DNAME occlusion

[Habbie]

From regression-tests/zones/test.com:

d               IN      DNAME   d2.test2.com.
a.d             IN      A       192.168.7.1

When queried for a.d, we return the A, while we should be synthesising a CNAME.

Tasks:

1. add to check-zone
2. optional: rework packethandler to do this right

[klaus3000]

I am just hit by this bug. Any chance this gets fixed some time?

Also the description of "dname-processing" confuses me:
"Synthesise CNAME records from DNAME records as required. This approximately doubles query load. Do not combine with DNSSEC!"
So, does this option activate DNAME handling inthe first place, or does it only control the CNAME synthesizing?

[Habbie]

I am just hit by this bug. Any chance this gets fixed some time?

As it only occurs when there is garbage in the database, it does not have a super high priority.

"Synthesise CNAME records from DNAME records as required. This approximately doubles query load. Do not combine with DNSSEC!"

The 'Do not combine with DNSSEC' remark surprises me!

So, does this option activate DNAME handling inthe first place, or does it only control the CNAME synthesizing?

Those are the same thing. DNAME processing -is- CNAME synthesis.

[klaus3000]

In my tests with Auth 4.1.5 DNAME does not work without dname-processing=yes. Hence, the name of the option is correct, the description make me thing this is only needed for CNAME synthesis but it is needed always for DNAME to work - even without subordinate labels.

[Habbie]

only needed for CNAME synthesis but it is needed always for DNAME to work

Again, those are the same thing. I'm confused - it looks like you are saying 'in 4.1.5, DNAME works, except it does not generate CNAMEs'. In that case, what part of DNAME is working?

[klaus3000]

Sorry for the confusion. Indeed there 3 issues:

1. dname-processing=yes must be set to serve DNAME at all
2. If the zone has sub-lables below DNAME, pdns serves the sublabel instead of the DNAME
3. DNAME responses are unsigned for presigned zones - at least the DNAMEs RRSIG should be served. (I have not tested online-signed zones)