Recursive resolver fails to fall back to working nameservers when one NS has a dead glue IP (exacerbated by "Prefer IPv6")

[philmacdonald]

Version

Technitium DNS Server v15.3

Description

Recursive resolution returns SERVFAIL for domains where one of the authoritative nameservers has a stale/dead glue record IP (granted this is a misconfiguration, but still) even though other listed nameservers are reachable and respond correctly. Public resolvers (Cloudflare, Google) resolve the same domain without issue.

The problem is significantly worse with the "Prefer IPv6" setting enabled — switching to "Enable IPv6" (not prefer) resolves the issue.

Steps to Reproduce

1. Configure Technitium in recursive mode with "Prefer IPv6" enabled
2. Query www.kwik-fit.com A record
3. Observe SERVFAIL with extended error: "No valid response from name servers for www.kwik-fit.com. A IN at delegation kwik-fit.com."

Root Cause Analysis

The domain kwik-fit.com has 5 nameservers:

dnsuk0.kwik-fit.com.      (glue: 83.231.133.125 — DEAD, times out)
dnseuw.imagehosting.co.uk (working)
dnssco.imagehosting.co.uk (working)
dnsuks.im463.net          (working)
dnsuse.im463.net          (working)

The .com TLD servers provide glue for dnsuk0.kwik-fit.com pointing to 83.231.133.125, but that IP does not respond to DNS queries (connection timeout). The other 4 nameservers respond correctly.

With "Prefer IPv6" enabled, the resolver appears to:

1. Attempt AAAA lookups for the nameservers (none have AAAA records — all fail)
2. Fall back to IPv4, but by this point the timeout/retry budget is consumed by the dead glue IP
3. Return SERVFAIL without successfully querying the other 4 working nameservers

With "Enable IPv6" (not prefer), the resolver successfully reaches the working nameservers and returns the correct answer.

Expected Behaviour

The resolver should try all available nameservers and return a successful response if any of them answer correctly, regardless of one nameserver being unreachable. The "Prefer IPv6" setting should not prevent fallback to working IPv4 nameservers.

Verification

# Dead glue IP — times out
$ dig www.kwik-fit.com @83.231.133.125 +time=3
;; connection timed out; no servers could be reached

# Other nameservers work fine
$ dig www.kwik-fit.com @dnseuw.imagehosting.co.uk A +short
kwikfit-tm01.trafficmanager.net.

$ dig www.kwik-fit.com @dnsuks.im463.net A +short
kwikfit-tm01.trafficmanager.net.

# Public resolvers handle it correctly
$ dig www.kwik-fit.com @1.1.1.1 A +short
kwikfit-tm01.trafficmanager.net.
etel-uks-lb05.uksouth.cloudapp.azure.com.
20.162.187.80

Workaround

Change "Prefer IPv6" to "Enable IPv6" in Settings → General → DNS Server.

Related

Possibly related to #1429 (Some Domains can not be resolved).

[ShreyasZare]

Thanks for the feedback. I tested the same domain name and was able to reproduce the issue.

The actual issue is with the new code changes added to prevent certain type of amplification attacks. The domain name being misconfigured caused the same condition that the code detected and marked all of the name servers as misconfigured. If you see the Cache section, you will see isMisconfigured set to true when the resolution fails for all of the NS records for the kwik-fit.com zone.

I have updated the condition with further refinement to mark only name servers that qualify as misconfigured instead of marking all of them. This change fixes this issue and will be available in the next update.