EDE 18/20 recursion failures after devel release upgrade 9.21.14 -> 9.21.15. bug, or config change req'd?

[Colin Vidal]

Hi, 

Can you provide your named.conf? 

9.21.15 introduces a new rndc command `showconf -effective`. The output of this command would be useful. 


From: "Greg Choules via bind-users" <bind-users at lists.isc.org> 
To: "pgnd" <pgnd at dev-mail.net> 
Cc: bind-users at lists.isc.org 
Sent: Wednesday, 19 November, 2025 15:02:24 
Subject: Re: EDE 18/20 recursion failures after devel release upgrade 9.21.14 -> 9.21.15. bug, or config change req'd? 

Hi. 
Looking at the dig flags it suggests you changed your config. 

In the first example the flags are qr (query), rd (recursion desired) ra (recursion available) 
In the second, ra is missing and dig tells you that explicitly: 

;; WARNING: recursion requested but not available 

Since the digs were to your local resolver, I think something must have changed in your config. The default for "recursion" hasn't changed; it's still "yes". Did you set it to "no"? 

Hope that helps. 
Cheers, Greg 

On Wed, 19 Nov 2025 at 13:53, pgnd < [ mailto:pgnd at dev-mail.net | pgnd at dev-mail.net ] > wrote: 


building devel release on 

distro 
Name: Fedora Linux 43 (Forty Three) 
Version: 43 
Codename: 

v9.21.14 

rpm -qa | grep bind9-current 
bind9-current-git_v9.21.14-0.20251119_130057.fc43.x86_64 

named -V 
BIND 9.21.14 (Development Release) <id:noscm> 
running on Linux x86_64 6.17.8-300.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 14 01:47:12 UTC 2025 
built by meson with ... 

resolves ok 

dig A [ http://isc.org/ | isc.org ] @::1 

; <<>> DiG 9.21.14 <<>> A [ http://isc.org/ | isc.org ] 
;; global options: +cmd 
;; Got answer: 
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63331 
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 

;; OPT PSEUDOSECTION: 
; EDNS: version: 0, flags:; udp: 4096 
; COOKIE: b1c0919d86c0b01001000000691dc03a9ed8ea5890000147 (good) 
;; QUESTION SECTION: 
; [ http://isc.org/ | isc.org ] . IN A 

;; ANSWER SECTION: 
[ http://isc.org/ | isc.org ] . 244 IN A 151.101.194.217 
[ http://isc.org/ | isc.org ] . 244 IN A 151.101.2.217 
[ http://isc.org/ | isc.org ] . 244 IN A 151.101.66.217 
[ http://isc.org/ | isc.org ] . 244 IN A 151.101.130.217 

;; Query time: 0 msec 
;; SERVER: ::1#53(::1) (UDP) 
;; WHEN: Wed Nov 19 08:03:54 EST 2025 
;; MSG SIZE rcvd: 128 

after upgrade to v9.21.15 

rpm -Uvh \ 
bind9-current-git_v9.21.15-0.20251119_131709.fc43.x86_64.rpm \ 

systemctl restart bind9-current 

named -V 
BIND 9.21.15 (Development Release) <id:noscm> 
running on Linux x86_64 6.17.8-300.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 14 01:47:12 UTC 2025 
built by meson with ... 

resolver fails 

dig A [ http://isc.org/ | isc.org ] @::1 

; <<>> DiG 9.21.15 <<>> A [ http://isc.org/ | isc.org ] @::1 
;; global options: +cmd 
;; Got answer: 
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 29342 
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 
;; WARNING: recursion requested but not available 

;; OPT PSEUDOSECTION: 
; EDNS: version: 0, flags:; udp: 4096 
; COOKIE: e714b97a4e1821be01000000691dc69fed0b5edc11f55428 (good) 
; EDE: 18 (Prohibited) 
; EDE: 20 (Not Authoritative): (recursion disabled) 
;; QUESTION SECTION: 
; [ http://isc.org/ | isc.org ] . IN A 

;; Query time: 0 msec 
;; SERVER: ::1#53(::1) (UDP) 
;; WHEN: Wed Nov 19 08:31:11 EST 2025 
;; MSG SIZE rcvd: 94 

note the 

; EDE: 18 (Prohibited) 
; EDE: 20 (Not Authoritative): (recursion disabled) 

and logs filling with 

19-Nov-2025 08:32:48.468 resolver: debug 1: set ede: info-code 18 extra-text (null) 
19-Nov-2025 08:32:48.468 resolver: debug 1: set ede: info-code 20 extra-text recursion disabled 


i see back in 

Notes for BIND 9.21.7 
... 
Support was added for EDE codes 20 (Not Authoritative) when the client requests recursion (RD) but the server has recursion disabled. 
... 

but nothing obvious in 9.21.15 release notes re: EDE xx, recursion 

is this a bug? or a required change in config? 
-- 
Visit [ https://lists.isc.org/mailman/listinfo/bind-users | https://lists.isc.org/mailman/listinfo/bind-users ] to unsubscribe from this list. 




-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20251119/d96ec9f3/attachment.htm>