QNAME minimisation question

[Carlos Horowicz]

Hi

The problem seems related to "No zone cut at 90.45.in-addr.arpa." , 
shouldn't trigger a SERVFAIL with qname-minimisation relaxed

This is strange, because the intermediate response has a SOA , and NSEC 
seems enough to fail-over to qname-minimisation off .. it seems you're 
force to set the value off or disabled, because bind finds something 
"strange" in the zone cut response.

dig ns +dnssec 90.45.in-addr.arpa @127.0.0.1

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> ns +dnssec 90.45.in-addr.arpa 
@127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3483
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
; COOKIE: 47e896cf6ccfda1101000000683d80f19d2be46647905c35 (good)
;; QUESTION SECTION:
;90.45.in-addr.arpa.        IN    NS

;; AUTHORITY SECTION:
45.in-addr.arpa.    739    IN    SOA    z.arin.net. dns-ops.arin.net. 
2017040515 1800 900 691200 10800
45.in-addr.arpa.    739    IN    RRSIG    SOA 8 3 86400 20250616082821 
20250602072821 19875 45.in-addr.arpa. 
P4IRK/zZI0PrSiEfGMY+aFC7ipvCDuxAf4qKU72PUrIXT34tRg/ILXN1 
xSu28ASQovyGVJavy09N9NWog+PUD4CTwLPLIzrYLSlQYSeSb74Lh0i2 
Y3CVe9d4OfRPmng1enj/CbhzYOe/PG/qJ159DoDlBg41gdhSzQyLSsdj Ffo=
99.9.45.in-addr.arpa.    739    IN    RRSIG    NSEC 8 5 10800 
20250616082821 20250602072821 19875 45.in-addr.arpa. 
nneoox/GsQsIPH1WfouCcqjpXzw1yd2S4km+jWPI7Ow6mDZkhpZEOr8L 
S5/osv5Dmu0HmadjUucHwpTFHALqJVR/BeCDl54w0/0pLaYX4BxSPzPN 
8a7AvmA/qpu/M5deTy4egDFX7qV2DJo17DvykLbBmeAGkN3R5k4olLha dbU=
99.9.45.in-addr.arpa.    739    IN    NSEC 0.90.45.in-addr.arpa. NS 
RRSIG NSEC

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Jun 02 07:46:09 -03 2025
;; MSG SIZE  rcvd: 541

-Carlos


On 02/06/2025 12:01, Nick Tait via bind-users wrote:
> No zone cut at 90.45.in-addr.arpa.