missing mandatory glue for root nameservers in BIND 9.21.26 global forwarding configuration

[Bagas Sanjaya]

Hi,

Since upgrading BIND on my Arch Linux system to 9.21.26 (compiled myself
from source), it now shows resolver priming query failure every time it
starts up. The log writes:

```
Sep 28 10:27:52 archie.me named[579]: using built-in root key for view _default
Sep 28 10:27:52 archie.me named[579]: set up managed keys zone for view _default, file 'managed-keys.bind'
Sep 28 10:27:52 archie.me named[579]: command channel listening on 127.0.0.1#953
Sep 28 10:27:53 archie.me named[579]: managed-keys-zone: loaded serial 7096
Sep 28 10:27:53 archie.me named[579]: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 42
Sep 28 10:27:53 archie.me named[579]: zone localhost/IN: loaded serial 42
Sep 28 10:27:53 archie.me named[579]: zone 0.0.127.in-addr.arpa/IN: loaded serial 42
Sep 28 10:27:53 archie.me named[579]: all zones loaded
Sep 28 10:27:53 archie.me named[579]: FIPS mode is disabled
Sep 28 10:27:53 archie.me named[579]: running
Sep 28 10:27:57 archie.me named[579]: managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
Sep 28 10:27:57 archie.me named[579]: managed-keys-zone: Key 38696 for zone . is now trusted (acceptance timer complete)
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for a.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for d.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for k.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for l.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for h.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for e.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for m.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for j.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for i.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for f.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for g.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for b.root-servers.net
Sep 28 10:27:57 archie.me named[579]: missing mandatory glue for c.root-servers.net
Sep 28 10:27:57 archie.me named[579]: resolver priming query complete: failure
```

BIND 9.21.25 (possibly) don't exhibit this failure.

The configuration I use (in `/etc/named.conf`):

```
tls quad9 {
    ca-file "/etc/ssl/certs/ca-certificates.crt";
    remote-hostname "dns.quad9.net";
};

tls adguard {
    ca-file "/etc/ssl/certs/ca-certificates.crt";
    remote-hostname "unfiltered.adguard-dns.com";
};

options {
    directory "/var/named";
    pid-file "/run/named/named.pid";

    listen-on-v6 { none; };
    listen-on { 127.0.0.53; };

    allow-recursion { 127.0.0.1; 127.0.0.53; 192.168.0.0/24; ::1; };
    allow-transfer { none; };
    allow-update { none; };
    max-cache-size 128M;

    forwarders {
        9.9.9.9 port 853 tls quad9;
        149.112.112.112 port 853 tls quad9;
        94.140.14.14 port 853 tls adguard;
        94.140.15.15 port 853 tls adguard;
    };

    forward only;

    version none;
    hostname none;
    server-id none;
};
```

(Note that I'm using global forwarding to DoT upstreams since I'm in a home
network where port 53 is firewalled (i.e. MITM'ed to ISP resolvers).)

Am I missing something? Is it a genuine bug?

Thanks.

-- 
An old man doll... just what I always wanted! - Clara
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20260928/9889b35b/attachment.sig>