The domain name can get too long during substitution. For example,
suppose the target name of the DNAME RR is 250 octets in length
(multiple labels), if an incoming QNAME that has a first label over 5
octets in length, the result would be a name over 255 octets. If
this occurs, the server returns an RCODE of YXDOMAIN [RFC2136]. The
DNAME record and its signature (if the zone is signed) are included
in the answer as proof for the YXDOMAIN (value 6) RCODE.
The recursor has two code comments mentioning we don't do this; the auth has no such comments but also lacks the relevant code:
Nov 16 16:56:36 Exception building answer packet for 1234567890.www.d.example.com/A (name too long) sending out servfail
Environment
Software version: all
Steps to reproduce
Create record d.example.com 3005 IN DNAME 1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.example.nl
Ask for 1234567890.www.d.example.com/
Expected behaviour
YXDOMAIN+DNAME+RRSIG
Actual behaviour
Auth: log message plus servfail. Rec: I did not check.
Short description
https://tools.ietf.org/html/rfc6672#section-2.2 says:
The recursor has two code comments mentioning we don't do this; the auth has no such comments but also lacks the relevant code:
Environment
Steps to reproduce
d.example.com 3005 IN DNAME 1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.1234567890.example.nl
1234567890.www.d.example.com/
Expected behaviour
YXDOMAIN+DNAME+RRSIG
Actual behaviour
Auth: log message plus servfail. Rec: I did not check.