getdns-node icon indicating copy to clipboard operation
getdns-node copied to clipboard

Issue with stub resolver and dnssec

Open romovs opened this issue 4 years ago • 0 comments

We seem to be having an issue getting RRSIG records when using stub resolver. Command line utilities getdns_query and dig return the expected RRSIG records. When doing the same through getdns-node we are receiving: (I have edited out the DNS IP and domain names due to our corporate policy)

  "answer_type": 800,
  "canonical_name": "XXXXX",
  "just_address_answers": [],
  "replies_full": [],
  "replies_tree": [],
  "status": 901
}

Executing the following two utilities returns proper results: ./getdns_query +dnssec_return_status @xxx.xxx.xxx.xxx XXXXX A

dig @xxx.xxx.xxx.xxx XXXXX +dnssec A

Nodejs code:

var getdns = require("getdns");

var options = {
   resolution_type: getdns.RESOLUTION_STUB,
    upstream_recursive_servers: [
        ["XXX.XXX.XXX.XXX", 53],
    ],
    timeout: 7000,
    return_dnssec_status: true,
    follow_redirects: getdns.REDIRECTS_FOLLOW,
};

var context = getdns.createContext(options);

var callback = function(err, result) {
    if (err) {
        console.error(err);
    } else {
        console.log(JSON.stringify(result, null, 2));
    }
    context.destroy();
};

var extensions = {};

var transactionId = context.general("XXXX", getdns.RRTYPE_A, extensions, callback)

Are we missing something in the configuration or is DNSSEC+stub resolver just not supported in getdns-node

romovs avatar Oct 19 '21 11:10 romovs