Add support for DNS resolvers implementing QNAME Minimisation (RFC 7816)
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
#### Feature Description
I use unbound as dns resolver and setup stub-zone according to [Forwarding DNS](https://learn.hashicorp.com/consul/security-networking/forwarding#unbound-setup) tutorial. But this configuration not worked and any attempt to resolve domain name for any registered service failed with NXDOMAIN error and "[WARN] dns: QName invalid: service." in consul logs. Investigation showed, that unbound by default enables QNAME Minimisation feature and consul can't handle this correctly. See [RFC 7816](https://tools.ietf.org/html/rfc7816) for more information about this feature.
More specifically, when unbound receives request for resolving abc.service.consul, first it send query to consul with first label removed (service.consul) and this request fails with NXDOMAIN error which translates back to client. According to RFC 7816, such request must be served with NOERROR and ANSWER: 0.
#### Workarounds
1. Disable qname minimisation:
```
server:
qname-minimisation: no
```
Unfortunately, this option act as global switch, not per-zone.
2. Configure zone as forward instead of stub:
```
forward-zone:
name: "consul"
forward-addr: 127.0.0.1@8600
```
Actually, this is wrong configuration because "forward-zone" purposed for recursors. Correct option for authority servers is "stub-zone".
Contributor guide
Assessment
This issue has not been assessed yet.