[Bug 2024320] Re: systemd-resolved: returns SERVFAIL for uknown domain

[Mike Battersby]

Upstream has closed the issue, but I think they have misunderstood the
bug report.

The problem is that contrary to standard resolvers, systemd-resolved is
returning SERVFAIL for this case instead of NXDOMAIN.

Nobody is asking for the query to be forwarded, only for the response
code to be right.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/2024320

Title:
  systemd-resolved: returns SERVFAIL for uknown domain

Status in systemd:
  Unknown
Status in systemd package in Ubuntu:
  Confirmed

Bug description:
  Ubuntu 22.04.2 amd64
  systemd: 249.11-0ubuntu3.9

  when I ask for non-existing domain, systemd-resolved replies with
  SERVFAIL. I believe that correct answer should be NXDOMAIN (this is
  reply from public DNS servers, like 1.1.1.1, 8.8.8.8, 9.9.9.9 and
  others).

  DEMO, I use `khost` utility from package `knot-host`:

  CloudFlare DNS, reference, I believe this is expected answer:

  $ khost oops. 1.1.1.1
  Host oops. type A error: NXDOMAIN
  Host oops. type AAAA error: NXDOMAIN
  Host oops. type MX error: NXDOMAIN

  systemd-resolved, the bug (and the reply is not consistent, MX record
  has different error):

  $ khost oops.
  Host oops. type A error: SERVFAIL
  Host oops. type AAAA error: SERVFAIL
  Host oops. type MX error: NXDOMAIN

  $ khost -v oops.
  ;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 15468
  ;; Flags: qr aa rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0
  ;;oops.                         IN      A

  ;; Received 22 B
  ;; Time 2023-06-18 18:27:02 UTC
  ;; From 127.0.0.53 at 53(UDP) in 0.0 ms

  ;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 55107
  ;; Flags: qr aa rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0
  ;;oops.                         IN      AAAA

  ;; Received 22 B
  ;; Time 2023-06-18 18:27:02 UTC
  ;; From 127.0.0.53 at 53(UDP) in 0.0 ms

  ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 46585
  ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 0
  ;;oops.                         IN      MX
  .                       1390    IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2023061800 1800 900 604800 86400

  ;; Received 97 B
  ;; Time 2023-06-18 18:27:02 UTC
  ;; From 127.0.0.53 at 53(UDP) in 3.4 ms

  Check that DNS is served by systemd-resolved:

  $ sudo ss -nlp | grep ":53 "
  udp   UNCONN 0      0                                   127.0.0.53%lo:53               0.0.0.0:*    users:(("systemd-resolve",pid=586,fd=13))
  tcp   LISTEN 0      4096                                127.0.0.53%lo:53               0.0.0.0:*    users:(("systemd-resolve",pid=586,fd=14))

  Check version

  $ resolvectl --version
  systemd 249 (249.11-0ubuntu3.9)
  +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified

To manage notifications about this bug go to:
https://bugs.launchpad.net/systemd/+bug/2024320/+subscriptions