4 Releases 585 Tags

RSS Feed

• v34.1.0 31df61f530

  Compare

  DcRouter v34.1.0

  jkunz released this 2026-10-25 20:36:18 +00:00 | 19 commits to main since this release

  2026-10-25 - 34.1.0

  Features

  • Delegation evidence from the parent zone (DNS authority, ops API). probeDnsAuthorityZone and verifyDnsAuthorityZone return the probe's new optional fields: parentZone, the parent zone whose servers were asked; dsPresent, whether the agreed referral carried a DS; and parentAnswers, each parent server's address, nameserver name, classified outcome (referral, negative or inconclusive), referral NS set and DS flag. The verdicts and the stored authority set are unchanged; observedNameservers is now the NS set the parent delegates to. verifyDnsAuthorityZone refuses a zone whose parent publishes a DS for it (remove the DS at the registrar first), and the drift audit's delegated-but-unclaimed finding says when a DS blocks the claim.

  Fixes

  • Claim a zone that is delegated to dcrouter but not claimed yet (DNS authority, AGL-894). The delegation probe asked a public resolver over DNS-over-HTTPS for the zone's NS records; the resolver followed the delegation to dcrouter, which REFUSES an unclaimed zone, and answered SERVFAIL, so the probe was undeterminable and the zone could never be claimed. The probe now reads the delegation from the parent zone's own servers: it finds the parent zone over DoH (the nearest proper suffix with NS records, at most 8 levels; the zone itself and names below it are never asked over DoH), looks up A and AAAA of up to 8 parent nameserver names, and asks up to 4 distinct addresses (one per name first, IPv4 before IPv6) for the zone's NS records with RD=0 and DO=1, over UDP and TCP on truncation. A referral counts only with RCODE 0, AA=0, an empty answer section, authority NS records all owned by the zone, and an OPT record echoing DO=1; an authoritative NXDOMAIN or NODATA with the parent's SOA and an empty answer section counts as "no delegation"; every other answer, an AA=1 answer from a server that hosts both zones included, is inconclusive. At least 2 identical conclusive answers through at least 2 different parent nameserver names decide the verdict (the NS set and DS presence are compared; glue, TTLs, case and order are not), and any disagreement is undeterminable. A foreign delegation is not-delegated. DoH lookups time out after 5 s and each parent attempt after 2 s; no probe step starts after 30 s, so the probe's lookups and queries, and with them the DNS mutation lock a claim holds while it probes, end within about 35 s (plus starting and stopping the probe's DNS client). A zone below a zone dcrouter already serves is undeterminable (its parent servers are dcrouter's own).

  Maintenance

  • @push.rocks/smartdns 8.2.1 → 11.1.0 (queryServer, which the probe uses). smartdns 11 lowered its default SOA minimum from 86400 to 300, which would have cut the TTL of the SOA in every NXDOMAIN and NODATA answer from 3600 to 300; the embedded DNS server now sets soaDefaults (minimum: 86400, and the mname from the first dnsNsDomains entry instead of the deprecated primaryNameserver), so the apex SOA (TTL 3600, refresh 3600, retry 600, expire 604800, minimum 86400, rname hostmaster.<zone>), the negative-answer SOA (TTL 3600) and their RRSIGs (Original TTL 3600) are the values 8.2.1 served (test/test.dns-server-soa.node.ts). One served value changes: a DNS record stored with TTL 0 (the ops API and the Ops UI accept 0) was answered with TTL 300 by smartdns 8.2.1 and is now answered with TTL 0, as stored. dns-packet 5.6.1 and @types/dns-packet 5.6.5 are new dev dependencies for the fake DNS servers in the tests.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)