSKEY Missing
 RRSIGs Missing
 No Zone Key Bit Set
 NSEC Missing
 Cached Error
 Not Ready
 Blocked
 Censored
 Filtered
 Prohibited
 Stale NXDOMAIN Answer
 Not Authoritative
 Not Supported
 No Reachable Authority
 Network Error
 Invalid Data

example:

pdns_recursor_servfail_responses{ede="No Reachable Authority"} 10
pdns_recursor_servfail_responses{ede="Network Error"} 10

[omoerbeek]

Related to #11386