<html><head></head><body style="zoom: 0%;"><div dir="auto">Hi all,<br><br></div>
<div dir="auto">Following on from Peter's comments, I went back to Cloudflare and they have fixed their upstream server.<br><br></div>
<div dir="auto">I'm not sure if it's dnsmasq's job to look up the RRSIG of an A record delivered with a CNAME, but either way, my original problem is now solved.<br><br></div>
<div dir="auto">If you think this is still something that should be supported, I'm happy to look into it some more, but probably not.<br><br></div>
<div dir="auto">Thanks all for your input on this.<br><br></div>
<div class="gmail_quote" >On 22 Apr 2022, at 07:57, Peter van Dijk <<a href="mailto:peter.van.dijk@powerdns.com" target="_blank">peter.van.dijk@powerdns.com</a>> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="blue">Hi Chris,<br><br>you replied only to me, and not to the list - in case that was on<br>purpose, this reply is also only to you. Feel free to take this back to<br>the list.<br><br>Given names x and y, with x in an unsigned zone and y in a signed zone,<br>and the following content in those two zones:<br><br>x CNAME y<br>y A <a href="http://192.0.2.1">192.0.2.1</a><br>y RRSIG A ...<br><br>your upstream, when asked to do DNSSEC, should give the RRSIG A for<br>both queries 'x A' and 'y A'. If it does not, it is broken. I'm not<br>sure it's dnsmasq's job to compensate for this.<br><br>Cheers, Peter<br><br>On Thu, 2022-04-21 at 23:04 +0100, Chris Staite wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Yes,<br> <br> And having spent the evening looking at the problem again, I now see that my fix isn’t actually the correct solution.<br> <br> The issue is actually that the server replies with the CNAME and no RRSIG for it (because it’s not signed) and the A records for the CNAME (but no RRSIG values for them). If a query is done separately for the target of the CNAME the RRSIG for the A records are returned.<br> <br> I’m not sure if this is an issue with dnsmasq (whether it should request the A records for the CNAME target as if they weren’t returned already) or if the upstream server really ought to reply with the RRSIG values in the original reply.<br> <br> I’ve got some code in test that detects the lack of RRSIG and removes it from the response, but I’m still trying to figure out how to get dnsmasq to re-query for the A records and get the RRSIG itself.<br> <br> Thanks, Chris.<br> <br> <br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> On 21 Apr 2022, at 18:36, Peter van Dijk <peter.van.dijk@powerdns.com> wrote:<br> <br> On Fri, 2022-04-15 at 00:19 +0100, Chris Staite via Dnsmasq-discuss<br> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> It does require the CNAME to come before the A record, but I think that’s required in the standard anyway<br></blockquote> <br> This is not something you can rely on. Records can get reordered for<br> many reasons.<br> <br> Kind regards,<br> -- <br> Peter van Dijk<br> PowerDNS.COM BV - <a href="https://www.powerdns.com">https://www.powerdns.com</a>/<br> <br> <br><hr><br> Dnsmasq-discuss mailing list<br> Dnsmasq-discuss@lists.thekelleys.org.uk<br> <a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a><br></blockquote> <br></blockquote><br><br></pre></blockquote></div></body></html>