Closed Taomyn closed 2 years ago
m13253
commented
2 years ago This may be a bug. And the reason may be I never tested this against a client that didn't support DNSSEC.
Have you tried the IETF protocol mode? That mode might (or might not) work.
Taomyn
commented
2 years ago Yeah, seems using IETF mode is better as I don't get RRSIG now - this is the test output from the Technitium DNS
JSON:
{
"Metadata": {
"NameServer": "https://doh.mydomain.com/dns-query",
"Protocol": "HttpsJson",
"DatagramSize": "778 bytes",
"RoundTripTime": "329.86 ms"
},
"Identifier": 35049,
"IsResponse": true,
"OPCODE": "StandardQuery",
"AuthoritativeAnswer": false,
"Truncation": false,
"RecursionDesired": true,
"RecursionAvailable": true,
"Z": 0,
"AuthenticData": false,
"CheckingDisabled": false,
"RCODE": "NoError",
"QDCOUNT": 1,
"ANCOUNT": 4,
"NSCOUNT": 0,
"ARCOUNT": 0,
"Question": [
{
"Name": "www.mitel.com",
"Type": "A",
"Class": "IN"
}
],
"Answer": [
{
"Name": "www.mitel.com",
"Type": "CNAME",
"Class": "IN",
"TTL": "3114 (51 mins 54 sec)",
"RDLENGTH": "33 bytes",
"RDATA": {
"Domain": "www.mitel.com.cdn.cloudflare.net"
}
},
{
"Name": "www.mitel.com.cdn.cloudflare.net",
"Type": "A",
"Class": "IN",
"TTL": "24 (24 sec)",
"RDLENGTH": "13 bytes",
"RDATA": {
"IPAddress": "104.18.20.112"
}
},
{
"Name": "www.mitel.com.cdn.cloudflare.net",
"Type": "A",
"Class": "IN",
"TTL": "24 (24 sec)",
"RDLENGTH": "13 bytes",
"RDATA": {
"IPAddress": "104.18.21.112"
}
},
{
"Name": "www.mitel.com.cdn.cloudflare.net",
"Type": "RRSIG",
"Class": "IN",
"TTL": "24 (24 sec)",
"RDLENGTH": "151 bytes",
"RDATA": {
"DATA": "QSAxMyA2IDMwMCAyMDIxMTIwNDA5MTIxMSAyMDIxMTIwMjA3MTIxMSAzNDUwNSBjbG91ZGZsYXJlLm5ldC4gWURNaGtBaDlJY1dKNmJXTi92SUdORUdpWkFJdnMxUkp1elhjV3ZCY0ZvendBTk54RUY2c3o2N0pBSW9ybVZXamZiV0JtR1BtRGthTnFXWW1idFlQSkE9PQ=="
}
}
],
"Authority": [],
"Additional": []
}IETF:
{
"Metadata": {
"NameServer": "https://doh.mydomain.com/dns-query",
"Protocol": "Https",
"DatagramSize": "197 bytes",
"RoundTripTime": "10.7 ms"
},
"Identifier": 50325,
"IsResponse": true,
"OPCODE": "StandardQuery",
"AuthoritativeAnswer": false,
"Truncation": false,
"RecursionDesired": true,
"RecursionAvailable": true,
"Z": 0,
"AuthenticData": false,
"CheckingDisabled": false,
"RCODE": "NoError",
"QDCOUNT": 1,
"ANCOUNT": 3,
"NSCOUNT": 0,
"ARCOUNT": 1,
"Question": [
{
"Name": "www.mitel.com",
"Type": "A",
"Class": "IN"
}
],
"Answer": [
{
"Name": "www.mitel.com",
"Type": "CNAME",
"Class": "IN",
"TTL": "2988 (49 mins 48 sec)",
"RDLENGTH": "34 bytes",
"RDATA": {
"Domain": "www.mitel.com.cdn.cloudflare.net"
}
},
{
"Name": "www.mitel.com.cdn.cloudflare.net",
"Type": "A",
"Class": "IN",
"TTL": "108 (1 min 48 sec)",
"RDLENGTH": "4 bytes",
"RDATA": {
"IPAddress": "104.18.20.112"
}
},
{
"Name": "www.mitel.com.cdn.cloudflare.net",
"Type": "A",
"Class": "IN",
"TTL": "108 (1 min 48 sec)",
"RDLENGTH": "4 bytes",
"RDATA": {
"IPAddress": "104.18.21.112"
}
}
],
"Authority": [],
"Additional": [
{
"Name": "",
"Type": "OPT",
"Class": 1232,
"TTL": "0 (0 sec)",
"RDLENGTH": "0 bytes",
"RDATA": {
"DATA": ""
}
}
]
}
gdm85
commented
2 years ago I am closing this issue as it seems there is nothing to be fixed on dns-over-https side; if you think otherwise please comment!
Thanks
I'm trying to use Technitium DNS Server to query the DoH server (Docker version from https://github.com/satishweb/docker-doh) but it gets messed up because it always received the RRSIG of the DNS record. They tell me that currently Technitium DNS does not support DNSSEC, yet, it will soon but that normally the upstream DNS should not be sending the RRSIG unless requested anyway.
I've tested manual requests to public DoH servers using curl and unless I add the "do=1" parameter to the query, none of them return the RRSIG. I even tried setting "do=0" in the query yet I still get the RRSIG
These are a couple of many I have tried:
The same lookups with Technitium DNS server never return the RRSIG as it never requests it.
And for completeness, against my Docker instance but also with a "do=0":
I also tried specifying "type=A" which made no difference.