DNS · XB Field Notes

dnsmasq separates forwarded cache entries from configured local names

Sat, 15 Apr 2028 00:00:00 +0000

dnsmasq can forward DNS questions upstream, retain supported answers in a bounded cache, and serve names configured locally. These are different sources of data. A repeated answer may be a cache hit or a local configuration result. Establishing which source supplied it is essential when a hostname disagrees with the authority or continues resolving after a cache flush.

Identify the source of each answer. Forwarded cache and configured local names have different lifetimes: local TTL zero does not erase configuration. SIGHUP clears cache and reloads selected data sources, not generally the main configuration. Counts and addresses reproduce the article’s historical example; it was not rerun.

When it breaks

Starting dnsmasq does not automatically make every application use it. Clients must direct their DNS queries through the intended listener, and some applications use other resolvers. Likewise, a correct local listener can forward to the wrong upstream or read unexpected host configuration. Diagnose the actual query path before enlarging the cache or restarting a daemon that never received the failing query.

A local name can deliberately override upstream data. Clearing the forwarding cache does not delete that configured name, so repeated flushing cannot make the upstream address win. Treat a local record as configuration with an owner and purpose. An answer with local TTL zero can still be returned repeatedly because dnsmasq generates it from configuration rather than retaining a forwarded response.

Cache capacity and freshness solve different problems. A larger cache can retain more eligible entries, but it does not extend their valid TTLs or make every possible query answerable during an upstream outage. New names and expired entries still need the appropriate resolution path. Cache-size tuning also does not directly specify the maximum number of simultaneous upstream queries or reserve application-level availability.

Check it quickly

Save the script as check-dnsmasq.py and run python3 check-dnsmasq.py with Docker. The pinned environment uses dnsmasq 2.90 and BIND 9.18.49. The test forwarders ignore ambient resolver and hosts files, bind explicit loopback listeners, and forward only to the disposable authority. They publish no host ports and use no DHCP configuration:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
with lab('cached 20 IN A 127.0.0.2\nuncached 20 IN A 127.0.0.3\nlocal 20 IN A 127.0.0.4') as (_,update,cache,queries):
 daemon,log=cache(options=('--host-record=local.lab.test,127.0.0.9',))
 for _ in range(3):assert values(query('cached.lab.test.',port=1054))==['127.0.0.2']
 wait(lambda: queries('cached.lab.test')==1)
 cache(port=1055,size=0)
 for _ in range(3):assert values(query('uncached.lab.test.',port=1055))==['127.0.0.3']
 wait(lambda: queries('uncached.lab.test')==3)
 local=query('local.lab.test.',port=1054);assert values(local)==['127.0.0.9'] and local.answer[0].ttl==0
 assert queries('local.lab.test')==0
 authoritative=query('local.lab.test.');assert values(authoritative)==['127.0.0.4']
 wait(lambda: queries('local.lab.test')==1)
 update('cached 20 IN A 127.0.0.8\nuncached 20 IN A 127.0.0.3\nlocal 20 IN A 127.0.0.4')
 stale=query('cached.lab.test.',port=1054);assert values(stale)==['127.0.0.2'] and queries('cached.lab.test')==1
 previous=log.read_text().count('cleared cache');daemon.send_signal(signal.SIGHUP)
 wait(lambda: log.read_text().count('cleared cache')>previous)
 refreshed=query('cached.lab.test.',port=1054);assert values(refreshed)==['127.0.0.8']
 wait(lambda: queries('cached.lab.test')==2)
 retained=query('local.lab.test.',port=1054);assert values(retained)==['127.0.0.9']
 print(json.dumps({'three_lookups_upstream_counts':{'cache_enabled':1,'cache_disabled':3},'local_record':show(local),
 'same_name_authority':show(authoritative),'before_SIGHUP':show(stale),'after_SIGHUP':show(refreshed),
 'configured_local_record_retained':show(retained)},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Three queries for cached.lab.test through the cache-enabled listener all return 127.0.0.2, while the authoritative log records one query. A second listener uses cache-size=0. Three queries for a separate name through it generate three upstream queries. This directly verifies the cache’s effect on forwarding work; the experiment does not infer hits from response speed or assert a particular latency improvement.

The first listener also has host-record=local.lab.test,127.0.0.9. Its answer is 127.0.0.9 with TTL zero, and no upstream query is logged for that lookup. A direct authoritative query for the same name returns 127.0.0.4 and increments the authority’s counter. The differing results show an explicit local override, with a positive control confirming that the query counter detects real upstream traffic.

Next, the authority changes cached.lab.test to 127.0.0.8. The cache still returns its earlier 127.0.0.2 answer within the remaining TTL. The script sends SIGHUP to this specific dnsmasq process and waits for its cache-cleared log entry. The following query reaches the authority and returns 127.0.0.8, increasing the corresponding authoritative count from one to two.

After that same signal, local.lab.test continues returning the configured 127.0.0.9 value. The signal clears forwarded cache state while leaving the explicitly configured local record available. This is why “flush DNS” is incomplete troubleshooting advice: the expected result depends on which process owns which data, and whether that data is cached, configured, or stored somewhere else entirely.

Operate the listener and its data sources deliberately

Inspect the effective configuration, listener address, upstream destinations, and client settings together. Avoid creating a forwarding loop between two local resolvers. The example removes ambient inputs to isolate behavior; a real installation may intentionally use hosts files, DHCP leases, or resolver-management software. Record those dependencies so an automatic rewrite or a local override is visible during troubleshooting.

For dnsmasq, SIGHUP clears its cache and reloads certain data sources described by the manual, but it does not generally reread the main configuration file. Use the documented service procedure for the kind of change being made. A successful cache clear cannot be treated as proof that edited listener, forwarding, or other startup configuration has been activated.

Limit listener exposure to intended clients, especially when forwarding recursion on a reachable network. DHCP, DNSSEC validation, and encrypted upstream transport require their own configuration and verification; none is demonstrated by this cache experiment. Query logging is useful during diagnosis but can reveal client naming activity, so select its scope and retention according to the environment rather than leaving detailed logs indefinitely by habit.

Finally, compare cached answers with the authority when it is the expected source. For a configured local name, compare against its configuration. Track upstream failures, hits, and entry churn separately. Identify whether the discrepancy concerns capacity, lifetime, the upstream service, or a local naming rule.

Sources

dnsmasq manual, forwarding, cache-size, host-record, local TTL, and SIGHUP behavior, checked 2026-09-12.
RFC 1035 domain names, DNS resource records and cached lifetimes, checked 2026-09-12.

DNS TTL trades repeated upstream queries against retained answers

Wed, 01 Mar 2028 00:00:00 +0000

A DNS TTL is a lifetime attached to cached data, not a refresh job scheduled for every second. A cache can reuse a valid answer while it retains that entry. After expiry, a subsequent request usually requires fresh resolution unless another configured behavior applies. An idle record need not produce an upstream query merely because its TTL has reached zero.

The article’s controlled example uses three lookups 1.2 seconds apart: TTL 1 produces three upstream queries and TTL 20 one. A downstream cache receives remaining lifetime, not a reset TTL. These diagrams reproduce source-described behavior; no resolver experiment was run for this visual.

When it breaks

Shortening TTL increases potential upstream work when clients keep asking for the same data. It does not multiply all authoritative traffic by one universal factor: query frequency, resolver sharing, cache capacity, prefetching, and record diversity affect the result. A short TTL on one popular name behaves differently from a large stream of names that are each queried only once.

A long TTL permits continued use of an answer after the authority changes its data. That cached answer may still be valid under the lifetime originally received even though it no longer matches the newest zone content. Calling every mismatch an expired or broken cache obscures the actual contract. TTL expresses permitted retention; it does not promise continuous synchronization with the authority.

Multiple forwarding layers do not ordinarily receive a fresh copy of the original TTL at every hop. A cache returns remaining lifetime, which the next cache then ages. Adding full TTLs per layer invents a propagation delay that ordinary compliant forwarding does not create. Local TTL overrides and serve-stale policies are separate behaviors that should be identified explicitly when present.

Check it quickly

Save this as check-ttl-cost.py and run python3 check-ttl-cost.py with Docker. The pinned container uses BIND 9.18.49 and dnsmasq 2.90, with no external runtime network. The authoritative server logs actual queries. One forwarder initially serves two names, and the script later starts a second forwarder behind the first to inspect the TTL handed downstream:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
with lab('short 1 IN A 127.0.0.2\nlong 20 IN A 127.0.0.3\nchain 6 IN A 127.0.0.4') as (_,update,cache,queries):
 cache();samples=[]
 for i in range(3):
 pair={name:show(query(name+'.lab.test.',port=1054)) for name in ('short','long')};samples.append(pair)
 if i<2:time.sleep(1.2)
 wait(lambda: queries('short.lab.test')==3 and queries('long.lab.test')==1)
 first=query('chain.lab.test.',port=1054);assert first.answer[0].ttl==6
 wait(lambda: queries('chain.lab.test')==1)
 time.sleep(2.2);cache(port=1055,upstream=1054)
 downstream=query('chain.lab.test.',port=1055);upstream=query('chain.lab.test.',port=1054)
 assert values(downstream)==['127.0.0.4'] and 0<downstream.answer[0].ttl<6
 assert abs(downstream.answer[0].ttl-upstream.answer[0].ttl)<=1
 assert queries('chain.lab.test')==1
 update('short 1 IN A 127.0.0.2\nlong 20 IN A 127.0.0.3\nchain 6 IN A 127.0.0.5')
 wait(lambda: values(query('chain.lab.test.',port=1055))==['127.0.0.5'],timeout=8)
 wait(lambda: queries('chain.lab.test')==2)
 print(json.dumps({'three_lookups_each':samples,'authority_query_counts':{'short':queries('short.lab.test'),'long':queries('long.lab.test')},
 'cache_chain':{'original':show(first),'downstream_first':show(downstream),'upstream_remaining':show(upstream),'authority_queries_after_expiry':queries('chain.lab.test')}},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The short.lab.test record has TTL 1 and long.lab.test has TTL 20. The program queries each three times, waiting 1.2 seconds between rounds. The authoritative log records three queries for the short-lived record and one for the long-lived record. Both produce successful answers on every round. The difference is upstream work under this controlled request schedule, not a measured application-latency improvement.

The returned TTL for the long-lived record decreases across rounds, while each refreshed short-lived answer starts at 1 again. The script checks the server log rather than assuming a fast response means a cache hit. On loopback, even an uncached query can be quick, so response time alone would not establish whether the authority was contacted or the answer came from memory.

For the layered case, the first forwarder caches chain.lab.test with TTL 6. After 2.2 seconds, a newly started second forwarder queries through it. The recorded downstream answer has TTL 3, matching the upstream remaining value within integer-second timing. It does not regain TTL 6. The authoritative count remains one, confirming that this downstream fill reused the first forwarder’s cached answer.

The authority then changes the chain record’s address. Queries through the second forwarder eventually receive the new address, and the authoritative count rises to two. This checks successful refresh through both layers after the retained data expires. The exact expiry fraction is implementation-dependent; the asserted properties are preserved remaining lifetime, no premature extra authoritative query, and eventual acquisition of the changed value.

Choose TTL from observed demand and change needs

Use expected change frequency and acceptable old-answer overlap alongside query volume. A busy shared resolver can amortize one answer across many clients, whereas isolated caches duplicate fills. Eviction can make an entry disappear before its TTL, so a long configured lifetime does not guarantee a hit. Measure hits, misses, upstream requests, and available capacity instead of treating TTL as a cache-size control.

For a planned move, lower TTL early enough for earlier longer-lived copies to expire. Keep the destination overlap aligned with the actual retained data. Raising TTL after stability reduces repeated resolution for busy records, but it also extends the next change’s ordinary waiting window. The relevant unit is the RRset: records of the same name, class, and type should have a consistent TTL.

Finally, compare answer data and remaining lifetime at each resolver actually used by the application. A direct authoritative query and a cached recursive answer reveal different states. Application caches and existing connections may add their own behavior outside this DNS experiment. Separate those lifetimes before estimating how quickly users will discover a changed endpoint or how much authoritative capacity a TTL adjustment requires.

Sources

RFC 1035 domain names, TTL as a cache lifetime and treatment of cached records, checked 2026-09-12.
RFC 2181 DNS clarifications, TTL limits and consistent lifetime within an RRset, checked 2026-09-12.
dnsmasq manual, cache sizing, forwarding, and TTL options, checked 2026-09-12.

AAAA records publish IPv6 addresses without proving reachability

Thu, 30 Dec 2027 00:00:00 +0000

An AAAA resource record contains one 128-bit IPv6 address. An A record contains an IPv4 address. A name may have either type, both types, or several addresses within each type. These are separate RRsets, so A and AAAA can have different TTLs. Publishing AAAA makes an address discoverable through DNS; it does not create an interface, route, listener, or working application.

AAAA publishes IPv6 data independently of DNS query transport. The article fixture demonstrates local HTTP reachability separately; it proves neither public IPv6 connectivity nor hostname TLS.

When it breaks

A successful AAAA lookup can lead to a failed connection. The published address may be obsolete, the service may listen only on IPv4, or the path may lack usable IPv6 routing. Firewall rules and TLS configuration can also differ between families. An IPv4-only availability check can miss the problem while dual-stack users experience delays or failures through the advertised IPv6 path.

Happy Eyeballs reduces some dual-stack connection delays by coordinating address discovery and connection attempts. It is a client algorithm, not a DNS guarantee that every client implements. Fallback behavior, deadlines, and application protocols still matter. Publishing a broken AAAA is therefore not automatically harmless merely because a particular browser quickly succeeds through an A record during one test.

Missing AAAA also needs precise language. An authoritative A-only name can produce a successful DNS response with no AAAA data, commonly called NODATA. That differs from NXDOMAIN, which reports a nonexistent name. An A-only service is not categorically unreachable from every IPv6-only network: DNS64 can synthesize AAAA answers for use with NAT64 translation when that infrastructure and its requirements are present.

Check it quickly

Save the script as check-aaaa.py and run python3 check-aaaa.py with Docker available. The pinned environment uses BIND 9.18.49 and dnspython 2.3.0. Its isolated network contains working IPv6 loopback but no external route. The program starts a real HTTP listener on ::1 and performs both DNS queries and a separate IPv6 connection:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,socket,threading
records='dual 17 IN A 127.0.0.1\ndual 29 IN AAAA ::1\nv4-only 17 IN A 127.0.0.1\nbroken 29 IN AAAA 2001:db8::1234'
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=b'IPv6 response';self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
class V6Server(ThreadingHTTPServer):address_family=socket.AF_INET6
with lab(records) as (_,update,cache,queries),V6Server(('::1',0),Handler) as server:
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
 try:
 a=query('dual.lab.test.','A');aaaa=query('dual.lab.test.','AAAA')
 assert values(a)==['127.0.0.1'] and values(aaaa,'AAAA')==['::1']
 assert a.answer[0].ttl==17 and aaaa.answer[0].ttl==29
 address=values(aaaa,'AAAA')[0];assert len(socket.inet_pton(socket.AF_INET6,address))==16
 client=http.client.HTTPConnection(address,server.server_port,timeout=2)
 client.request('GET','/');reply=client.getresponse();body=reply.read();client.close()
 assert reply.status==200 and body==b'IPv6 response'
 only_a=query('v4-only.lab.test.');assert values(only_a)==['127.0.0.1']
 missing=query('v4-only.lab.test.','AAAA');assert missing.rcode()==0 and missing.answer==[]
 assert len(missing.authority)==1 and missing.authority[0].rdtype==dns.rdatatype.SOA
 broken=query('broken.lab.test.','AAAA');assert values(broken,'AAAA')==['2001:db8::1234']
 unreachable=socket.socket(socket.AF_INET6);unreachable.settimeout(.3)
 try:unreachable.connect(('2001:db8::1234',server.server_port));raise AssertionError('documentation address unexpectedly reachable')
 except OSError as error:failure=type(error).__name__
 finally:unreachable.close()
 print(json.dumps({'A':show(a),'AAAA_over_IPv4_DNS':show(aaaa),'IPv6_HTTP_status':reply.status,
 'AAAA_wire_address_bytes':16,'A_only_AAAA_query':show(missing),'published_but_unreachable':{'answer':show(broken),'connect_error':failure}},sort_keys=True))
 finally:server.shutdown();thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The name dual.lab.test returns A 127.0.0.1 with TTL 17 and AAAA ::1 with TTL 29. Both DNS queries travel to an IPv4 DNS socket at 127.0.0.1. Receiving AAAA over that socket demonstrates that the address family described by the record is independent of the transport carrying the DNS question and answer.

The program converts the AAAA text into its packed form and checks that it occupies 16 bytes. It then uses the returned IPv6 address to request the local HTTP service. The recorded response is status 200 with the expected body. This verifies a usable IPv6 loopback connection for the selected address, rather than treating the existence of an AAAA record as the application test.

Querying AAAA for v4-only.lab.test returns NOERROR, no answer RRset, and an SOA in the authority section. The name still has its A record. Meanwhile, broken.lab.test successfully returns the documentation address 2001:db8::1234; connecting to it fails in this isolated environment. The result deliberately separates positive DNS data from transport success without sending test traffic to a real external host.

Check each advertised family through the service

Before publishing an IPv6 address, establish the listener, route, access rules, and application behavior. Test the hostname with its normal identity and test the individual advertised endpoints. A raw-address HTTP success does not validate hostname-based TLS or virtual-host routing. The example verifies local HTTP only; it neither demonstrates public IPv6 connectivity nor evaluates a client’s Happy Eyeballs implementation.

Keep both RRsets in monitoring and deployment records. Removing AAAA stops new authoritative answers but does not invalidate addresses already cached by clients. Existing connections have their own lifetimes. During a move, retain the old IPv6 service for the intended overlap and compare authoritative data with the recursive resolver used by affected clients before attributing every old connection to a stale DNS answer.

Finally, AAAA is forward address data, despite occasional descriptions calling it an IPv6 pointer. Reverse lookup uses PTR records under ip6.arpa, with reversed hexadecimal nibbles derived from the address. Publishing forward AAAA does not automatically publish that reverse record. Treat forward lookup, reverse naming, address selection, and successful application traffic as related checks with distinct configurations and observable outcomes.

Sources

RFC 3596 DNS extensions for IPv6, AAAA address data, transport independence, and ip6.arpa reverse names, checked 2026-09-12.
RFC 6147 DNS64, synthesized AAAA records for access to IPv4 servers, checked 2026-09-12.
RFC 8305 Happy Eyeballs version 2, client address selection and connection attempts, checked 2026-09-12.

Zone transfer copies authoritative data under explicit authorization and serial rules

Sun, 05 Dec 2027 00:00:00 +0000

AXFR transfers a complete DNS zone so another server or authorized client can obtain its data. A secondary can then answer authoritatively from its local copy. The protocol does not magically identify callers as legitimate authoritative servers: access control decides who may transfer. A zone is also a defined authority boundary, not every record in every delegated child zone or the organization’s entire DNS namespace.

Compare serial and actual data, not serial alone. The source’s 10-to-11 repair is a concrete case; general comparison uses 32-bit serial arithmetic. Complete-transfer framing, TSIG authorization and SOA expiry are separate checks. The zone-transfer exercise was not rerun and no shared secret was generated.

When it breaks

Editing primary data without updating the SOA serial can leave a secondary serving different content with the same version number. Reloading the primary does not force every secondary to replace an apparently unchanged zone. DNS serial comparison uses 32-bit serial arithmetic, including wraparound rules; a date-looking number is only an operator convention, not an independent guarantee that every numeric change is newer.

An unrestricted transfer can reveal the zone’s full published contents to an arbitrary requesting client. Source restrictions and TSIG can control access, but their configuration semantics matter. In particular, listing an address and a key in an ordinary BIND allow-list is not automatically an AND requirement. Review the actual ACL behavior and test an unauthorized request from a relevant source, rather than assuming two listed conditions both apply.

A secondary’s ability to answer during primary failure is bounded by SOA expiry. Record TTL controls caching by downstream consumers; it is not the same as the secondary’s expiry timer for its authoritative copy. After unsuccessful refresh for the allowed period, the secondary must stop treating that copy as current authoritative data. Existing successful answers do not establish unlimited independence from the primary.

Check it quickly

Save this as check-zone-transfer.py and run python3 check-zone-transfer.py with Docker. Two BIND 9.18.49 processes run inside an isolated container. A randomly generated disposable TSIG secret authorizes transfers, and is not printed. The fixture uses deliberately short refresh and expiry values to expose state changes promptly; these values are test settings, not a suggested production policy:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
import base64,secrets
import dns.tsig,dns.tsigkeyring
with TemporaryDirectory(prefix='xbcatm-xfr-') as directory:
 root=Path(directory);primary=root/'primary';secondary=root/'secondary';primary.mkdir();secondary.mkdir()
 secret=base64.b64encode(secrets.token_bytes(32)).decode();keyring=dns.tsigkeyring.from_text({'xfr.lab.test.':secret})
 key_config=f'key "xfr.lab.test." {{ algorithm hmac-sha256; secret "{secret}"; }};'
 zone=primary/'zone'
 def save(serial,address):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 2\n@ IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 1 1 6 1)\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\nservice IN A {address}\n')
 run('named-checkzone','lab.test',str(zone))
 def options(path,port):return f'''options {{ directory "{path}"; listen-on port {port} {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; max-cache-size 8m; session-keyfile none; pid-file "{path}/named.pid"; lock-file "{path}/named.lock";
min-refresh-time 1; max-refresh-time 2; min-retry-time 1; max-retry-time 2; }}; controls {{}};'''
 save(10,'127.0.0.2')
 primary_config=key_config+options(primary,1053)+f'''zone "lab.test" {{ type primary; file "{zone}";
allow-transfer {{key "xfr.lab.test.";}}; notify explicit; also-notify {{127.0.0.1 port 1054 key "xfr.lab.test.";}}; }};'''
 secondary_config=key_config+options(secondary,1054)+f'''zone "lab.test" {{ type secondary; file "{secondary}/copy";
primaries {{127.0.0.1 port 1053 key "xfr.lab.test.";}}; allow-transfer {{none;}}; }};'''
 with named_process(primary,primary_config) as (master,master_log),named_process(secondary,secondary_config):
 wait(lambda: values(query('service.lab.test.',port=1054))==['127.0.0.2'])
 def transfer(**kwargs):return [rr for message in dns.query.xfr('127.0.0.1','lab.test.',port=1053,timeout=2,lifetime=4,relativize=False,**kwargs) for rr in message.answer]
 copied=transfer(keyring=keyring,keyname='xfr.lab.test.')
 assert copied[0].rdtype==copied[-1].rdtype==dns.rdatatype.SOA
 assert copied[0][0].serial==copied[-1][0].serial==10
 assert any(str(rr.name)=='service.lab.test.' and any(str(item)=='127.0.0.2' for item in rr) for rr in copied)
 rejected={}
 for label,kwargs in [('unsigned',{}),('wrong_secret',{'keyring':dns.tsigkeyring.from_text({'xfr.lab.test.':base64.b64encode(secrets.token_bytes(32)).decode()}),'keyname':'xfr.lab.test.'})]:
 try:transfer(**kwargs);raise AssertionError('unauthorized zone transfer succeeded')
 except (dns.query.TransferError,dns.tsig.PeerBadSignature) as error:rejected[label]=type(error).__name__
 assert values(query('service.lab.test.'))==['127.0.0.2']
 save(10,'127.0.0.3');master.send_signal(signal.SIGHUP);wait(lambda: values(query('service.lab.test.'))==['127.0.0.3'])
 time.sleep(2.2);unchanged=query('service.lab.test.',port=1054);assert values(unchanged)==['127.0.0.2']
 save(11,'127.0.0.3');master.send_signal(signal.SIGHUP)
 wait(lambda: query('lab.test.','SOA').answer[0][0].serial==11)
 wait(lambda: values(query('service.lab.test.',port=1054))==['127.0.0.3'])
 secondary_soa=query('lab.test.','SOA',1054);assert secondary_soa.answer[0][0].serial==11
 requested_ixfr=transfer(keyring=keyring,keyname='xfr.lab.test.',rdtype='IXFR',serial=10)
 assert requested_ixfr[0][0].serial==11 and requested_ixfr[1].rdtype!=dns.rdatatype.SOA
 assert requested_ixfr[-1].rdtype==dns.rdatatype.SOA and requested_ixfr[-1][0].serial==11
 stop(master)
 while_valid=query('service.lab.test.',port=1054);assert values(while_valid)==['127.0.0.3']
 expired=[]
 def no_longer_served():
 answer=query('service.lab.test.',port=1054);expired.append(answer);return answer.rcode()==dns.rcode.SERVFAIL
 wait(no_longer_served,timeout=12)
 print(json.dumps({'AXFR_SOA_serials':[copied[0][0].serial,copied[-1][0].serial],'AXFR_record_sets':len(copied),
 'unauthorized_transfer_errors':rejected,'same_serial_secondary_address':values(unchanged),'updated_secondary_serial':11,
 'IXFR_without_history_returned_AXFR':True,'primary_stopped_secondary_initially_answers':values(while_valid),
 'secondary_after_SOA_expire':dns.rcode.to_text(expired[-1].rcode())},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The primary starts at serial 10 with service.lab.test pointing to 127.0.0.2. A real secondary transfers the zone and answers that address. An ordinary Python client using the authorized TSIG key also completes AXFR. Its five RRset entries include opening and closing SOA records with serial 10 and the expected service data, demonstrating both transfer completion and access by an authorized non-server client.

An unsigned request and a request signed with a different secret fail, even though the requests originate inside the same loopback environment. Ordinary permitted address queries still succeed. The tested rule requires the configured key for transfer; it does not make every DNS query require TSIG. Authentication of the transfer operation is separate from publishing ordinary authoritative answers.

The primary then reloads a changed service address, 127.0.0.3, while retaining serial 10. After the short refresh window, the secondary still answers 127.0.0.2. Raising the serial to 11 and reloading lets the secondary acquire the changed address. The example therefore verifies the divergence and its repair, rather than merely checking that both configuration files mention the same primary.

An IXFR request for changes since serial 10 receives a full AXFR-style response because this primary retains no incremental history for the update. The script identifies the response’s SOA framing. Finally, it stops the primary. The secondary initially continues answering 127.0.0.3, then returns SERVFAIL after its short SOA expiry interval. No host clock or shared network setting is changed to produce that transition.

Validate replication, authorization, and confidentiality separately

NOTIFY can prompt an earlier check, while periodic refresh provides another opportunity to detect a newer serial. Neither makes replication instantaneous. Monitor each authoritative server’s serial and actual answer data, and investigate transfer failures before expiry removes service. When repairing a serial mistake, ensure the secondary receives the intended complete state rather than assuming that any subsequent incremental update will repair arbitrary divergence.

IXFR can save work when a suitable change history exists, but the request type does not guarantee an incremental response. AXFR can span multiple DNS messages over TCP, so complete-transfer verification must respect its protocol boundaries. A partial stream or a single matching record is insufficient evidence that the entire zone arrived and can be served correctly.

TSIG authenticates messages using shared key material and protects integrity; it does not encrypt the zone contents. Protect the key and apply transport confidentiality where the deployment requires it. Keep transfer authorization, successful replication, ordinary query availability, and replica expiry as distinct checks. Together they establish the practical boundary far more clearly than an assumption that transfers only happen between trusted servers.

Sources

RFC 5936 AXFR, full-zone transfer framing and completion, checked 2026-09-12.
RFC 1995 IXFR, incremental requests and full-transfer fallback, checked 2026-09-12.
RFC 1982 serial number arithmetic, 32-bit DNS serial comparisons and wraparound, checked 2026-09-12.
RFC 8945 TSIG, shared-key message authentication and integrity, checked 2026-09-12.
BIND 9.18.49 reference, transfer ACLs, notification, and secondary refresh controls, checked 2026-09-12.

DoT and DoH protect the connection to the resolver you authenticate

Thu, 07 Oct 2027 00:00:00 +0000

DNS over TLS and DNS over HTTPS protect DNS traffic on the encrypted connection between their endpoints. For a typical client, that connection ends at the selected resolver. The resolver can read the question and answer, and its later queries may follow different transports. Encrypting this hop does not automatically encrypt every recursive exchange or make the resolver unable to log the names it handles.

Read the encryption boundary and the authentication evidence separately. Ports 853/443 are normal protocol choices; 8531/8443 belong to the article’s loopback fixture. Its certificate-failure diagnostics override an exit code of zero. This is source-based illustration only: the encrypted-DNS runtime review remains pending, and the exercise was not rerun.

When it breaks

An encrypted socket without the intended certificate validation can connect to the wrong endpoint. Verify both the certificate’s trust chain and the resolver identity expected by the client. A successful handshake alone does not prove those checks were enabled. Configuration that silently uses a different resolver or a plaintext path on failure also changes the privacy contract and must be understood through the actual caller.

DoH uses HTTPS, but port 443 does not make its traffic unidentifiable, unblockable, or indistinguishable in every network. Destination addresses, connection timing, and other metadata remain observable. TLS termination points can inspect plaintext HTTP. Choose a resolver and transport policy with those boundaries in mind rather than assuming that an HTTPS URL removes every source of DNS-related information exposure.

The two protocols also have different message framing. DoT normally uses port 853 and carries DNS messages with the TCP two-byte length prefix inside TLS. DoH normally uses an HTTPS endpoint on port 443. Standard DoH carries DNS wire-format messages using application/dns-message; POST places the message in the body, while GET uses a base64url-encoded dns parameter. It is not defined as arbitrary JSON over HTTPS.

Check it quickly

Save this as check-encrypted-dns.py and run python3 check-encrypted-dns.py with Docker. The pinned BIND 9.18.49 environment supports DoT and DoH through its linked TLS and HTTP/2 libraries. The script creates a disposable certificate, trusts it explicitly for successful probes, and uses isolated loopback ports 8531 and 8443. It does not install a new host-wide trust anchor:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
import socket,ssl,struct
def exact(stream,count):
 data=b''
 while len(data)<count:
 more=stream.recv(count-len(data));assert more,'unexpected EOF';data+=more
 return data
with TemporaryDirectory(prefix='xbcatm-dot-') as directory:
 root=Path(directory);certificate=root/'certificate.pem';key=root/'key.pem'
 run('openssl','req','-x509','-newkey','rsa:2048','-nodes','-days','2','-subj','/CN=resolver.lab.test',
 '-addext','subjectAltName=DNS:resolver.lab.test,IP:127.0.0.1','-keyout',str(key),'-out',str(certificate))
 zone=root/'zone';zone.write_text('$ORIGIN lab.test.\n$TTL 30\n@ IN SOA ns.lab.test. hostmaster.lab.test. (1 60 60 3600 30)\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\nservice IN A 127.0.0.2\n')
 config=f'''tls local-tls {{ key-file "{key}"; cert-file "{certificate}"; }};
http local-http {{ endpoints {{ "/dns-query"; }}; }};
options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}};
listen-on port 8531 tls local-tls {{127.0.0.1;}};
listen-on port 8443 tls local-tls http local-http {{127.0.0.1;}};
listen-on-v6 {{none;}}; recursion no; dnssec-validation no; notify no;
pid-file "{root}/named.pid"; session-keyfile none; max-cache-size 8m; }};
controls {{}}; zone "lab.test" {{ type primary; file "{zone}"; }};
'''
 with named_process(root,config):
 context=ssl.create_default_context(cafile=str(certificate));context.set_alpn_protocols(['dot'])
 with socket.create_connection(('127.0.0.1',8531),timeout=2) as raw,context.wrap_socket(raw,server_hostname='resolver.lab.test') as stream:
 q=dns.message.make_query('service.lab.test.','A');wire=q.to_wire();stream.sendall(struct.pack('!H',len(wire))+wire)
 count=struct.unpack('!H',exact(stream,2))[0];response=dns.message.from_wire(exact(stream,count))
 assert response.id==q.id and values(response)==['127.0.0.2'];tls_version=stream.version();alpn=stream.selected_alpn_protocol()
 failures={}
 for name,ctx,hostname in [('untrusted',ssl.create_default_context(),'resolver.lab.test'),('wrong_name',context,'different.lab.test')]:
 try:
 with socket.create_connection(('127.0.0.1',8531),timeout=2) as raw,ctx.wrap_socket(raw,server_hostname=hostname):pass
 raise AssertionError('certificate validation unexpectedly succeeded')
 except ssl.SSLCertVerificationError as error:failures[name]=error.verify_code
 https={}
 for mode in ('https-get','https-post'):
 output=run('dig','@127.0.0.1','-p','8443','service.lab.test.','A','+'+mode,'+tls-ca='+str(certificate),
 '+tls-hostname=resolver.lab.test','+short','+tries=1','+time=2').stdout
 assert output.strip()=='127.0.0.2',output;https[mode]=output.strip()
 doh_rejections={}
 for label,verification in [('untrusted',['+tls-ca','+tls-hostname=resolver.lab.test']),
 ('wrong_name',['+tls-ca='+str(certificate),'+tls-hostname=different.lab.test'])]:
 rejected=run('dig','@127.0.0.1','-p','8443','service.lab.test.','A','+https-get',*verification,'+short','+tries=1','+time=2',check=False)
 diagnostic=rejected.stdout+rejected.stderr
 assert 'TLS peer certificate verification' in diagnostic and 'failed:' in diagnostic,(label,diagnostic)
 assert not re.search(r'^127\.0\.0\.2$',diagnostic,re.M)
 doh_rejections[label]={'exit':rejected.returncode,'diagnostic':diagnostic.strip(),'no_DNS_answer':True}
 wrong_path=run('dig','@127.0.0.1','-p','8443','service.lab.test.','A','+https=/wrong',
 '+tls-ca='+str(certificate),'+tls-hostname=resolver.lab.test','+tries=1','+time=2',check=False)
 assert wrong_path.returncode!=0
 print(json.dumps({'DoT':{'answer':values(response),'TLS_version':tls_version,'ALPN':alpn},'certificate_rejections':failures,
 'DoH_verified_TLS':https,'DoH_certificate_rejections':doh_rejections,'wrong_DoH_path_exit':wrong_path.returncode,
 'wrong_DoH_path_diagnostic':wrong_path.stdout+wrong_path.stderr},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The Python DoT client authenticates resolver.lab.test, negotiates TLS 1.3 with ALPN dot in the recorded run, and sends a length-prefixed DNS question. It reads the complete framed response, verifies the message ID, and receives A 127.0.0.2 for service.lab.test. Supplying the loopback connection address separately from the expected TLS hostname keeps endpoint location and authenticated identity explicit.

Two DoT controls fail certificate verification: using the system trust store without the disposable certificate, and requesting a different hostname while trusting that certificate. These failures demonstrate both trust and name checks. The test catches the specific certificate-verification exception; it does not classify an arbitrary socket failure as successful proof that certificate validation worked.

For DoH, dig performs HTTPS GET and POST queries against /dns-query with explicit CA and hostname validation. Both return 127.0.0.2. The untrusted-certificate and wrong-hostname controls emit certificate-verification errors without a DNS answer, despite exiting zero in this version. The assertions inspect those diagnostics instead of trusting exit status. Querying /wrong with valid trust settings also fails: authenticated HTTPS still needs the correct endpoint path.

The bad-path diagnostic is a failed exchange, not NXDOMAIN and not evidence that service.lab.test disappeared. This example does not extract a specific HTTP status from that diagnostic. It preserves the distinction between transport or endpoint failure and a completed DNS response carrying a DNS response code, preventing a generic command failure from being reported as an authoritative negative answer.

Keep the resolver and bootstrap configuration visible

A client needs an address for its encrypted resolver before it can connect. Deployments can provide bootstrap addresses or another documented discovery path. The fixture supplies loopback directly, avoiding a circular dependency on the same resolver. In production, verify how bootstrap, certificate renewal, endpoint changes, and connection failures behave for the client implementation actually in use.

Check whether application queries traverse the configured encrypted connection. Other processes may use the operating system’s resolver, another browser setting, or cached data. One successful DoH command demonstrates that command’s path, not a machine-wide policy. Observe the intended applications and their failure behavior before claiming that all their name lookups receive the same transport protection.

Finally, DNSSEC and encrypted DNS address different properties. DNSSEC can authenticate signed DNS data through a trust chain; TLS protects and authenticates the selected transport endpoint. Neither mechanism automatically supplies the other’s guarantee. Use both where the service contract requires them, and keep evidence for certificate validation, actual encrypted queries, resolver trust, and DNS-data validation distinct.

Sources

RFC 7858 DNS over TLS, TLS transport, dedicated port, and connection framing, checked 2026-09-12.
RFC 8484 DNS over HTTPS, DoH GET and POST mapping and application/dns-message, checked 2026-09-12.
BIND 9.18.49 tools, dig encrypted transports and explicit certificate validation, checked 2026-09-12.

A CNAME changes DNS resolution while the requested hostname stays the same

Fri, 09 Jul 2027 00:00:00 +0000

A CNAME record associates an alias name with another DNS name. When resolving an address through that alias, a resolver follows the target until it obtains the requested data or encounters a failure. This lets a public hostname remain stable while its DNS dependency changes. It does not redirect a browser to another URL or replace the application’s requested hostname.

When it breaks

An alias can resolve perfectly while the destination serves the wrong website. HTTP still identifies the original hostname, and HTTPS certificate verification is tied to the requested service identity. Configuring only the target’s virtual host or certificate is insufficient. DNS supplies an address path; the selected server must also accept the hostname that users and applications actually request.

A CNAME cannot coexist with ordinary A, AAAA, TXT, or other data at the same owner name. DNSSEC-related metadata has specific exceptions, but those do not make a CNAME plus an A record valid. The ordinary zone apex already requires SOA and NS data, so placing a conventional CNAME there conflicts with those requirements. Provider alias-flattening features need their own documented semantics.

Chains can terminate at missing data or form loops. Each dependency also has its own lifetime and administrative boundary. Shortening an alias TTL does not shorten a target address already cached under a different RRset. Nor does every extra alias require another network round trip: a server may include several chain records in one answer, or the resolver may already have them cached.

Resolve the alias; preserve its identity. Static illustration of the source and its limits. Reported fixture outcomes were not rerun for this graphic.

Check it quickly

Save this as check-cname.py and run python3 check-cname.py with Docker. The pinned environment uses BIND 9.18.49, dnsmasq 2.90, and a small HTTP server. All DNS names belong to an isolated test zone. Resolver configuration changes and candidate zone files stay inside the disposable container; no public domain or host resolver is modified:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,threading
records='alias 9 IN CNAME middle.lab.test.\nmiddle 12 IN CNAME target.lab.test.\ntarget 20 IN A 127.0.0.1\nloop-a 9 IN CNAME loop-b.lab.test.\nloop-b 9 IN CNAME loop-a.lab.test.'
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=json.dumps({'host':self.headers['Host'],'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
with lab(records) as (root,update,cache,queries),ThreadingHTTPServer(('127.0.0.1',0),Handler) as server:
 chain=query('alias.lab.test.');assert values(chain)==['127.0.0.1']
 assert values(chain,'CNAME')==['middle.lab.test.','target.lab.test.']
 assert [r.ttl for r in chain.answer]==[9,12,20]
 invalid={}
 for case,addition in [('same_owner','alias IN A 127.0.0.2'),('apex','@ IN CNAME target.lab.test.')]:
 candidate=root/(case+'.zone');candidate.write_text((root/'zone').read_text()+addition+'\n')
 checked=run('named-checkzone','lab.test',str(candidate),check=False)
 assert checked.returncode!=0 and 'CNAME and other data' in checked.stdout+checked.stderr
 invalid[case]={'returncode':checked.returncode,'diagnostic':'CNAME and other data'}
 seen=set();name='loop-a.lab.test.';hops=[]
 while name not in seen:
 seen.add(name);answer=query(name,'CNAME');target=values(answer,'CNAME')[0];hops.append([name,target]);name=target
 assert len(hops)==2 and name=='loop-a.lab.test.'
 cache(port=53)
 Path('/etc/resolv.conf').write_text('nameserver 127.0.0.1\noptions timeout:1 attempts:1\n')
 nss=Path('/etc/nsswitch.conf');nss.write_text(re.sub(r'^hosts:.*$','hosts: dns',nss.read_text(),flags=re.M))
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
 try:
 client=http.client.HTTPConnection('alias.lab.test',server.server_port,timeout=2)
 client.request('GET','/original');response=client.getresponse();body=json.loads(response.read());client.close()
 assert response.status==200 and body=={'host':'alias.lab.test:'+str(server.server_port),'path':'/original'}
 print(json.dumps({'chain':show(chain),'invalid_candidates':invalid,'loop_detected_by_client':hops,'HTTP':body,'HTTP_status':response.status},sort_keys=True))
 finally:server.shutdown();thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The address query for alias.lab.test returns two CNAME records followed by an A record: alias points to middle, middle points to target, and target has 127.0.0.1. Their respective TTLs are 9, 12, and 20 seconds. This single authoritative response contains the complete local chain, so the example does not claim that its two aliases necessarily cost two additional DNS exchanges.

Two separate candidate zones demonstrate invalid combinations. One adds an A record at the alias owner; the other adds a CNAME at the zone apex. named-checkzone rejects both with “CNAME and other data.” These candidates never replace the running valid zone. Syntax and data validation therefore establish the configuration restriction without making a failed candidate look like a successfully activated change.

A second pair of aliases points in a circle. The example client queries each CNAME explicitly, remembers visited names, and detects the repeat after two hops. This is a bounded demonstration of the loop itself. It is not a measurement of every recursive resolver’s timeout, retry count, or chosen error response when presented with that same dependency cycle.

Finally, Python’s HTTP client requests alias.lab.test through the container’s normal name-resolution path. The server reports Host alias.lab.test with its temporary port and path /original, returning status 200. The client is not manually told to substitute the target hostname. The result demonstrates address resolution through the chain while preserving the original HTTP service identity and request path.

Move the dependency and preserve the service contract

Before switching an alias, provision the destination to serve the original hostname, including routing and certificates where applicable. Verify both address families and any provider-specific domain ownership checks. An alias into an external service also depends on that service retaining the intended resource; a dangling target is an ownership and availability concern, not a harmless unused name.

Plan the change around all relevant cached RRsets. Updating the alias target and updating the old target’s address are different operations. Observe authoritative answers, recursive answers, and actual application traffic so a cached link in the chain is distinguishable from a misconfigured destination. Retain the old endpoint for the overlap your migration requires rather than assuming the stable public spelling makes the transition instantaneous.

Keep the chain understandable, with a named owner for each dependency and explicit checks for missing targets and cycles. Use an HTTP redirect when changing the URL presented to the client is the intended behavior. Use CNAME when the DNS alias relationship is the intended behavior, and validate the application separately after that relationship successfully resolves.

Sources

RFC 1034 domain names, alias processing, canonical names, and loop handling, checked 2026-09-12.
RFC 2181 DNS clarifications, CNAME coexistence constraints and RRset TTL rules, checked 2026-09-12.
BIND 9.18.49 tools, validating candidate zone data with named-checkzone, checked 2026-09-12.

Multiple DNS addresses do not guarantee balanced or healthy traffic

Tue, 06 Jul 2027 00:00:00 +0000

Several A or AAAA records at one name provide an address set. A DNS server may rotate the order it returns, but the receiving resolver and application decide how to use that set. Ordinary address records contain no request-load measurement or application-health result. Their presence alone does not promise equal traffic, automatic failover, or even a particular first address across implementations.

Rotating an address set does not schedule application requests or detect peer health. The article’s saved selection creates twelve requests to one peer; recovery requires explicit client retry. These are illustrated observations, not a new runtime test.

When it breaks

DNS answer distribution and application request distribution have different denominators. One recursive resolver can serve many clients from a cached answer, and one application can issue thousands of requests after a single lookup. Connection pooling makes that separation even stronger. Even perfectly alternating first addresses in authoritative replies can coexist with highly unequal request counts at the actual servers.

A failed peer remains in an ordinary static RRset until DNS data changes or another system changes it. The DNS server does not learn application health simply by returning the address. Some clients try an alternate address after connection failure; others exhaust their deadline or expose the failure immediately. Retry behavior is a property to verify for the specific client and operation.

Describing the mechanism as a guaranteed coin flip is also inaccurate. Ordering can be configured, randomized, retained by a cache, or changed by address-selection policy. Clients may select the first address, race attempts, or reuse a prior choice. An observed distribution therefore needs the DNS configuration, resolver behavior, connection reuse, and workload alongside the server-side request counts.

Check it quickly

Save this as check-dns-addresses.py and run python3 check-dns-addresses.py with Docker. The pinned environment uses BIND 9.18.49 with rrset-order explicitly set to cyclic. Two real HTTP listeners bind separate loopback addresses on the same temporary port inside an isolated container. Their response bodies identify the listener that actually served each request:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,threading
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=self.server.server_address[0].encode();self.server.hits+=1
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
def request(address,port):
 connection=http.client.HTTPConnection(address,port,timeout=.5)
 try:
 connection.request('GET','/');response=connection.getresponse();assert response.status==200;return response.read().decode()
 finally:connection.close()
with lab('pool 30 IN A 127.0.0.2\npool 30 IN A 127.0.0.3',extra='rrset-order { order cyclic; };') as (_,update,cache,queries):
 servers=[];threads=[]
 try:
 for address in ['127.0.0.2','127.0.0.3']:
 server=ThreadingHTTPServer((address,0 if not servers else servers[0].server_port),Handler);server.hits=0
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start();servers.append(server);threads.append(thread)
 port=servers[0].server_port;orders=[values(query('pool.lab.test.')) for _ in range(6)]
 assert all(set(order)=={'127.0.0.2','127.0.0.3'} for order in orders)
 assert {tuple(order) for order in orders}=={('127.0.0.2','127.0.0.3'),('127.0.0.3','127.0.0.2')}
 saved=values(query('pool.lab.test.'));selected=saved[0]
 hits=[request(selected,port) for _ in range(12)];assert hits==[selected]*12
 distribution={s.server_address[0]:s.hits for s in servers};assert sorted(distribution.values())==[0,12]
 victim=next(s for s in servers if s.server_address[0]==selected);victim.shutdown();victim.server_close()
 still_published=values(query('pool.lab.test.'));assert selected in still_published
 try:request(selected,port);raise AssertionError('stopped HTTP server accepted a connection')
 except OSError as error:failure=type(error).__name__
 alternate=next(a for a in saved if a!=selected);assert request(alternate,port)==alternate
 print(json.dumps({'cyclic_answer_orders':orders,'one_lookup_twelve_requests':distribution,'after_peer_stopped':still_published,
 'selected_address_error':failure,'explicit_alternate_succeeded':alternate},sort_keys=True))
 finally:
 for server in servers:server.shutdown();server.server_close()
 for thread in threads:thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Six direct queries for pool.lab.test return the same two addresses, 127.0.0.2 and 127.0.0.3, in alternating order in the recorded run. Every answer includes the complete set. The assertion checks both membership and observed order changes. This establishes the configured behavior of this authoritative server; it does not claim that all DNS servers or recursive caches must preserve that order.

The example then performs one additional lookup, saves the returned list, and uses its first address for twelve HTTP requests. All twelve reach that selected listener, producing a 12:0 distribution. Each request establishes its own HTTP connection, so this imbalance does not require connection pooling. Retaining one DNS selection across multiple connections is enough to separate answer rotation from request balancing.

Next, the selected listener is stopped and its socket closed. A fresh authoritative DNS query still includes its address because the zone has not changed. A connection to that peer fails with ConnectionRefusedError in the recorded environment. The program explicitly selects the other saved address and receives a successful response, demonstrating an available alternate without attributing that choice to DNS itself.

Choose the balancing and failure contract explicitly

If simple address distribution is sufficient, keep all advertised peers capable of serving the hostname and the expected workload. Monitor each peer directly as well as the aggregate name. A successful request through one address cannot establish the health of every other advertised address, especially when the client silently tries alternatives and hides the first failure from the caller.

If a DNS provider removes unhealthy addresses, account for the separate detection delay and previously cached answers. Health-driven DNS changes improve future discovery but do not revoke old answers or move established connections. Keep a defined client retry policy and migration overlap where required. Lowering TTL changes the caching tradeoff; it does not turn DNS into an application-level scheduler.

When per-request routing, capacity weights, or bounded failover behavior is required, evaluate an appropriate load balancer and its actual health and retry settings. That choice brings its own operational responsibilities. The useful comparison is between observable contracts, not between a supposedly random DNS mechanism and a supposedly infallible proxy. Measure which peer served requests and what users experienced when one peer stopped.

Finally, remember that address records of the same name, class, and type form an RRset and should share one TTL. Assigning different lifetimes to individual members is not a sound way to express weights. Use a supported policy with defined semantics, and validate distribution under realistic resolver sharing and connection reuse before making promises about how evenly traffic will spread.

Sources

RFC 2181 DNS clarifications, complete RRsets and equal TTLs within a set, checked 2026-09-12.
BIND 9.18.49 reference, rrset-order and configured cyclic answer order, checked 2026-09-12.
RFC 1034 domain names, resolver behavior and cached resource records, checked 2026-09-12.

SRV discovery gives clients targets and ports that they must interpret

Sat, 13 Mar 2027 00:00:00 +0000

An SRV record describes a service target using priority, weight, port, and a target hostname. Its owner normally combines a service label, transport label, and domain, such as _echo._tcp.lab.test. A client that understands that service can query SRV, obtain target addresses through A or AAAA, and connect to the advertised port. Ordinary hostname lookup does not automatically perform this application-specific discovery sequence.

Priority chooses the reachable tier; weight operates within a tier. The article uses one target per tier, so its failover demonstrates client handling, not equal-priority weighted selection or DNS health removal.

When it breaks

Publishing SRV does not make every existing client use it. The application needs a defined service label and supported discovery behavior. A browser or library expecting an ordinary hostname and configured port may never ask for SRV. A successful DNS response to a manual SRV query therefore cannot establish that the application’s endpoint selection has changed or that redeploying configuration is now unnecessary.

Priority and weight are not interchangeable. Lower numeric priority is preferred among reachable targets. Weight influences selection among records with the same priority; a large weight on a higher-priority-number backup does not override an available lower-numbered target. Simply sorting every record by weight or selecting the first wire-order entry can reverse the service owner’s intended primary and backup relationship.

Discovery also does not prove health. A target can remain published after its listener stops, and cached SRV and address RRsets have independent lifetimes. A client must apply connection deadlines and appropriate retry behavior. Retrying a read after connection refusal is different from repeating an operation whose side effects might already have occurred, so endpoint failover must remain consistent with the application protocol.

Check it quickly

Save this as check-srv-discovery.py and run python3 check-srv-discovery.py with Docker. The pinned BIND 9.18.49 environment publishes a test _echo._tcp service. Two real HTTP listeners provide identifiable read-only responses on different temporary ports. HTTP is used as the fixture’s observable payload; the example is a custom SRV-aware client, not a claim that generic HTTP clients implement this service label:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,threading
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=self.server.identity.encode();self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
servers=[];threads=[]
try:
 for identity in ('primary','backup'):
 server=ThreadingHTTPServer(('127.0.0.1',0),Handler);server.identity=identity
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start();servers.append(server);threads.append(thread)
 records=f'''_echo._tcp 30 IN SRV 10 1 {servers[0].server_port} first.lab.test.
_echo._tcp 30 IN SRV 20 65535 {servers[1].server_port} second.lab.test.
_absent._tcp 30 IN SRV 0 0 0 .
first 30 IN A 127.0.0.1
second 30 IN A 127.0.0.1'''
 with lab(records) as (_,update,cache,queries):
 srv=query('_echo._tcp.lab.test.','SRV');entries=sorted(srv.answer[0],key=lambda r:r.priority)
 assert [r.priority for r in entries]==[10,20] and [r.weight for r in entries]==[1,65535]
 def discover():
 attempts=[]
 for record in entries:
 addresses=values(query(str(record.target)))
 for address in addresses:
 client=http.client.HTTPConnection(address,record.port,timeout=.5)
 try:
 attempts.append(str(record.target));client.request('GET','/');response=client.getresponse();body=response.read().decode()
 assert response.status==200;return {'identity':body,'attempted_targets':attempts,'selected_port':record.port}
 except OSError:continue
 finally:client.close()
 raise AssertionError('all service endpoints failed')
 first=discover();assert first['identity']=='primary' and first['attempted_targets']==['first.lab.test.']
 servers[0].shutdown();servers[0].server_close()
 assert len(query('_echo._tcp.lab.test.','SRV').answer[0])==2
 failed_over=discover();assert failed_over['identity']=='backup' and len(failed_over['attempted_targets'])==2
 absent=query('_absent._tcp.lab.test.','SRV');assert str(absent.answer[0][0].target)=='.'
 ordinary=query('lab.test.','A');assert ordinary.rcode()==0 and not ordinary.answer
 print(json.dumps({'SRV':show(srv),'healthy_selection':first,'after_primary_stopped':failed_over,
 'ordinary_A_lookup':show(ordinary),'unavailable_service':show(absent)},sort_keys=True))
finally:
 for server in servers:server.shutdown();server.server_close()
 for thread in threads:thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The first target has priority 10 and weight 1; the backup has priority 20 and weight 65535. Each advertises its actual listener port, and both target names resolve to loopback. The client reads SRV, orders these distinct priority groups, resolves each target, and connects using the record’s port. With both listeners healthy, it reaches only the first target and receives the primary identity.

The program stops the primary listener while leaving DNS unchanged. A fresh SRV query still contains both records. Reusing the previously discovered candidate set, the client attempts the primary, encounters connection failure, and then successfully contacts the backup. The result records both attempted names and the selected port. DNS did not remove the failed target; the client’s connection handling performed the transition.

A separate service has one SRV record whose target is the root name, .. RFC 2782 defines that form as explicit service unavailability at the domain, so it is not an instruction to resolve the root and connect there. Meanwhile, an ordinary A query for lab.test returns no address despite the _echo._tcp records being present. The query type and discovery name are part of the contract.

Match the client algorithm to the published record set

This fixture intentionally has one target per priority group. Its priority ordering is sufficient for those records and does not implement weighted ordering among equal-priority peers. A general client needs the complete selection behavior appropriate to its protocol, including equal-priority weights and the unavailable-service case. Test those branches with the actual library rather than assuming an SRV-capable label implies full conformance.

SRV targets should name hosts with address records and must not be aliases under RFC 2782’s rules. Check the target’s A and AAAA data, port listener, and required service identity. A returned address alone does not verify TLS certificates, authentication, or application readiness. Some protocols define additional discovery records or identity rules; their documented behavior takes precedence over a generic example’s convenient layout.

Refresh discovery according to the relevant cache lifetimes and deployment policy. Changing SRV does not withdraw a cached target, and changing a target address does not modify an already established connection. During planned removal, account for retained candidates and drain existing work. Observe authoritative publication, resolver answers, and actual connection attempts to distinguish stale discovery from a reachable server rejecting the application operation.

Keep ownership of service labels and update permissions explicit. DNS-based discovery can reduce hard-coded endpoint configuration, but it shifts responsibility into records and client selection logic. Verify a normal request, a failed preferred endpoint, and the resulting alternate connection. Those observations demonstrate the useful behavior more directly than merely confirming that a service record exists in a zone file.

Sources

RFC 2782 DNS SRV records, priority, weight, port, target, and explicit service unavailability, checked 2026-09-12.
RFC 1035 domain names, address records and DNS caching, checked 2026-09-12.
BIND 9.18.49 reference, authoritative zone data and service records, checked 2026-09-12.

Useful hostnames distinguish local identity, service names, and lookup scope

Tue, 01 Dec 2026 00:00:00 +0000

A useful name gives people and software a reference they can carry across an address change. That reference needs a defined scope and owner. A machine’s local hostname, a service’s DNS name, and an instance identifier may intentionally differ. Naming them clearly helps operators understand logs and deployments without pretending that one label automatically establishes every other identity in the system.

When it breaks

Setting a local hostname does not, by itself, publish an A or AAAA record in an authoritative zone. Registration may be performed by separate provisioning or network-management software, but it must actually exist. Conversely, changing a DNS address does not rename the local kernel hostname. Confusing these operations produces servers whose local label looks correct while clients cannot discover the intended service.

Short names depend on lookup context. service can resolve differently under two search domains even when both machines appear to use normal DNS settings. A copied runbook command may therefore reach a different environment from the one its author tested. Use the complete intended DNS name in configuration when ambiguity matters, and preserve the context that explains short names in interactive use.

Human meaning also has limits. A name such as app-prod-01 can suggest role, environment, and instance, but it is not authoritative evidence of permissions, ownership, or current workload. Reusing an old instance name can confuse historical logs. Keep stable service names separate from replacement-machine identity when their lifetimes differ, and attach operational metadata instead of trying to encode every changing fact in the hostname.

A short name inherits lookup context. Static illustration of the source and its limits. Reported fixture outcomes were not rerun for this graphic.

Check it quickly

Save this as check-hostnames.py and run python3 check-hostnames.py with Docker. The pinned environment uses BIND 9.18.49, dnsmasq 2.90, and Python 3.11. The container’s resolver and NSS files are disposable. Forwarding cache is disabled for this exercise so the search-domain and address changes can be observed directly without waiting for a previous cached generation:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
import socket
records='service 30 IN A 127.0.0.2\nservice.branch 30 IN A 127.0.0.3\n_echo._tcp 30 IN SRV 0 0 8080 service.lab.test.'
with lab(records) as (root,update,cache,queries):
 cache(port=53,size=0)
 nss=Path('/etc/nsswitch.conf');nss.write_text(re.sub(r'^hosts:.*$','hosts: dns',nss.read_text(),flags=re.M))
 def search(domain):Path('/etc/resolv.conf').write_text('nameserver 127.0.0.1\nsearch '+domain+'\noptions timeout:1 attempts:1\n')
 def address(name):
 return json.loads(run('/usr/bin/python3','-c','import socket,json,sys;print(json.dumps(sorted({r[4][0] for r in socket.getaddrinfo(sys.argv[1],80,socket.AF_INET,socket.SOCK_STREAM)})))',name).stdout)
 local_name=socket.gethostname();unpublished=query(local_name+'.lab.test.');assert unpublished.rcode()==dns.rcode.NXDOMAIN
 lower=query('service.lab.test.');mixed=query('SeRvIcE.LaB.TeSt.');assert values(lower)==values(mixed)==['127.0.0.2']
 search('lab.test');first=address('service');absolute_first=address('service.lab.test.');assert first==absolute_first==['127.0.0.2']
 search('branch.lab.test');second=address('service');absolute_second=address('service.lab.test.');assert second==['127.0.0.3'] and absolute_second==first
 update(records.replace('service 30 IN A 127.0.0.2','service 30 IN A 127.0.0.4'));changed=address('service.lab.test.')
 assert changed==['127.0.0.4'] and socket.gethostname()==local_name
 invalid=root/'invalid.zone';invalid.write_text((root/'zone').read_text()+'bad_name IN A 127.0.0.1\n')
 check=run('named-checkzone','-k','fail','lab.test',str(invalid),check=False)
 assert check.returncode!=0 and 'bad owner name' in check.stdout+check.stderr
 assert values(query('_echo._tcp.lab.test.','SRV'),'SRV')==['0 0 8080 service.lab.test.']
 print(json.dumps({'local_hostname_published_in_zone':False,'case_insensitive_A':values(mixed),
 'short_name_by_search_domain':{'lab.test':first,'branch.lab.test':second},'absolute_name_unchanged_by_search':[absolute_first,absolute_second],
 'DNS_address_after_change':changed,'local_hostname_unchanged':True,'invalid_host_owner_rejected':check.returncode,'underscore_SRV_owner_accepted':True},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The script reads the container’s local hostname, then queries that label under lab.test. The authority returns NXDOMAIN because no corresponding zone record was published. The result illustrates the missing registration in this setup; it does not assert that every installation lacks hostname registration. Lowercase and mixed-case queries for service.lab.test both return 127.0.0.2, demonstrating ASCII DNS case-insensitive comparison.

With search domain lab.test, a fresh application’s lookup of service returns 127.0.0.2. Changing the search domain to branch.lab.test makes the same short input return 127.0.0.3. The absolute name service.lab.test. continues returning 127.0.0.2 in both contexts. The trailing root dot makes that test’s absolute DNS name explicit rather than relying on search-list behavior.

Next, the authority changes service.lab.test to 127.0.0.4. A fresh lookup sees that address while the local hostname remains unchanged. This verifies independence between the DNS mapping and local machine label. It does not prove that existing connections move or that other caches refresh immediately; those behaviors have separate lifetimes and are intentionally excluded from this cache-disabled comparison.

Finally, a candidate A owner named bad_name fails named-checkzone -k fail with a bad-owner-name diagnostic. The valid _echo._tcp SRV owner remains accepted and queryable. This separates strict host-address owner checks from the broader DNS namespace: underscores used for service labels do not imply that ordinary hostnames should follow the same naming rules or that every DNS label is a host label.

Choose names for the lifetime and audience they serve

Use a documented, predictable convention with enough meaning to help distinguish environments and instances. Keep sensitive or rapidly changing details out of publicly visible names. When replacing a machine behind a stable service name, update discovery and service configuration deliberately, retaining any required address overlap. The stable spelling helps callers, but working TLS, routing, and application state still need their own preparation.

Record fully qualified names alongside local hostnames in inventory and incident evidence. Preserve case for display if useful, but do not treat ASCII DNS names differing only by case as separate services. When joining datasets, normalize according to the identifier’s actual rules; an arbitrary application ID or a URL path may have different case semantics from its DNS hostname.

Check generated names before deployment against the rules of the systems that consume them. DNS labels, certificate identities, operating-system hostnames, and service-discovery labels are related but not interchangeable validation domains. A name that a kernel accepts is not automatically suitable as an ordinary internet hostname. Meaningful names work best when both their human interpretation and their technical scope remain explicit.

Sources

RFC 1123 Internet host requirements, preferred hostname syntax and host naming requirements, checked 2026-09-12.
RFC 4343 DNS case insensitivity, ASCII case-insensitive DNS comparison, checked 2026-09-12.
Python 3.11 socket documentation, gethostname and application address lookup, checked 2026-09-12.
RFC 2782: DNS SRV records, service and protocol labels deliberately use underscore prefixes, checked 2026-10-15.

DNS needs a working TCP path when a UDP answer is truncated

Thu, 19 Nov 2026 00:00:00 +0000

DNS supports both UDP and TCP. A server sets the TC flag when a response is truncated for the available message space. A client receiving that flag must handle the incomplete result, commonly by retrying over TCP. This is about the DNS response limit in use, not proof that the physical network cannot carry any larger UDP datagram.

TC marks an incomplete answer even when records are present. A working TCP path recovers the complete set; a UDP-only endpoint cannot. The article also demonstrates separate message framing and connection reuse, without encryption guarantees.

When it breaks

A network that permits UDP port 53 but blocks TCP port 53 can pass small lookups and fail larger ones. DNSSEC data and larger record sets make the difference visible, but TCP is not reserved for those cases. General-purpose DNS implementations need TCP support, and clients may choose it directly. A successful small UDP query therefore does not establish that the DNS service’s complete transport path works.

A truncated answer can still contain records. Ignoring TC and using those records as the complete set can omit valid destinations or other required data. NOERROR does not cancel the truncation flag. Capture the flags and complete question alongside answer counts, especially when an application appears to see fewer records than a direct authoritative query through a different transport.

TCP also does not remove all DNS message-size limits. Each DNS message on a TCP stream is preceded by a two-byte length, which limits that message to 65,535 bytes. A zone transfer can use multiple DNS messages. Stream reads may split either the length prefix or the message, so code must read the required number of bytes rather than assuming one recv call returns a whole answer.

Check it quickly

Save this as check-dns-tcp.py and run python3 check-dns-tcp.py with Docker. The pinned BIND 9.18.49 environment serves a four-record TXT set inside an isolated container. The initial query explicitly disables EDNS to exercise the traditional 512-byte UDP limit. Later stages use a real TCP connection and a deliberately UDP-only relay:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
import dns.flags,socket,struct,threading
texts=[f'{i}-'+('x'*200) for i in range(4)]
records='small 30 IN A 127.0.0.2\n'+'\n'.join('large 30 IN TXT "'+s+'"' for s in texts)
def exact(stream,size):
 data=b''
 while len(data)<size:
 part=stream.recv(size-len(data));assert part,'unexpected TCP EOF';data+=part
 return data
def description(response):return {'wire_bytes':len(response.to_wire()),'TC':bool(response.flags&dns.flags.TC),'answer_records':sum(len(rr) for rr in response.answer)}
with lab(records) as (_,update,cache,queries):
 q=dns.message.make_query('large.lab.test.','TXT',use_edns=False)
 udp=dns.query.udp(q,'127.0.0.1',port=1053,timeout=2)
 assert udp.flags&dns.flags.TC and len(udp.to_wire())<=512
 tcp=dns.query.tcp(q,'127.0.0.1',port=1053,timeout=2)
 assert not tcp.flags&dns.flags.TC and set(values(tcp,'TXT'))=={'"'+s+'"' for s in texts}
 assert len(tcp.to_wire())>512
 with socket.create_connection(('127.0.0.1',1053),timeout=2) as stream:
 lengths=[]
 for name,kind in [('large.lab.test.','TXT'),('small.lab.test.','A')]:
 request=dns.message.make_query(name,kind);wire=request.to_wire();stream.sendall(struct.pack('!H',len(wire))+wire)
 size=struct.unpack('!H',exact(stream,2))[0];reply=dns.message.from_wire(exact(stream,size));assert reply.id==request.id and reply.rcode()==0
 assert values(reply,kind);lengths.append(size)
 with socket.socket() as reservation,socket.socket(socket.AF_INET,socket.SOCK_DGRAM) as relay:
 reservation.bind(('127.0.0.1',0));port=reservation.getsockname()[1];relay.bind(('127.0.0.1',port));relay.settimeout(3)
 errors=[]
 def one_datagram():
 try:
 data,peer=relay.recvfrom(4096);answer=dns.query.udp(dns.message.from_wire(data),'127.0.0.1',port=1053,timeout=2);relay.sendto(answer.to_wire(),peer)
 except Exception as error:errors.append(type(error).__name__)
 thread=threading.Thread(target=one_datagram);thread.start()
 limited=dns.query.udp(q,'127.0.0.1',port=port,timeout=2);assert limited.flags&dns.flags.TC
 thread.join(timeout=4);assert not thread.is_alive() and not errors
 try:dns.query.tcp(q,'127.0.0.1',port=port,timeout=1);raise AssertionError('UDP-only endpoint unexpectedly accepted TCP')
 except OSError as error:failure=type(error).__name__
 print(json.dumps({'UDP':description(udp),'TCP':description(tcp),'two_messages_one_connection_lengths':lengths,
 'UDP_only_path':{'TC_received':True,'TCP_error':failure}},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The historical UDP result reserializes to 462 bytes, has TC set, and contains only two of the four TXT records. The TCP response is 892 bytes, has TC clear, and contains all four expected values. The script compares complete record contents. Its wire_bytes fields use len(response.to_wire()): reserialized DNS-message lengths, not captured packet lengths. The later reused-stream lengths instead come directly from TCP framing.

The program next opens one TCP connection and sends two DNS queries through it, first for the large TXT answer and then for a small A answer. It reads each two-byte length prefix and the corresponding message body, obtaining message lengths 892 and 48 in this run. It also checks response IDs. The same stream serves both exchanges, demonstrating that a fresh handshake is not required for every query.

A separate endpoint forwards one UDP question to the real authority and returns its truncated response. On that same endpoint number, a reserved but non-listening TCP socket prevents a TCP listener from existing. The UDP query succeeds with TC, while the TCP attempt fails with ConnectionRefusedError. This reproduces the transport mismatch without changing firewall rules or relying on an unrelated public resolver.

Diagnose truncation and connection failure separately

Check the response flags, advertised EDNS capacity if present, TCP connection result, and final DNS contents. A TC response followed by a refused connection has a different cause from an unanswered UDP packet or an authoritative NXDOMAIN. The relay is intentionally limited to one exchange; it is a controlled failure fixture, not a general DNS proxy implementation intended for deployment.

Permit the required TCP path through the client, resolver, server listener, and intervening access rules. Keep connection deadlines and resource limits appropriate to the resolver workload. Reuse can reduce repeated setup work, but idle connections, connection limits, and server behavior still matter. Do not convert the extra handshake observed for one new connection into a fixed latency surcharge for every TCP lookup.

EDNS can allow a larger UDP response and avoid truncation in many cases, but it does not eliminate the need for TCP. Larger datagrams can encounter path-MTU and fragmentation problems before the client ever receives a useful TC signal. Test the configured UDP size alongside a complete TCP exchange, and avoid treating an unusually large advertised payload as a substitute for a working second transport.

Finally, TCP provides a reliable byte stream, not DNS confidentiality or authenticated record data. Plain DNS over TCP remains plaintext. TLS-based DNS transport and DNSSEC address separate security properties. Keep those claims separate from this experiment, whose evidence establishes truncation handling, complete record recovery, stream framing, connection reuse, and a concrete failure when only UDP is available.

Sources

dnspython Message API, to_wire serializes DNS messages; the unchanged fixture measures its returned bytes, checked 2026-10-18.
RFC 7766 DNS over TCP, TCP support, connection reuse, and DNS transport requirements, checked 2026-09-12.
RFC 1035 domain names, TC, traditional UDP size, and two-byte TCP framing, checked 2026-09-12.
RFC 5936 AXFR, zone transfers spanning multiple DNS messages, checked 2026-09-12.

Dual-stack address ordering and successful connection choice are separate

Wed, 04 Nov 2026 00:00:00 +0000

Discovering A and AAAA records provides possible destinations. It does not select a successful connection by itself. Address ordering, source-address selection, routing, and the application’s connection algorithm all contribute. RFC 6724 describes default source and destination selection rules, while applications can impose their own choices. A program requesting only IPv4 has already narrowed the result before any dual-stack connection strategy can act.

When it breaks

Address preference is not an application-health probe. An IPv6 destination can look suitable according to local policy and routing even when its remote service is stopped or a later network hop drops traffic. The preferred candidate may therefore fail. Assuming that the operating system has already tested every returned endpoint can hide the need for connection deadlines and alternate-address handling.

RFC 6724’s rules are ordered comparisons, not a general score for cheapest or fastest network path. They consider properties such as usability, scope, policy labels, precedence, and matching prefixes. They do not measure application response time. Destination address selection must also be distinguished from a routing table’s longest-prefix match for sending packets after a destination has been chosen.

Happy Eyeballs is another layer. It coordinates discovery and staggered connection attempts to reduce delays when one family is problematic. A client that tries addresses sequentially is not automatically implementing that algorithm. Immediate connection refusal and a silently dropped connection attempt can produce very different waiting times, even if both clients eventually reach the same working IPv4 service.

The first candidate is a preference, not proof of service health. The pictured IPv6-first order belongs to the article’s local process. Its network example remains blocked and was not rerun for this draft.

Check it quickly

Save this as check-address-selection.py and run python3 check-address-selection.py with Docker. The pinned environment uses glibc 2.36 and Python 3.11, with BIND 9.18.49 and dnsmasq 2.90 supplying DNS. Two real HTTP listeners use IPv4 and IPv6 loopback on the same port. The fixture has no public network path, so its observed order is explicitly a local result:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import socket,threading
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=self.server.server_address[0].encode();self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
class V6Server(ThreadingHTTPServer):address_family=socket.AF_INET6
with lab('dual 30 IN A 127.0.0.1\ndual 30 IN AAAA ::1') as (_,update,cache,queries):
 cache(port=53)
 Path('/etc/resolv.conf').write_text('nameserver 127.0.0.1\noptions timeout:1 attempts:1\n')
 nss=Path('/etc/nsswitch.conf');nss.write_text(re.sub(r'^hosts:.*$','hosts: dns',nss.read_text(),flags=re.M))
 servers=[];threads=[]
 try:
 for server_class,address in [(ThreadingHTTPServer,'127.0.0.1'),(V6Server,'::1')]:
 server=server_class((address,0 if not servers else servers[0].server_port),Handler)
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start();servers.append(server);threads.append(thread)
 port=servers[0].server_port;v6=servers[1]
 def candidates(family=socket.AF_UNSPEC):return socket.getaddrinfo('dual.lab.test',port,family,socket.SOCK_STREAM)
 addresses=candidates();assert {r[0] for r in addresses}=={socket.AF_INET,socket.AF_INET6}
 assert addresses[0][0]==socket.AF_INET6
 assert {r[0] for r in candidates(socket.AF_INET)}=={socket.AF_INET}
 assert {r[0] for r in candidates(socket.AF_INET6)}=={socket.AF_INET6}
 def request():
 with socket.create_connection(('dual.lab.test',port),timeout=1) as stream:
 chosen={'family':stream.family.name,'peer':stream.getpeername()[0],'source':stream.getsockname()[0]}
 stream.sendall(b'GET / HTTP/1.0\r\nHost: dual.lab.test\r\n\r\n');data=b''
 while True:
 part=stream.recv(4096)
 if not part:break
 data+=part
 assert b' 200 ' in data.split(b'\r\n',1)[0] and data.endswith(chosen['peer'].encode());return chosen
 first=request();assert first['family']=='AF_INET6'
 v6.shutdown();v6.server_close();assert values(query('dual.lab.test.','AAAA'),'AAAA')==['::1']
 with socket.socket(socket.AF_INET6) as forced:
 forced.settimeout(1)
 try:forced.connect(('::1',port));raise AssertionError('closed IPv6 listener accepted a connection')
 except OSError as error:failure=type(error).__name__
 assert candidates()[0][0]==socket.AF_INET6
 second=request();assert second['family']=='AF_INET'
 print(json.dumps({'candidate_order':[{'family':socket.AddressFamily(r[0]).name,'address':r[4][0]} for r in addresses],
 'both_listeners_healthy':first,'forced_IPv6_after_stop':failure,'sequential_client_after_IPv6_stop':second,
 'AAAA_still_published':True},sort_keys=True))
 finally:
 for server in servers:server.shutdown();server.server_close()
 for thread in threads:thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

For dual.lab.test, getaddrinfo with AF_UNSPEC returns both ::1 and 127.0.0.1, with IPv6 first in the recorded environment. Separate calls restricted to AF_INET or AF_INET6 return only the requested family. These calls establish the actual candidate list used by this process rather than assuming that separate A and AAAA query outputs define a universal merged ordering.

With both listeners healthy, Python’s socket.create_connection connects to ::1. The program records both the selected peer and the local source address, then sends a real HTTP request and verifies the listener’s identifying response. This links candidate preference to an actual successful connection while keeping source address, destination address, and application response visible as distinct observations.

The IPv6 listener is then stopped and closed. DNS still publishes ::1, and getaddrinfo still puts IPv6 first. A forced IPv6 connection fails with ConnectionRefusedError. The normal Python connection helper nevertheless succeeds through 127.0.0.1 and receives the IPv4 listener’s response. Its sequential attempt behavior can reach a later working candidate without requiring the DNS order to change.

The refusal is immediate on this local path. The test does not inject a black hole, measure an internet fallback delay, or exercise a full Happy Eyeballs implementation. It demonstrates that local address preference can remain unchanged while service availability changes, and that the connection algorithm is responsible for turning that candidate list into an eventual success or failure.

Inspect the actual caller before changing host-wide policy

Check which family and flags the application asks getaddrinfo to use, whether its runtime caches results, and how it attempts the candidates. Some applications use different resolver libraries or implement their own connection racing. Reproducing a lookup with a command-line tool is useful only when the tool’s relevant choices match those of the failing process.

Observe selected source and destination addresses alongside connection timing and errors. A working DNS lookup followed by refusal suggests a different investigation from a timeout along the routed path. Test each advertised family through the actual service identity and protocol. A healthy IPv4 endpoint does not prove that the advertised IPv6 endpoint has matching routing, access rules, certificates, or application configuration.

Use policy changes deliberately when the deployment requires them, and verify their effect on real callers. RFC 6724 permits administrative policy, but that does not make a global preference change a substitute for repairing a broken advertised service. Likewise, removing AAAA changes future discovery while cached records and existing connections can persist. Plan those lifetimes alongside any endpoint change.

Treat the observed order as evidence for this host and process, not a guarantee for all clients. A complete diagnosis identifies the candidate set, local selection policy, attempted connections, and successful peer. Keeping those stages separate explains dual-stack behavior without inventing a promise that the first address is healthy or that every client races the two families.

Sources

RFC 6724 default address selection, source and destination selection rules and policy overrides, checked 2026-09-12.
RFC 8305 Happy Eyeballs version 2, staggered connection attempts across address families, checked 2026-09-12.
Python 3.11 socket documentation, getaddrinfo families and create_connection attempt behavior, checked 2026-09-12.

EDNS advertises UDP capacity without guaranteeing path delivery

Wed, 28 Oct 2026 00:00:00 +0000

EDNS extends DNS through an OPT pseudo-record. Among other information, a request can advertise the UDP payload size its sender is prepared to receive. This allows answers beyond the traditional 512-byte DNS limit. It is an advertisement within a DNS exchange, not a network path-MTU discovery protocol or a promise that every intervening device will deliver a datagram of that size.

The illustrated values are the article’s explicit loopback configuration and recorded DNS-message sizes, not universal defaults or a path-MTU measurement. OPT advertises capacity; the client must interpret TC and retain TCP access.

When it breaks

A client advertising 4096 bytes does not compel the server to send a 4096-byte response. The server can apply a smaller outgoing limit. If the required answer does not fit, it can return TC and the client still needs a working TCP path. Increasing the advertised number cannot fix a server policy that deliberately uses a smaller response budget.

Conversely, a response that fits the advertised capacity can still be lost along the path. Fragmentation, tunnels, packet filters, and local network constraints are separate from what the DNS participants advertise. If the client receives no response, it may never see a TC signal. Treat payload settings as an interoperability choice to verify, not a universal performance knob whose maximum value is always best.

EDNS also carries information that must not be mistaken for ordinary cached DNS data. OPT is a pseudo-record describing the exchange. Its fields encode such things as payload capacity, version, extended response code, and flags; its TTL-shaped field is not a normal record lifetime. The DNSSEC OK flag, DO, asks for relevant DNSSEC records but does not prove that anyone validated the answer.

Check it quickly

Save this as check-edns.py and run python3 check-edns.py with Docker. The pinned BIND 9.18.49 authority runs on isolated loopback networking. Its edns-udp-size and max-udp-size are explicitly set to 1232. The zone contains a medium TXT set with four records and a larger set with eight, allowing capacity and truncation to be observed independently:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
import dns.flags
records='\n'.join(f'{name} 30 IN TXT "{i}-'+('x'*200)+'"' for name,count in [('medium',4),('large',8)] for i in range(count))
def ask(name,payload=None,version=0,flags=0):
 q=dns.message.make_query(name+'.lab.test.','TXT',use_edns=False)
 if payload is not None:q.use_edns(edns=version,ednsflags=flags,payload=payload)
 return dns.query.udp(q,'127.0.0.1',port=1053,timeout=2)
def description(response):return {'wire_bytes':len(response.to_wire()),'TC':bool(response.flags&dns.flags.TC),
 'rcode':dns.rcode.to_text(response.rcode()),'EDNS_version':response.edns,'advertised_payload':response.payload,
 'DO':bool(response.ednsflags&dns.flags.DO),'AD':bool(response.flags&dns.flags.AD),'answer_records':sum(len(rr) for rr in response.answer)}
with lab(records,extra='edns-udp-size 1232; max-udp-size 1232;') as (_,update,cache,queries):
 classic=ask('medium');extended=ask('medium',1232);capped=ask('large',4096);do=ask('medium',1232,flags=dns.flags.DO);version=ask('medium',1232,version=1)
 assert classic.flags&dns.flags.TC and len(classic.to_wire())<=512 and classic.edns==-1
 assert not extended.flags&dns.flags.TC and 512<len(extended.to_wire())<=1232 and len(values(extended,'TXT'))==4
 assert extended.edns==0 and extended.opt is not None
 assert capped.flags&dns.flags.TC and len(capped.to_wire())<=1232
 assert do.ednsflags&dns.flags.DO and not do.flags&dns.flags.AD
 assert not any(rr.rdtype==dns.rdatatype.RRSIG for rr in do.answer)
 assert version.rcode()==dns.rcode.BADVERS and version.edns==0
 full=dns.query.tcp(dns.message.make_query('large.lab.test.','TXT'),'127.0.0.1',port=1053,timeout=2)
 assert len(values(full,'TXT'))==8 and len(full.to_wire())>1232
 print(json.dumps({'without_EDNS':description(classic),'EDNS_1232':description(extended),'client_4096_server_1232':description(capped),
 'DO_on_unsigned_zone':description(do),'unsupported_version':description(version),'TCP_full':description(full)},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Without EDNS, the medium query returns a 463-byte truncated response containing two TXT records. With an advertised payload of 1232, it returns all four records in 904 bytes with TC clear. The script checks membership count, reserialized message length, and EDNS presence. Its wire_bytes fields use len(response.to_wire()), not a captured datagram or IP-packet length; reserialization is not a byte-for-byte capture guarantee. This shows a concrete answer moving past the traditional limit while staying inside the selected UDP response budget.

For the larger set, the client advertises 4096 but the server remains capped at 1232. The recorded response is only 43 bytes with TC set and no answer records. A subsequent TCP query retrieves all eight records in 1752 bytes. A truncated reply need not fill the entire allowed buffer; record grouping and response construction can produce a much smaller signal that more data is needed.

The program also sets DO on a query to this unsigned zone. The response preserves DO, but has no RRSIG and no authenticated-data AD flag. That combination is expected: requesting DNSSEC-related data cannot manufacture signatures or a chain of trust. The example records the flags separately rather than labeling a DO-bearing exchange as a successful DNSSEC validation.

Finally, a query advertises EDNS version 1. This server returns BADVERS and indicates supported version 0. The library decodes the extended response code from the complete message. This negative test distinguishes unsupported EDNS version from an absent name or an ordinary successful empty answer, and demonstrates why diagnostics must retain OPT information when interpreting extension-related failures.

Measure the configured exchange rather than assuming a default

Record the actual client advertisement, server configuration, response size, flags, and transport. Different software versions and operators choose different payload values; neither 1232 nor 4096 is a universal default guaranteed by the standard. The fixture’s 1232 value is an explicit test configuration. Its loopback results do not measure fragmentation, a remote path’s MTU, or public resolver performance.

When diagnosing large-answer failures, compare a small query, a larger EDNS query, and a full TCP query through the same intended endpoint. Keep error categories separate: TC requests completion through another exchange, BADVERS reports extension-version disagreement, and a timeout does not identify which network component lost a packet. Preserve enough of the reply to avoid collapsing those distinct failures into “DNS is down.”

Use the deployment’s supported sizing and retry policy, then validate from the networks that matter to clients. Retain TCP access even when most observed answers fit in UDP. EDNS improves extensibility and can reduce some truncation retries, but complete delivery still depends on transport behavior, server limits, and client handling of the answer actually received.

Sources

dnspython Message API, to_wire serializes DNS messages; the unchanged fixture measures its returned bytes, checked 2026-10-18.
RFC 6891 extension mechanisms for DNS, OPT, payload advertisement, extended errors, and EDNS version handling, checked 2026-09-12.
RFC 7766 DNS over TCP, TCP remains a required DNS transport, checked 2026-09-12.
BIND 9.18.49 reference, edns-udp-size and max-udp-size configuration, checked 2026-09-12.

Negative DNS answers preserve absence until their cache lifetime expires

Thu, 22 Oct 2026 00:00:00 +0000

DNS can return useful information by saying that data is absent. NXDOMAIN reports a name error; NODATA describes a successful response without the requested record type. In a direct query without aliases, these distinguish a nonexistent name from an existing name that lacks the requested data. Caching those results avoids repeating the same unsuccessful upstream lookup for every client request.

Classify the response before interpreting its cache. The source’s SOA TTL/MINIMUM pairs 8/4 and 2/9 yield four and two seconds. Existing negative entries can outlive authoritative publication. SERVFAIL, timeout and validation failure use different failure-caching rules. The historical resolver example was not rerun.

When it breaks

A deployment can create a correct record and still appear broken to clients whose resolver previously cached its absence. The authority returns the new data, while the cache continues returning the earlier negative result until its lifetime ends. Repeatedly recreating the record does not invalidate that remote cache. This is especially visible when applications query a planned hostname before provisioning completes.

An empty answer section alone is not enough to classify a DNS result. Examine the response code, authority section, and any alias chain. A referral is different from an authoritative negative answer, and an NXDOMAIN can concern a terminal CNAME target rather than the originally requested alias. Reporting every empty result as “the domain does not exist” can send investigation toward the wrong record.

For authoritative NXDOMAIN and NODATA covered by RFC 2308, negative lifetime comes from the smaller of SOA.MINIMUM and the SOA record’s TTL. That value is carried on the SOA in the negative response and aged by caches. The MINIMUM field is not a universal floor for all positive record TTLs, and changing only a future positive record’s TTL does not shorten an already cached absence.

Check it quickly

The historical resolver integration remains unrerun. This review preserves its existing Docker/listener hold; no new environment or listener test was attempted.

Save this as check-negative-dns.py and run python3 check-negative-dns.py with Docker. The pinned environment uses BIND 9.18.49 and dnsmasq 2.90 on isolated loopback networking. The first zone has SOA TTL 8, SOA minimum 4, and one existing A record. The example checks actual responses and authoritative query counts before and after creating the missing data:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
with lab('exists 30 IN A 127.0.0.2',soa_ttl=8,minimum=4) as (_,update,cache,queries):
 cache();missing=query('new.lab.test.',port=1054);nodata=query('exists.lab.test.','AAAA',1054)
 assert missing.rcode()==dns.rcode.NXDOMAIN and not missing.answer
 assert nodata.rcode()==dns.rcode.NOERROR and not nodata.answer
 for answer in (missing,nodata):assert len(answer.authority)==1 and answer.authority[0].rdtype==dns.rdatatype.SOA and answer.authority[0].ttl==4
 wait(lambda: queries('new.lab.test')==1 and queries('exists.lab.test','AAAA')==1)
 again=query('new.lab.test.',port=1054);again_nodata=query('exists.lab.test.','AAAA',1054)
 assert again.rcode()==dns.rcode.NXDOMAIN and again_nodata.rcode()==0 and not again_nodata.answer
 assert queries('new.lab.test')==1 and queries('exists.lab.test','AAAA')==1
 positive=query('exists.lab.test.','A',1054);assert values(positive)==['127.0.0.2']
 update('exists 30 IN A 127.0.0.2\nexists 30 IN AAAA ::1\nnew 30 IN A 127.0.0.3')
 assert values(query('new.lab.test.'))==['127.0.0.3'] and values(query('exists.lab.test.','AAAA'),'AAAA')==['::1']
 stale_missing=query('new.lab.test.',port=1054);stale_nodata=query('exists.lab.test.','AAAA',1054)
 assert stale_missing.rcode()==dns.rcode.NXDOMAIN and stale_nodata.rcode()==0 and not stale_nodata.answer
 wait(lambda: values(query('new.lab.test.',port=1054))==['127.0.0.3'],timeout=7)
 wait(lambda: values(query('exists.lab.test.','AAAA',1054),'AAAA')==['::1'],timeout=7)
 result={'NXDOMAIN':show(missing),'NODATA':show(nodata),'repeat_upstream_queries':{'NXDOMAIN':1,'NODATA':1},'existing_A_unaffected':show(positive),
 'immediately_after_creation':{'NXDOMAIN':show(stale_missing),'NODATA':show(stale_nodata)},'new_records_observed_after_expiry':True}
with lab('exists 30 IN A 127.0.0.2',soa_ttl=2,minimum=9) as (_,update,cache,queries):
 smaller=query('new.lab.test.');assert smaller.rcode()==dns.rcode.NXDOMAIN and smaller.authority[0].ttl==2
 result['smaller_SOA_TTL']=show(smaller)
print(json.dumps(result,sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

An A query for new.lab.test returns NXDOMAIN. An AAAA query for exists.lab.test, which already has A 127.0.0.2, returns NOERROR with no answer data. Both negative responses contain an SOA with TTL 4. The program repeats both queries through the cache and confirms that each has generated only one upstream query, proving reuse rather than merely observing two identical responses.

Querying the existing name’s A record still succeeds. This shows that the cached absence of AAAA does not mean every type at that name is absent. The script next adds A for the new name and AAAA for the existing name, reloads the authoritative zone, and verifies the new records directly. The authority now returns 127.0.0.3 and ::1, respectively.

Immediately querying through dnsmasq still returns the earlier NXDOMAIN and NODATA results. After the negative entries expire, those queries return the new positive data. A second isolated zone reverses the limiting values: SOA TTL 2 and minimum 9 produce a negative response with TTL 2. Together the cases verify both sides of the minimum rule instead of only one convenient configuration.

Separate authoritative absence from resolution failure

SERVFAIL, timeout, and DNSSEC validation failure do not establish that a name is absent. They describe failure to obtain or accept an answer. They are not categorically uncacheable, however: RFC 9520 updates the requirements for caching DNS resolution failures, including validation failures. Its failure-cache lifetime rules differ from the SOA-derived lifetime used for the authoritative negative answers in this experiment.

Do not assume a resolver implements every current recommendation merely because it caches NXDOMAIN correctly. This fixture does not test failure caching or DNSSEC validation. Inspect the deployed resolver’s version, configuration, and diagnostics for those behaviors. Preserve response codes and extended error information when available so a cached validation problem is not mistaken for a recently deleted hostname.

Before publishing a new service, consider whether its names have already been queried while absent. Create required records early when the deployment permits, and allow any known negative cache window to drain before requiring successful discovery. An operator can clear a cache they control, but cannot normally purge every independent resolver used by clients. Verify both authoritative publication and the affected resolver’s current response.

Choose negative lifetime with recovery and repeated-miss load in mind. Repeated queries for one absent name can benefit from caching; a stream of unique names behaves differently and still consumes resources. Keep positive and negative query metrics distinguishable. The operational question is which fact was cached, under which name and type, for how long, and what evidence now shows that the client’s view has changed.

Sources

RFC 2308 negative DNS caching, NXDOMAIN, NODATA, cache keys, and the SOA-derived lifetime, checked 2026-09-12.
RFC 9520 caching DNS resolution failures, updated requirements for resolution and validation failure caching, checked 2026-09-12.
dnsmasq manual, negative caching behavior and related options, checked 2026-09-12.

DNSSEC validates a chain of signed data, not merely the presence of signatures

Wed, 21 Oct 2026 00:00:00 +0000

DNSSEC adds origin authentication and integrity checking for DNS data. RRSIG records sign RRsets, DNSKEY records publish verification keys, and a parent’s DS record identifies a child DNSKEY through a digest. The parent signs its DS RRset; it does not simply sign the child’s public key directly. Validation follows these relationships from a configured trust anchor to the requested data.

The digest edge identifies a child key; signature edges verify RRsets. The source uses a local lab.test anchor, not the public-root or registrar path. Its authenticated no-DS delegation is insecure, distinct from a broken secure chain. Diagram construction did not execute the DNSSEC exercise or create keys.

When it breaks

Publishing signatures is insufficient when the delegation does not establish the intended trust path. A missing DS can leave a child insecure, while an incorrect DS can make a supposedly secure child fail validation. Those are different states. Securely established absence of DS does not require every unsigned or independently signed child answer to be rejected as bogus.

Signatures also have inception and expiration times independent of an answer’s ordinary cache TTL. A signed zone can keep serving records after its signatures expire, but validators may reject them. Incorrect clocks, incomplete key rollovers, and stale parent DS data can therefore disrupt a zone that still answers ordinary queries. Monitoring only the presence of DNSKEY or RRSIG misses the actual validation boundary.

The authenticated-data AD flag must be interpreted through a trusted resolver path. Seeing the bit in an arbitrary unprotected response does not make that response trustworthy; an attacker can alter an unauthenticated message. Likewise, asking for DNSSEC records with DO is not validation. Establish which component validates and how the application trusts its response before treating a displayed flag as a security guarantee.

Check it quickly

Save this as check-dnssec.py and run python3 check-dnssec.py with Docker. The pinned BIND 9.18.49 environment creates disposable keys and offline-signed parent and child zones. A separate validating resolver trusts a local lab.test anchor and forwards only that test namespace to the authority. Private keys stay inside the container, and the host’s trust configuration and clock are unchanged:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
from datetime import datetime,timedelta,timezone
import dns.flags,dns.rdataset,dns.zone
with TemporaryDirectory(prefix='xbcatm-dnssec-') as directory:
 root=Path(directory);keys=root/'keys';keys.mkdir()
 parent='lab.test.';child='secure.lab.test.';key_names={}
 for name in (parent,child):
 for role in ('KSK','ZSK'):
 args=['dnssec-keygen','-q','-a','ECDSAP256SHA256','-n','ZONE','-K',str(keys)]
 if role=='KSK':args+=['-f','KSK']
 key_names[name,role]=run(*args,name).stdout.strip()
 def base(name):return f'$ORIGIN {name}\n$TTL 60\n@ IN SOA ns.{name} hostmaster.{name} (1 60 60 3600 60)\n@ IN NS ns.{name}\nns IN A 127.0.0.1\n'
 child_zone=root/'child.zone';child_zone.write_text(base(child)+'www IN A 127.0.0.2\n')
 ds=run('dnssec-dsfromkey','-2',str(keys/(key_names[child,'KSK']+'.key'))).stdout.strip()
 parent_body=base(parent)+'secure IN NS ns.secure.lab.test.\nns.secure IN A 127.0.0.1\n'
 def sign(name,body,label,extra=()):
 plain=root/(label+'.zone');signed=root/(label+'.signed');plain.write_text(body)
 result=subprocess.run(['dnssec-signzone','-S','-K',str(keys),'-n','1','-o',name,'-f',str(signed),*extra,str(plain)],
 cwd=root,text=True,capture_output=True,timeout=15)
 assert result.returncode==0,result.stdout+result.stderr
 return signed
 signed_child=sign(child,child_zone.read_text(),'child-good')
 signed_parent=sign(parent,parent_body+ds+'\n','parent-good')
 parsed=dns.zone.from_file(str(signed_parent),origin=parent);anchor=next(key for key in parsed.get_rdataset('@','DNSKEY') if key.flags==257)
 anchor_parts=anchor.to_text().split();anchor_config=' '.join(anchor_parts[:3])+' '+json.dumps(''.join(anchor_parts[3:]))
 tampered=root/'child-tampered.signed';zone=dns.zone.from_file(str(signed_child),origin=child)
 zone.replace_rdataset('www',dns.rdataset.from_text('IN','A',60,'127.0.0.3'));zone.to_file(str(tampered))
 start=(datetime.now(timezone.utc)-timedelta(days=2)).strftime('%Y%m%d%H%M%S');end=(datetime.now(timezone.utc)-timedelta(days=1)).strftime('%Y%m%d%H%M%S')
 expired=sign(child,child_zone.read_text(),'child-expired',extra=('-s',start,'-e',end,'-P'))
 pieces=ds.split();pieces[-1]='0'*len(pieces[-1]);wrong_parent=sign(parent,parent_body+' '.join(pieces)+'\n','parent-wrong-ds')
 insecure_parent=sign(parent,parent_body,'parent-no-ds')
 outcomes={}
 for label,parent_file,child_file in [('secure',signed_parent,signed_child),('tampered',signed_parent,tampered),
 ('expired',signed_parent,expired),('wrong_DS',wrong_parent,signed_child),('unsigned_delegation',insecure_parent,signed_child)]:
 auth=root/(label+'-authority');resolver=root/(label+'-resolver');auth.mkdir();resolver.mkdir()
 def options(path,port,validation,recursion):return f'''options {{ directory "{path}"; listen-on port {port} {{127.0.0.1;}};
listen-on-v6 {{none;}}; recursion {recursion}; dnssec-validation {validation}; notify no; max-cache-size 8m;
pid-file "{path}/named.pid"; lock-file "{path}/named.lock"; session-keyfile none; }}; controls {{}};'''
 authority_config=options(auth,1053,'no','no')+f'''zone "{parent}" {{type primary; file "{parent_file}";}};
zone "{child}" {{type primary; file "{child_file}";}};'''
 resolver_config=options(resolver,1054,'yes','yes')+f'''trust-anchors {{ "{parent}" static-key {anchor_config}; }};
zone "{parent}" {{type forward; forward only; forwarders {{127.0.0.1 port 1053;}};}};'''
 with named_process(auth,authority_config),named_process(resolver,resolver_config):
 q=dns.message.make_query('www.'+child,'A',want_dnssec=True)
 direct=dns.query.udp(q,'127.0.0.1',port=1053,timeout=2)
 assert any(rr.rdtype==dns.rdatatype.RRSIG for rr in direct.answer) and not direct.flags&dns.flags.AD
 checked=dns.query.udp(q,'127.0.0.1',port=1054,timeout=8)
 outcomes[label]={'authority_A':values(direct),'authority_has_RRSIG':True,'resolver_rcode':dns.rcode.to_text(checked.rcode()),
 'resolver_AD':bool(checked.flags&dns.flags.AD),'resolver_A':values(checked)}
 if label=='secure':assert checked.rcode()==0 and checked.flags&dns.flags.AD and values(checked)==['127.0.0.2']
 elif label=='unsigned_delegation':assert checked.rcode()==0 and not checked.flags&dns.flags.AD and values(checked)==['127.0.0.2']
 else:assert checked.rcode()==dns.rcode.SERVFAIL and not values(checked)
 print(json.dumps({'trust_anchor':parent,'cases':outcomes,'system_clock_changed':False},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The valid case has a signed parent DS matching the child’s key and a valid signature on www.secure.lab.test A 127.0.0.2. The authority supplies RRSIG but does not mark its direct reply AD. The separate resolver returns NOERROR, the expected address, and AD. This demonstrates the difference between serving signed data and validating that data through the configured parent-child chain.

The tampered case changes the child’s A data to 127.0.0.3 while retaining its earlier signatures. Direct authority lookup returns that changed address with RRSIG still present; the validating resolver returns SERVFAIL and no address. The test therefore checks rejection of a concrete data modification, rather than declaring data safe merely because a response contains a signature-shaped record.

Another case signs the child with deliberately past validity times. The signer generates this expired fixture without its normal post-sign verification, while resolver validation stays enabled. A third case signs the parent correctly but publishes a wrong child DS digest. Both produce SERVFAIL at the resolver, despite the authority returning the original address and RRSIG. No system-clock manipulation is used to manufacture expiry.

Finally, the signed parent publishes no DS for the child. The child still serves signed data, but the resolver returns the address without AD. This authenticated insecure delegation is accepted in the test’s policy and is distinct from the bogus tampered, expired, and wrong-DS cases. Each scenario starts fresh authority and resolver processes so prior cached results cannot mask the changed chain.

Keep signing, delegation, and validation observable

The fixture’s anchor is local; it does not test the public root or a registrar update. A production resolver can use the public root anchor and may have additional explicitly configured trust anchors. The important relationship is a valid path from an anchor the validator already trusts. DNSSEC does not require every possible deployment to derive trust from exactly one hard-coded root key.

Signing may happen offline or through managed authoritative workflows; every authoritative response does not need to be freshly signed by the server answering it. Verify the published DNSKEY and DS relationship, signature validity windows, and results through the resolvers clients actually use. Include an expected validation failure in a controlled test, since a resolver that accepts every answer can appear healthy while providing no validation.

Plan key rollover and parent coordination using the supported procedure and relevant cached lifetimes. Do not respond to a broken chain by silently disabling validation and then reporting the zone repaired. A restored plain answer is different from restored authenticated data. Compare direct authoritative contents with validating results to identify whether the fault lies in publication, delegation, signature timing, or the validator’s trusted configuration.

DNSSEC does not encrypt queries or prove that the application at an authenticated address is safe. TLS transport and application authentication protect other boundaries. The tested property is validation of signed DNS data through an authenticated delegation, with rejection of specific broken secure chains.

Sources

RFC 4033 DNS security introduction, DNSSEC properties and secure, insecure, and bogus data, checked 2026-09-12.
RFC 4034 DNSSEC resource records, DNSKEY, RRSIG, and DS relationships, checked 2026-09-12.
RFC 4035 DNSSEC protocol modifications, validation, authenticated delegation, and resolver behavior, checked 2026-09-12.
BIND 9.18.49 tools, offline key generation, zone signing, and DS generation, checked 2026-09-12.

Resolution order depends on the application and its name-service path

Sun, 02 Aug 2026 00:00:00 +0000

A hostname lookup starts with the program making it. On Linux, an application using glibc name-service interfaces can consult the services listed for hosts in /etc/nsswitch.conf. A program with its own DNS client may take a different path. There is no universal sequence in which every application checks a cache, then a hosts file, then the internet.

The same name can resolve differently through local files and direct DNS. Inspect NSS actions, caller flags and the actual process environment before changing upstream records. This diagram summarizes the article without rerunning its experiment.

When it breaks

A hosts-file entry can override a correct DNS answer when files precedes dns. Editing the authoritative zone does not remove that override. Conversely, a direct DNS query can report a new address while an application still uses the local entry. Both observations can be accurate because they answer different questions about where the address came from.

NSS actions matter as much as order. A clause such as [NOTFOUND=return] after files stops lookup when the file service finds no entry. DNS can contain a valid record and still never be consulted. Treating that failure as an upstream outage leads to unnecessary DNS changes while leaving the actual lookup policy untouched.

Address-family filtering creates another misleading disagreement. With AI_ADDRCONFIG, glibc considers configured non-loopback addresses when deciding which families to return. A container containing only loopback interfaces can therefore behave differently from a normal host. Even two tools using libc need not request identical families or flags, so matching their command names is insufficient evidence of equivalent lookups.

Check it quickly

Save this as check-resolution.py and run python3 check-resolution.py with Docker available. It builds the pinned Debian-based environment with BIND 9.18.49, dnsmasq 2.90, and glibc 2.36. The disposable container has only loopback networking. Hosts, NSS, and resolver changes happen inside that container; the host’s configuration is not used as the experiment’s writable state:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
with lab('choice 30 IN A 127.0.0.2\ndns-only 30 IN A 127.0.0.3') as (_,update,cache,queries):
 cache(port=53)
 hosts=Path('/etc/hosts');hosts.write_text(hosts.read_text()+'\n127.0.0.9 choice.lab.test\n')
 Path('/etc/resolv.conf').write_text('nameserver 127.0.0.1\noptions timeout:1 attempts:1\n')
 nss=Path('/etc/nsswitch.conf');original=nss.read_text()
 def order(value):nss.write_text(re.sub(r'^hosts:.*$', 'hosts: '+value,original,flags=re.M))
 def application(name):
 result=run('/usr/bin/python3','-c',
 'import json,socket,sys;print(json.dumps(sorted({v[4][0] for v in socket.getaddrinfo(sys.argv[1],80,socket.AF_INET,socket.SOCK_STREAM)})))',name,check=False)
 return result.returncode,json.loads(result.stdout) if result.returncode==0 else None
 results={};order('files dns')
 assert application('choice.lab.test')==(0,['127.0.0.9'])
 filtered=run('getent','ahostsv4','choice.lab.test',check=False)
 assert filtered.returncode!=0
 libc=run('getent','-A','ahostsv4','choice.lab.test').stdout
 assert {line.split()[0] for line in libc.splitlines()}=={'127.0.0.9'}
 before=queries('choice.lab.test')
 direct=run('dig','@127.0.0.1','-p','1053','choice.lab.test.','A','+short').stdout.strip()
 wait(lambda: queries('choice.lab.test')==before+1)
 assert direct=='127.0.0.2';results['files_first']={'application':['127.0.0.9'],'getent_without_addrconfig':['127.0.0.9'],'dig':direct}
 results['loopback_only_getent_default_exit']=filtered.returncode
 order('dns files');assert application('choice.lab.test')==(0,['127.0.0.2']);results['dns_first']=['127.0.0.2']
 order('files [NOTFOUND=return] dns')
 before=queries('dns-only.lab.test');code,address=application('dns-only.lab.test')
 assert code!=0 and address is None and queries('dns-only.lab.test')==before
 assert values(query('dns-only.lab.test.'))==['127.0.0.3']
 wait(lambda: queries('dns-only.lab.test')==before+1)
 results['stop_after_files_miss']={'application_failed':True,'DNS_would_answer':['127.0.0.3']}
 print(json.dumps(results,sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The authoritative server publishes choice.lab.test as 127.0.0.2. The container’s hosts file maps the same name to 127.0.0.9. With hosts: files dns, a fresh Python process calling getaddrinfo for IPv4 returns the hosts-file value. A direct dig query to the authoritative server returns the DNS value. Query-log counting confirms that the direct query actually reached that server.

In this loopback-only environment, default getent ahostsv4 exits with status 2. Adding its -A option disables address-configuration filtering and returns 127.0.0.9. The comparison records this failure rather than silently treating an empty tool result as a missing DNS record. The Python call explicitly supplies a family and uses no AI_ADDRCONFIG flag, explaining why it already succeeds.

Changing NSS to dns files makes the application return 127.0.0.2. Changing it again to files [NOTFOUND=return] dns makes lookup of dns-only.lab.test fail. The authoritative query counter remains unchanged during that application lookup, while a subsequent direct DNS query returns 127.0.0.3 and increments the counter. This distinguishes an early local stop from a server that answered negatively.

Inspect the path that the failing process uses

Start with the application’s resolver API, address family, flags, and runtime caching policy. Then inspect the process’s filesystem and network namespace. A container can have different hosts and resolver files from its host; a browser may use its own encrypted DNS service. The successful host-side command is useful context, but it does not establish the failing process’s effective configuration.

Within an NSS path, read the complete hosts line, including bracketed actions and available modules. Within a DNS path, identify the actual destination resolver, search domains, and query type. Use fully qualified names when isolating search-list effects. Query the authority and the recursive resolver separately, retaining response status, answer records, and remaining TTL instead of reducing every response to a single address.

Finally, separate name lookup from connection establishment. An address returned by either source may be unreachable, and an existing connection may keep using an older peer without resolving again. Correct the observed cause: update an unintended hosts entry, repair NSS policy, inspect the relevant cache, or investigate transport. Flushing an unrelated cache cannot change a hosts-file rule or the behavior of a different resolver implementation.

Sources

Linux nsswitch.conf(5), service order and actions after lookup results, checked 2026-09-12.
Linux getaddrinfo(3), address-family selection and AI_ADDRCONFIG behavior, checked 2026-09-12.
BIND 9.18.49 tools, dig queries sent to a specified DNS server, checked 2026-09-12.

DNS changes need a cache-aware rollback window

Thu, 18 Jun 2026 00:00:00 +0000

Changing an address record is easy; predicting when every resolver stops using the old answer is not. The time-to-live value travels with a DNS response and controls its ordinary cache freshness. Lowering the TTL at the moment of a migration does not rewrite answers that were cached earlier.

TTL travels with each answer. Prepare before the switch, keep both endpoints valid, and use old-endpoint traffic plus a margin to guide retirement and rollback.

Lower the TTL before the event

If an existing record has a one-day TTL, lower it at least one old TTL before the planned switch. That gives caches time to fetch the shorter value while the authoritative record still points to the old endpoint. The exact interval belongs in the change plan rather than in an improvised command during the migration.

Record authoritative answers separately. The following two probes compare the system-configured resolver with a public recursive resolver; neither is inherently an authoritative query:

dig +noall +answer www.example.test A
dig @1.1.1.1 +noall +answer www.example.test A

For authoritative evidence, query the zone’s actual nameserver without recursion and inspect the AA flag, status, answer, and authority sections. The remaining TTL shown by a recursive resolver is evidence of its current cache state; different resolvers can legitimately differ. Repeat for AAAA and any CNAME chain used by the service, not only A.

Keep both sides valid

During the switch, keep the old and new endpoints capable of serving the intended hostname. TLS names, redirects, and application configuration must agree on both sides. Removing the old endpoint immediately after the authoritative record changes creates an avoidable outage for clients that still hold the prior answer.

Negative answers are cached too. Creating a name that recently returned NXDOMAIN can take time to become visible because the negative response may remain in recursive caches according to the zone’s authority data.

Raise the TTL after observation

Once authoritative and representative recursive answers point to the new endpoint and the old cache window has elapsed, restore the normal TTL. Keep the change record with the old value, new value, authoritative answer, and rollback condition.

TTL is not a universal shutdown deadline. Resolvers can serve stale data during resolution failures, and long-lived connections or application caches may outlast DNS freshness. Observe old-endpoint traffic and retain a margin; changing DNS back also has a cache window. For negative answers, inspect the SOA-derived negative TTL rather than assuming the new A record’s TTL applies.

Sources

RFC 1034 — Domain Names: Concepts and Facilities, caching model, checked 2026-10-15.
RFC 1035 — Domain Names: Implementation and Specification, TTL field, checked 2026-10-15.
RFC 2308 — Negative Caching of DNS Queries, negative caching model and retained error TTL, checked 2026-10-15.
RFC 8767 — Serving Stale Data, stale answers during DNS resolution failures, checked 2026-10-15.
BIND 9 dig manual, server selection and recursion controls, checked 2026-10-15.

Lower DNS TTL before a move and budget the rollback cache window

Thu, 18 Jun 2026 00:00:00 +0000

A DNS TTL expresses how long a resource record may ordinarily remain in a cache before refresh is needed. Changing the authoritative record changes future answers, but it does not send an invalidation message to every resolver that previously stored the data. A migration therefore has both an authoritative update and a period during which clients can legitimately discover different addresses.

Event order is schematic, not proportional time. Cache generations can differ; applications and existing connections have separate lifetimes.

When it breaks

Lowering TTL at the moment of an address change does not shorten the lifetime of earlier cached answers. A resolver that stored yesterday’s longer TTL has not learned today’s shorter one. Removing the old service immediately can break those clients even when every authoritative query already returns the new address. The failure is a mismatch between service overlap and outstanding discovery state.

Rollback has the same asymmetry. Changing the zone back does not retract the new address from caches that already learned it. A destination that worked briefly may continue receiving requests after the rollback command completes. Keep the rollback target and the recently published target usable for the relevant overlap, or define how clients using either address will receive an acceptable result.

Do not calculate propagation by adding every cache layer’s original TTL. Ordinary forwarding caches return remaining lifetime, and downstream caches age that received value. Independent resolver populations may have filled at different times, however. Application-specific caching, long-lived connections, authoritative synchronization delays, and configured serve-stale behavior also prevent a single TTL from becoming a universal end-to-end completion guarantee.

Check it quickly

Save this as check-dns-move.py and run python3 check-dns-move.py with Docker. The pinned environment uses BIND 9.18.49 as an authority and dnsmasq 2.90 as one forwarding cache. Both run on the isolated container’s loopback interface. The example changes only its disposable zone, increments its serial, and confirms each authoritative reload before observing the cache:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
def record(address,ttl):return f'move {ttl} IN A {address}'
with lab(record('127.0.0.2',8)) as (_,update,cache,queries):
 cache();before=queries('move.lab.test');started=time.monotonic();initial=query('move.lab.test.',port=1054)
 wait(lambda: queries('move.lab.test')==before+1)
 assert values(initial)==['127.0.0.2'] and initial.answer[0].ttl==8
 update(record('127.0.0.2',3));lowered=query('move.lab.test.');cached_after_lower=query('move.lab.test.',port=1054)
 assert lowered.answer[0].ttl==3 and cached_after_lower.answer[0].ttl>3
 update(record('127.0.0.3',3));new_authority=query('move.lab.test.');old_cache=query('move.lab.test.',port=1054)
 assert values(new_authority)==['127.0.0.3'] and values(old_cache)==['127.0.0.2']
 time.sleep(3.3);after_new_ttl=query('move.lab.test.',port=1054)
 assert values(after_new_ttl)==['127.0.0.2']
 observations=[]
 def changed():
 answer=query('move.lab.test.',port=1054);observations.append(show(answer));return values(answer)==['127.0.0.3']
 wait(changed,timeout=8);migration_delay=round(time.monotonic()-started,3)
 update(record('127.0.0.2',3));rollback_authority=query('move.lab.test.');rollback_cache=query('move.lab.test.',port=1054)
 assert values(rollback_authority)==['127.0.0.2'] and values(rollback_cache)==['127.0.0.3']
 wait(lambda: values(query('move.lab.test.',port=1054))==['127.0.0.2'],timeout=6)
 print(json.dumps({'initial':show(initial),'lowered_authority':show(lowered),'cache_after_lower':show(cached_after_lower),
 'after_address_change':{'authority':show(new_authority),'cache':show(old_cache)},'after_new_TTL_elapsed':show(after_new_ttl),
 'new_address_observed_after_seconds':migration_delay,'rollback':{'authority':show(rollback_authority),'cache':show(rollback_cache)},
 'rollback_eventually_observed':True},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

First, move.lab.test points to 127.0.0.2 with TTL 8. Querying through dnsmasq stores that answer, and the authoritative log confirms one upstream query. The script then republishes the same address with TTL 3. Direct authority lookup sees 3, while the previously populated cache still reports a remaining TTL greater than 3. Lowering the source value has not rewritten existing cache state.

The authority next changes the address to 127.0.0.3, still with TTL 3. Direct queries see the new address immediately; the cache continues returning 127.0.0.2. After another 3.3 seconds, the old address remains cached. This deliberately waits longer than the newly configured TTL and demonstrates why that new number cannot be used as the expiry time for an earlier answer.

The article’s historical run first returns 127.0.0.3 about 7.35 seconds after its initial fill. Integer-second expiry and process scheduling affect this interval; it is not a portable eight-second stopwatch. Crucially, the existing copy survives the new three-second interval. The script then rolls the authority back to 127.0.0.2. An immediate cache lookup still returns 127.0.0.3, and a later lookup returns the restored address after that cached generation expires.

Prepare the overlap before changing discovery

Lower TTL while the old destination is still healthy, confirm that all relevant authoritative servers have the intended data, and allow the previous longer cache lifetime to drain before the planned move. Measure the resolvers and client populations that matter to the service. One query to one public resolver samples one view; it cannot prove that every user now holds the same record.

At cutover, verify the new endpoint through the real hostname and required protocols. Keep the old endpoint serving or safely forwarding traffic for the planned overlap. Address discovery, TLS identity, application state, and connection draining are separate responsibilities. DNS changes cannot repair a new server that lacks the correct certificate or move an established connection away from an old process.

Maintain a usable rollback window after the first successful test. Record when the new address became authoritative, its TTL, and which endpoints must remain available. If a client still reaches the old address, establish whether it performed a new lookup, used a cached answer, or reused an existing connection. Those observations lead to different fixes and different timing expectations.

RFC 8767 describes serving expired data under controlled conditions when refresh fails. This example does not enable that feature; its older answers are still within their ordinary cache lifetimes. Inspect the actual resolver policy before interpreting an expired answer. Planning with explicit cache generations and endpoint overlap is more reliable than treating the zone editor’s save time as global completion.

Sources

RFC 1035 domain names, resource-record TTL and cache lifetime, checked 2026-09-12.
RFC 8767 serving stale DNS data, controlled reuse after expiration when refresh fails, checked 2026-09-12.
dnsmasq manual, forwarding, caching, and TTL controls, checked 2026-09-12.

CAA records should authorize the issuer you actually use

Wed, 17 Jun 2026 00:00:00 +0000

Certification Authority Authorization records let a domain holder state which certificate authorities may issue certificates for the domain. They are useful only when the record matches the real renewal path and the operator understands how policy can be inherited from parent names.

CAA authorizes issuers at issuance time. Lookup stops at the first relevant nonempty record set; wildcard tags refine the rule. Existing certificates and HTTPS trust are separate boundaries. The displayed issuer is an example.

Inspect the current policy

Query the exact hostname and its parent names:

for name in www.example.test example.test test; do
 printf '== %s\n' "$name"
 dig +noall +answer CAA "$name"
done

These are placeholder names, queried through the configured resolver. An empty answer at the leaf does not necessarily mean there is no applicable policy: lookup follows aliases and stops at the first nonempty relevant CAA RRset while walking upward. It does not merge every parent’s restrictions. Inspect DNS status and authority information too; an empty answer-only display can hide NXDOMAIN or SERVFAIL. Compare authoritative answers with recursive results when diagnosing changes.

Match the CA’s issuer identifier

A record uses tags such as issue or issuewild and an issuer-domain value:

example.test. 3600 IN CAA 0 issue "letsencrypt.org"

The value is an authorization identifier, not the display name from a certificate. Confirm it in the certificate authority’s current documentation. Without issuewild, issue also governs wildcard issuance. When issuewild is present, it takes precedence for wildcard requests; multiple records of the same tag grant alternatives rather than requiring every CA. CAA does not select a particular intermediate certificate.

Stage the DNS change before renewal

Add or tighten CAA while the current certificate is healthy. Wait through the previous TTL, query authoritative and recursive answers, and run a staging or renewal test supported by the ACME client. Keep a rollback record ready.

Do not add a restrictive record during an expiry incident unless the issuer path has already been verified. A syntactically correct but wrong policy can turn automatic renewal into a hard failure.

Observe issuance failures

CAA checks happen at issuance time, not on every HTTPS request. Changing CAA neither revokes existing certificates nor proves that a historical issuance complied with the policy at that time. Certificate monitoring must therefore cover both current expiry and renewal attempts. Log the effective DNS answer with the ACME failure instead of recording only a generic authorization error.

Sources

RFC 8659 — DNS Certification Authority Authorization, CAA lookup and property semantics, checked 2026-10-15.
Let’s Encrypt: CAA, issuer identifiers and operational guidance, checked 2026-10-15.

DNS · XB Field Notes

dnsmasq separates forwarded cache entries from configured local names

When it breaks

Check it quickly

Operate the listener and its data sources deliberately

Sources

DNS TTL trades repeated upstream queries against retained answers

When it breaks

Check it quickly

Choose TTL from observed demand and change needs

Sources

AAAA records publish IPv6 addresses without proving reachability

When it breaks

Check it quickly

Check each advertised family through the service

Sources

Zone transfer copies authoritative data under explicit authorization and serial rules

When it breaks

Check it quickly

Validate replication, authorization, and confidentiality separately

Sources

DoT and DoH protect the connection to the resolver you authenticate

When it breaks

Check it quickly

Keep the resolver and bootstrap configuration visible

Sources

A CNAME changes DNS resolution while the requested hostname stays the same

When it breaks

Check it quickly

Move the dependency and preserve the service contract

Sources

Multiple DNS addresses do not guarantee balanced or healthy traffic

When it breaks

Check it quickly

Choose the balancing and failure contract explicitly

Sources

SRV discovery gives clients targets and ports that they must interpret

When it breaks

Check it quickly

Match the client algorithm to the published record set

Further reading

Sources

Useful hostnames distinguish local identity, service names, and lookup scope

When it breaks

Check it quickly

Choose names for the lifetime and audience they serve

Sources

DNS needs a working TCP path when a UDP answer is truncated

When it breaks

Check it quickly

Diagnose truncation and connection failure separately

Sources

Dual-stack address ordering and successful connection choice are separate

When it breaks

Check it quickly

Inspect the actual caller before changing host-wide policy

Sources

EDNS advertises UDP capacity without guaranteeing path delivery

When it breaks

Check it quickly

Measure the configured exchange rather than assuming a default

Sources

Negative DNS answers preserve absence until their cache lifetime expires

When it breaks

Check it quickly

Separate authoritative absence from resolution failure

Sources

DNSSEC validates a chain of signed data, not merely the presence of signatures

When it breaks

Check it quickly

Keep signing, delegation, and validation observable

Sources

Resolution order depends on the application and its name-service path

When it breaks

Check it quickly

Inspect the path that the failing process uses

Further reading

Sources

DNS changes need a cache-aware rollback window

Lower the TTL before the event