DNS server does not include SOA record in response to ANY query

It would appear that the rack DNS server does not provide a complete response to an ANY query; in particular, it seems like the SOA record is missing from the response:

$ dig +notcp ANY @172.20.37.1 berlin.eng.oxide.computer

; <<>> DiG 9.18.39-0ubuntu0.24.04.5-Ubuntu <<>> +notcp ANY @172.20.37.1 berlin.eng.oxide.computer
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39566
;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;berlin.eng.oxide.computer.     IN      ANY

;; ANSWER SECTION:
berlin.eng.oxide.computer. 0    IN      NS      ns1.berlin.eng.oxide.computer.
berlin.eng.oxide.computer. 0    IN      NS      ns2.berlin.eng.oxide.computer.
berlin.eng.oxide.computer. 0    IN      NS      ns3.berlin.eng.oxide.computer.

;; ADDITIONAL SECTION:
ns1.berlin.eng.oxide.computer. 0 IN     A       172.20.37.1
ns2.berlin.eng.oxide.computer. 0 IN     A       172.20.37.2
ns3.berlin.eng.oxide.computer. 0 IN     A       172.20.37.3

;; Query time: 212 msec
;; SERVER: 172.20.37.1#53(172.20.37.1) (UDP)
;; WHEN: Thu Aug 06 14:41:19 AEST 2026
;; MSG SIZE  rcvd: 170

If explicitly requested, we do get the SOA record:

 $ dig +notcp SOA @172.20.37.1 berlin.eng.oxide.computer

; <<>> DiG 9.18.39-0ubuntu0.24.04.5-Ubuntu <<>> +notcp SOA @172.20.37.1 berlin.eng.oxide.computer
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 776
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;berlin.eng.oxide.computer.     IN      SOA

;; ANSWER SECTION:
berlin.eng.oxide.computer. 0    IN      SOA     ns1.berlin.eng.oxide.computer. admin.berlin.eng.oxide.computer. 2 3600 600 1800 600

;; Query time: 212 msec
;; SERVER: 172.20.37.1#53(172.20.37.1) (UDP)
;; WHEN: Thu Aug 06 14:41:25 AEST 2026
;; MSG SIZE  rcvd: 114

A similar query to a BIND nameserver returns every available record type, including SOA:

 $ dig +notcp @dns2.sysmgr.org ANY unix.house

; <<>> DiG 9.18.39-0ubuntu0.24.04.5-Ubuntu <<>> +notcp @dns2.sysmgr.org ANY unix.house
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56029
;; flags: qr aa rd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: bdfb34887f65eaf2010000006a741192ff8b553644c963d3 (good)
;; QUESTION SECTION:
;unix.house.                    IN      ANY

;; ANSWER SECTION:
unix.house.             3600    IN      SOA     dns2.sysmgr.org. josh.sysmgr.org. 2020053001 3600 1800 1209600 60
unix.house.             3600    IN      NS      dns2.sysmgr.org.
unix.house.             3600    IN      NS      dns3.sysmgr.org.
unix.house.             60      IN      A       15.204.0.92
unix.house.             60      IN      CAA     0 iodef "mailto:josh@sysmgr.org"
unix.house.             60      IN      CAA     0 issue "letsencrypt.org"

;; Query time: 170 msec
;; SERVER: 165.22.135.133#53(dns2.sysmgr.org) (UDP)
;; WHEN: Thu Aug 06 14:46:10 AEST 2026
;; MSG SIZE  rcvd: 247

Start by reproducing the ANY query for berlin.eng.oxide.computer and compare it with the explicit SOA query shown in the issue. Locate the DNS response assembly and verify how available record types are selected for ANY requests. Done means the ANY response includes the SOA record while preserving the other records and explicit SOA queries.