[PR #6455] [MERGED] [client] Forward non-address DNS record types through route forwarders #28265

Closed
opened 2026-08-05 08:06:03 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/6455
Author: @lixmal
Created: 6/17/2026
Status: Merged
Merged: 6/28/2026
Merged by: @lixmal

Base: mainHead: dnsfwd-extra-qtypes


📝 Commits (5)

  • 4a4a46d Forward non-address DNS record types to the route forwarder instead of NXDOMAIN fallthrough
  • e659350 Split record lookups into per-type helpers and reduce forwarder param count
  • 3a6852c Answer NODATA for missing non-address records and cover record lookups with tests
  • dc7adf7 Extract arpa reverse-name parsing into per-family helpers
  • 04a2cfc Merge remote-tracking branch 'origin/main' into dnsfwd-extra-qtypes

📊 Changes

5 files changed (+703 additions, -47 deletions)

View changed files

📝 client/internal/dns/resutil/resolve.go (+229 -1)
📝 client/internal/dns/resutil/resolve_test.go (+159 -0)
📝 client/internal/dnsfwd/forwarder.go (+63 -7)
📝 client/internal/dnsfwd/forwarder_test.go (+247 -20)
📝 client/internal/routemanager/dnsinterceptor/handler.go (+5 -19)

📄 Description

Describe your changes

DNS queries for a domain handled by a NetBird DNS route are now fully owned by that route's forwarder. Previously only A/AAAA were served; any other record type fell through to the client's system resolver, which is not authoritative for the routed (often internal, split-horizon) zone and answers NXDOMAIN. Because NXDOMAIN is name-scoped, that poisoned the whole name and broke the A/AAAA records the route does serve.

  • Forward all query types from the DNS route interceptor to the peer forwarder instead of passing non-A/AAAA queries down the handler chain
  • Resolve MX, TXT, NS, SRV, CNAME and PTR through the host resolver and return real records
  • Answer NODATA (NOERROR, empty) for record types the host resolver cannot serve, never NXDOMAIN or NOTIMP, so a routed name is not poisoned
  • Distinguish NXDOMAIN from NODATA on a missing record by probing whether the name has any address, treating an inconclusive probe as existing
  • Attach an Extended DNS Error ("Not Supported") on the NODATA returned for unsupported types when the client uses EDNS0

Stack

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)
  • This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

  • I added/updated documentation for this change
  • Documentation is not needed for this change (explain why)

Behavioral fix to existing DNS route forwarding; no user-facing configuration or API changes.

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

Summary by CodeRabbit

  • New Features

    • Added DNS forwarding support for MX, TXT, NS, SRV, CNAME, and PTR (including reverse-DNS PTR handling).
    • When EDNS0 is enabled, unsupported query types now return an EDNS0 EDE “not supported” response.
  • Bug Fixes

    • Improved DNS response correctness for non-address lookups to return NODATA (empty answers) instead of NXDOMAIN.
    • For intercepted domains, queries are forwarded to the peer resolver to avoid system-resolver NXDOMAIN behavior.
  • Tests

    • Expanded coverage for PTR name parsing, TXT chunking, record routing, and EDNS0 EDE behavior.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/6455 **Author:** [@lixmal](https://github.com/lixmal) **Created:** 6/17/2026 **Status:** ✅ Merged **Merged:** 6/28/2026 **Merged by:** [@lixmal](https://github.com/lixmal) **Base:** `main` ← **Head:** `dnsfwd-extra-qtypes` --- ### 📝 Commits (5) - [`4a4a46d`](https://github.com/netbirdio/netbird/commit/4a4a46d67ae9090ae2f456cadfae90b40b5a284c) Forward non-address DNS record types to the route forwarder instead of NXDOMAIN fallthrough - [`e659350`](https://github.com/netbirdio/netbird/commit/e659350eaf6e104e69982b72c1ac9174fe32442d) Split record lookups into per-type helpers and reduce forwarder param count - [`3a6852c`](https://github.com/netbirdio/netbird/commit/3a6852cbc2c365c7bfc9d0b5f74190b8384d0b3f) Answer NODATA for missing non-address records and cover record lookups with tests - [`dc7adf7`](https://github.com/netbirdio/netbird/commit/dc7adf725c09b057a2b0a87d46b77300a0424dfe) Extract arpa reverse-name parsing into per-family helpers - [`04a2cfc`](https://github.com/netbirdio/netbird/commit/04a2cfc045eec3c6d1ddc3dc99bbf0a3f40ded93) Merge remote-tracking branch 'origin/main' into dnsfwd-extra-qtypes ### 📊 Changes **5 files changed** (+703 additions, -47 deletions) <details> <summary>View changed files</summary> 📝 `client/internal/dns/resutil/resolve.go` (+229 -1) 📝 `client/internal/dns/resutil/resolve_test.go` (+159 -0) 📝 `client/internal/dnsfwd/forwarder.go` (+63 -7) 📝 `client/internal/dnsfwd/forwarder_test.go` (+247 -20) 📝 `client/internal/routemanager/dnsinterceptor/handler.go` (+5 -19) </details> ### 📄 Description ## Describe your changes DNS queries for a domain handled by a NetBird DNS route are now fully owned by that route's forwarder. Previously only A/AAAA were served; any other record type fell through to the client's system resolver, which is not authoritative for the routed (often internal, split-horizon) zone and answers NXDOMAIN. Because NXDOMAIN is name-scoped, that poisoned the whole name and broke the A/AAAA records the route does serve. - Forward all query types from the DNS route interceptor to the peer forwarder instead of passing non-A/AAAA queries down the handler chain - Resolve MX, TXT, NS, SRV, CNAME and PTR through the host resolver and return real records - Answer NODATA (NOERROR, empty) for record types the host resolver cannot serve, never NXDOMAIN or NOTIMP, so a routed name is not poisoned - Distinguish NXDOMAIN from NODATA on a missing record by probing whether the name has any address, treating an inconclusive probe as existing - Attach an Extended DNS Error ("Not Supported") on the NODATA returned for unsupported types when the client uses EDNS0 ## Issue ticket number and link ## Stack <!-- branch-stack --> ### Checklist - [x] Is it a bug fix - [ ] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) - [ ] This change does **not** modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — **OR** I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first). > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [ ] I added/updated documentation for this change - [x] Documentation is **not needed** for this change (explain why) Behavioral fix to existing DNS route forwarding; no user-facing configuration or API changes. ### Docs PR URL (required if "docs added" is checked) Paste the PR link from https://github.com/netbirdio/docs here: https://github.com/netbirdio/docs/pull/__ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added DNS forwarding support for MX, TXT, NS, SRV, CNAME, and PTR (including reverse-DNS PTR handling). * When EDNS0 is enabled, unsupported query types now return an EDNS0 EDE “not supported” response. * **Bug Fixes** * Improved DNS response correctness for non-address lookups to return **NODATA** (empty answers) instead of **NXDOMAIN**. * For intercepted domains, queries are forwarded to the peer resolver to avoid system-resolver NXDOMAIN behavior. * **Tests** * Expanded coverage for PTR name parsing, TXT chunking, record routing, and EDNS0 EDE behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 08:06:04 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#28265