{"action":"opened","issue":{"url":"https://api.github.com/repos/kenshinx/godns/issues/20","labels_url":"https://api.github.com/repos/kenshinx/godns/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/kenshinx/godns/issues/20/comments","events_url":"https://api.github.com/repos/kenshinx/godns/issues/20/events","html_url":"https://github.com/kenshinx/godns/issues/20","id":113783393,"number":20,"title":"Error codes converted to SERVFAIL","user":{"login":"robcza","id":11228982,"avatar_url":"https://avatars.githubusercontent.com/u/11228982?v=3","gravatar_id":"","url":"https://api.github.com/users/robcza","html_url":"https://github.com/robcza","followers_url":"https://api.github.com/users/robcza/followers","following_url":"https://api.github.com/users/robcza/following{/other_user}","gists_url":"https://api.github.com/users/robcza/gists{/gist_id}","starred_url":"https://api.github.com/users/robcza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robcza/subscriptions","organizations_url":"https://api.github.com/users/robcza/orgs","repos_url":"https://api.github.com/users/robcza/repos","events_url":"https://api.github.com/users/robcza/events{/privacy}","received_events_url":"https://api.github.com/users/robcza/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-28T10:05:19Z","updated_at":"2015-10-28T10:05:19Z","closed_at":null,"body":"This is a request against unbound resolver (mark the NXDOMAIN status)\r\n```                                                                    \r\n; <<>> DiG 9.10.2-P4-RedHat-9.10.2-5.P4.fc22 <<>> @127.0.0.1 -p5353 dfhfghhsdgfg\r\ndfgdfhfgh.com                                                                   \r\n; (1 server found)                                                              \r\n;; global options: +cmd                                                         \r\n;; Got answer:                                                                  \r\n;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51298                      \r\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1            \r\n                                                                                \r\n;; OPT PSEUDOSECTION:                                                           \r\n; EDNS: version: 0, flags:; udp: 4096                                           \r\n;; QUESTION SECTION:                                                            \r\n;dfhfghhsdgfgdfgdfhfgh.com.     IN      A                                       \r\n                                                                                \r\n;; AUTHORITY SECTION:                                                           \r\ncom.                    900     IN      SOA     a.gtld-servers.net. nstld.verisi\r\ngn-grs.com. 1446026097 1800 900 604800 86400                                    \r\n                                                                                \r\n;; Query time: 98 msec                                                          \r\n;; SERVER: 127.0.0.1#5353(127.0.0.1)                                            \r\n;; WHEN: Wed Oct 28 09:55:07 UTC 2015                                           \r\n;; MSG SIZE  rcvd: 127\r\n```\r\n\r\nThis request is sent towards godns that resolves against the same unbound as used earlier (status SERVFAIL)\r\n```\r\n;; SERVER: 127.0.0.1#5353(127.0.0.1)                                            \r\n;; WHEN: Wed Oct 28 09:55:07 UTC 2015                                           \r\n;; MSG SIZE  rcvd: 127                                                          \r\n                                                                                \r\n[root@resolver-1 /]# dig @127.0.0.1 -p53 dfhfghhsdgfgdfgdfhfgh.com              \r\n                                                                                \r\n; <<>> DiG 9.10.2-P4-RedHat-9.10.2-5.P4.fc22 <<>> @127.0.0.1 -p53 dfhfghhsdgfgdf\r\ngdfhfgh.com                                                                     \r\n; (1 server found)                                                              \r\n;; global options: +cmd                                                         \r\n;; Got answer:                                                                  \r\n;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 25294                      \r\n;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0               \r\n;; WARNING: recursion requested but not available                               \r\n                                                                                \r\n;; QUESTION SECTION:                                                            \r\n;dfhfghhsdgfgdfgdfhfgh.com.     IN      A                                       \r\n                                                                                \r\n;; Query time: 21 msec                                                          \r\n;; SERVER: 127.0.0.1#53(127.0.0.1)                                              \r\n;; WHEN: Wed Oct 28 09:56:53 UTC 2015                                           \r\n;; MSG SIZE  rcvd: 43\r\n```\r\n\r\nIn my opinion, this could affect client behavior and any forwarders in the chain, as these responses are inappropriate and does not describe the nature of the response in the right way (SERVFAIL is a signal for a forwarder to try another resolver, however NXDOMAIN is a very clear response stating that it has been verified no such domain exists).\r\nI would suggest processing all the possible response codes according to the source project https://github.com/miekg/dns/blob/adeb323cbc8e73c87181c5ac9d393d66bbc4e165/msg.go#L124 and use these even in the cache (I consider caching NXDOMAIN ok, however caching SERFAIL does not make sense).\r\nI believe @karm will be interested in this issue as well"}}