{"action":"created","issue":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/3312","labels_url":"https://api.github.com/repos/PowerDNS/pdns/issues/3312/labels{/name}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/3312/comments","events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/3312/events","html_url":"https://github.com/PowerDNS/pdns/issues/3312","id":128939625,"number":3312,"title":"CERT record throws SERVFAIL when retrieved","user":{"login":"c0t0d0s2","id":159020,"avatar_url":"https://avatars.githubusercontent.com/u/159020?v=3","gravatar_id":"","url":"https://api.github.com/users/c0t0d0s2","html_url":"https://github.com/c0t0d0s2","followers_url":"https://api.github.com/users/c0t0d0s2/followers","following_url":"https://api.github.com/users/c0t0d0s2/following{/other_user}","gists_url":"https://api.github.com/users/c0t0d0s2/gists{/gist_id}","starred_url":"https://api.github.com/users/c0t0d0s2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/c0t0d0s2/subscriptions","organizations_url":"https://api.github.com/users/c0t0d0s2/orgs","repos_url":"https://api.github.com/users/c0t0d0s2/repos","events_url":"https://api.github.com/users/c0t0d0s2/events{/privacy}","received_events_url":"https://api.github.com/users/c0t0d0s2/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-26T20:55:46Z","updated_at":"2016-01-28T16:53:14Z","closed_at":"2016-01-28T16:53:14Z","body":"When trying to resolve the following record, I get errors:\r\n```\r\n$ dig nainil.chheda.prodtest.eclinicaldirectplus.com cert @localhost\r\n\r\n; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> nainil.chheda.prodtest.eclinicaldirectplus.com cert @localhost\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9216\r\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0\r\n\r\n;; QUESTION SECTION:\r\n;nainil.chheda.prodtest.eclinicaldirectplus.com.        IN CERT\r\n\r\n;; Query time: 156 msec\r\n;; SERVER: 127.0.0.1#53(127.0.0.1)\r\n;; WHEN: Tue Jan 26 15:53:09 2016\r\n;; MSG SIZE  rcvd: 64\r\n```\r\nreturns \"SERVFAIL\"\r\n\r\nI would expect this zone to return a CERT record, and on any other resolver (e.g. bind) it does.\r\n\r\nIn the log files, I will get either:\r\n```\r\nUnable to parse packet from remote server 204.12.75.12: Overly long label during label decompression (114)\r\n```\r\nor I will get \r\n```\r\nUnable to parse packet from remote server 204.12.75.12: forward reference during label decompression\r\n```\r\nEvery other resolver i've tried seems to be able to get this record just fine.\r\n\r\npdns-recursor-3.7.3-1.x86_64 (obtained from the powerdns website)\r\nrunning OL6.7 (oracle linux 6.7) running 3.8.13-55.1.5.el6uek.x86_64\r\n\r\nWhat I get when I run with any other resolver:\r\n\r\n```\r\n$ dig nainil.chheda.prodtest.eclinicaldirectplus.com cert @8.8.8.8\r\n;; Truncated, retrying in TCP mode.\r\n\r\n; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> nainil.chheda.prodtest.eclinicaldirectplus.com cert @8.8.8.8\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4655\r\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0\r\n\r\n;; QUESTION SECTION:\r\n;nainil.chheda.prodtest.eclinicaldirectplus.com.        IN CERT\r\n\r\n;; ANSWER SECTION:\r\nnainil.chheda.prodtest.eclinicaldirectplus.com. 12168 IN CERT PKIX 5003 RSASHA1 MIIFhTCCBG2gAwIBAgIQCg4X3laklrg2KNCU98NMRzANBgkqhkiG9w0B AQsFADBrMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5j MRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSowKAYDVQQDEyFEaWdp Q2VydCBBY2NyZWRpdGVkIERpcmVjdCBNZWQgQ0EwHhcNMTYwMTA4MDAw MDAwWhcNMTcwMTEyMTIwMDAwWjCBhDELMAkGA1UEBhMCVVMxFjAUBgNV BAgTDU1hc3NhY2h1c2V0dHMxFDASBgNVBAcTC1dlc3Rib3JvdWdoMR0w GwYDVQQKExRlQ2xpbmljYWxEaXJlY3QsIExMQzEoMCYGA1UEAxMfTmFp bmlsIGNoaGVkYSBEaXJlY3QgR3JvdXAgQ2VydDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMXSmdrwhOzzlkCW85tCHfn/5IQYj4yf rdDVXWXCZL6RKOSjBCp7kgIHVqVi4eugPLvyRUn0HzeXhOZq1z40dZh7 DkilaFe/deK9Bj/SuXoZqUkaivaHn38Gdd9a0UZrWhqZGwq+usH1VE+4 jn130yfddQ+rEpZGDgdV4LbGgoUc/x6J1gAO2n3p7M2Odgl7NFmiKrei CKf7JGNdQ0AuqtldDNIu27Kt1n6PAiZydbDOF6mW8ac2x4i3Hzpx1g4j VLavpQsfIdX1qsn88hFaXe/nwtTORXzaEZhodzCWkpuPg6bYwqTCCVz8 TlMrAnKdxGZt4bPw28cBJAgYVFXJE4sCAwEAAaOCAgkwggIFMB8GA1Ud IwQYMBaAFHeuA1ZtElAVf/4Qq3m6LLaMb0nWMB0GA1UdDgQWBBQ/NxmP UdFiPMe7u1EiR8T78sOo9jA5BgNVHREEMjAwgS5uYWluaWwuY2hoZWRh QHByb2R0ZXN0LmVjbGluaWNhbGRpcmVjdHBsdXMuY29tMA4GA1UdDwEB /wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDBDCBjwYDVR0fBIGHMIGE MECgPqA8hjpodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRB Y2NyZWRpdGVkRGlyZWN0TWVkQ0EuY3JsMECgPqA8hjpodHRwOi8vY3Js NC5kaWdpY2VydC5jb20vRGlnaUNlcnRBY2NyZWRpdGVkRGlyZWN0TWVk Q0EuY3JsMEIGA1UdIAQ7MDkwDQYLKwYBBAGCwVsAAQIwDAYKKwYBBAGC wVsBAzAMBgpghkgBhv1sBAMCMAwGCisGAQQBgsFbAgEwfwYIKwYBBQUH AQEEczBxMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5j b20wSQYIKwYBBQUHMAKGPWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv bS9EaWdpQ2VydEFjY3JlZGl0ZWREaXJlY3RNZWRDQS5jcnQwDAYDVR0T AQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAQEAQhmIrC4609GXKCWl5zz9 pddSZEI5C7CoyvdO+Uz1GOP7aj4HwE8T1yLOKcNNOQsCNohFMaBZyr8j tLIDpWmVTfRe7FeK1b90dLzOTVakfxwIE6qfpf7Gv7EUSyGfV/D53Dq4 DxzVAUpKajCqASkbbPVCQZBj9J+M2TN9ljjoY47ztQQtw6kpLcBcQLMW pXWSZiALp+I0ManO1TiTcLQcQAP358ardGqK6Uy0Wm/uoFb5Erci1nmg qIhgLKdr+1iBX0Th0FPem96l3GhkL7JM3gm7yn7a/b7BxyofmC4kvBrX lmEEW71QSc4OV7h34NO+sLdjqoZ9+HfoNw5Ec0afQQ==\r\n\r\n;; AUTHORITY SECTION:\r\neclinicaldirectplus.com. 0      IN      SOA     ns1.eclinicaldirectplus.com. . 125 10800 3600 60480 0\r\n\r\n;; Query time: 10 msec\r\n;; SERVER: 8.8.8.8#53(8.8.8.8)\r\n;; WHEN: Tue Jan 26 15:54:13 2016\r\n;; MSG SIZE  rcvd: 1537\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/comments/176280424","html_url":"https://github.com/PowerDNS/pdns/issues/3312#issuecomment-176280424","issue_url":"https://api.github.com/repos/PowerDNS/pdns/issues/3312","id":176280424,"user":{"login":"Habbie","id":525838,"avatar_url":"https://avatars.githubusercontent.com/u/525838?v=3","gravatar_id":"","url":"https://api.github.com/users/Habbie","html_url":"https://github.com/Habbie","followers_url":"https://api.github.com/users/Habbie/followers","following_url":"https://api.github.com/users/Habbie/following{/other_user}","gists_url":"https://api.github.com/users/Habbie/gists{/gist_id}","starred_url":"https://api.github.com/users/Habbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Habbie/subscriptions","organizations_url":"https://api.github.com/users/Habbie/orgs","repos_url":"https://api.github.com/users/Habbie/repos","events_url":"https://api.github.com/users/Habbie/events{/privacy}","received_events_url":"https://api.github.com/users/Habbie/received_events","type":"User","site_admin":false},"created_at":"2016-01-28T16:53:14Z","updated_at":"2016-01-28T16:53:14Z","body":"Hello,\r\n\r\nthe nameservers for that name are severely broken.\r\n\r\n(1) when queried for CERT, along with the CERT comes a SOA in the AUTHORITY section. This SOA is unnecessary and the RNAME in it ('.') is weird.\r\n(2) when queried for any other type (A, MX), an empty NXDOMAIN comes back, claiming the name does not exist (for any type!). An NXDOMAIN requires a SOA to allow caching. The only reason this NXDOMAIN is not actually breaking the CERT lookup is in fact the lack of SOA. Two wrongs are making a 'gets away with it here'.\r\n(3) but the big dealbreaker is that the response is 1537 bytes, while RFC 1035 4.2.1 is very clear on the maximum datagram message size for DNS over UDP is 512 bytes. PowerDNS Recursor leniently accepts up to 1500 bytes, but this response is over that limit. To fix this, implement setting of the TC bit (but while at it, also make TCP actually work in the name server, it does not respond over TCP 90% of the time). Implementing EDNS0 (RFC 6891) might also be useful for performance reasons.\r\n\r\nAs this is not a PowerDNS issue, I am closing this ticket."}}