Organization: Missouri S&T
Date: Fri, 2 Feb 2018 11:56:11 -0600
Content-Language: en-US
To: bind-bugs@isc.org
MIME-Version: 1.0
From: "Nathan Neulinger" <nneul@mst.edu>
Message-ID: <d61c2f5e-9ae2-b760-b3a4-8058f0416894@mst.edu>
Subject: Changes in 9.12 (related to additional-from changes?) break functionality of a recursive resolver that has cnames crossing zones
content-type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
From nneul@mst.edu  Fri Feb  2 17:56:16 2018
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Thunderbird/58.0
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mst.edu; s=google; h=to:from:subject:organization:message-id:date:user-agent :mime-version:content-language:content-transfer-encoding; bh=gf//H3H1bsa8bomb/9upJRvOb5Qd+eQ9/Uf2n56tE7w=; b=fV87gCApdupbHdQDoqBsmYf2NZ+CHbLOxUMVArkubjjLTEibsg1SLrSrkyS+JZhE+l 1gqati+hJS7+loOUDkD6uAVGOtZbNLYSr4xl8fla5jUqH+VhD0FmxTLPm0PRI3ub8ChD FtRNuiUtH+DbKZ7B5OQRWCXwq2LqIN/3aLbwk=
X-GM-Message-State: AKwxytceZJUN5MzDi7pITk0sSy7zpLDQqYw8G4Ccj4U43uH8ly4rxAK0 hOYgdnAuTyyaFoZkwgmgpVbgNeU1
X-RT-Original-Encoding: utf-8
X-RT-Interface: Email
Content-Length: 1448

Scenario:

Recursive resolver host that is either
	A) Authoritative master for zones srv.example.com and example.com
	B) Authoritative ixfr slave for zones srv.example.com and example.com

With 9.11, a lookup of 'service.example.com' that is a cname to 'server.srv.example.com' will return the cname and the A 
record.

With 9.12, it returns only the cname, expecting the client system to do the recursion to the second zone.


I can understand this new behavior on a normal master server for multiple zones - since that should not be getting 
queried by clients that don't do their own recursive lookups. However, for a server that has recursion enabled - it 
shouldn't be sending back a partial response like this and expecting the client system to do the recursion since that 
will break any normal desktop client system.

Another way of looking at it would be if I had a recursive-only (no slave zones) server - it would work fine. The moment 
I enhance that recursive server by giving it a full authoritative copy of the zones - it breaks.


If the expectation/statement going forward is that a bind 9.12 recursive server cannot also be authoritative slave, then 
that should be called out much more blatantly in release notes.


-- Nathan

------------------------------------------------------------
Nathan Neulinger                       nneul@mst.edu
Missouri S&T Information Technology    (573) 612-1412
System Administrator - Architect