Hello, I've come across an authoritative that responds with BADVERS when edns client subnet is sent in a query to it, for example it can only be queried with dig if edns is turned off and no subnet is set:
fails: dig www.tsp.gov @ns2.tsp.gov ; <<>> DiG 9.11.2 <<>> www.tsp.gov @ns2.tsp.gov ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: BADVERS, id: 44363 ;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; Query time: 18 msec ;; SERVER: 74.113.204.34#53(74.113.204.34) ;; WHEN: Tue Jan 02 15:09 fails: dig +noedns www.tsp.gov @ns2.tsp.gov +subnet=162.88.100.192 ; <<>> DiG 9.11.2 <<>> +noedns www.tsp.gov @ns2.tsp.gov +subnet=162.88.100.192 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: BADVERS, id: 60645 ;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; Query time: 19 msec ;; SERVER: 74.113.204.34#53(74.113.204.34) ;; WHEN: Tue Jan 02 15:10:21 EST 2018 ;; MSG SIZE rcvd: 23 works: dig +noedns www.tsp.gov @ns2.tsp.gov ; <<>> DiG 9.11.2 <<>> +noedns www.tsp.gov @ns2.tsp.gov ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50317 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;www.tsp.gov. IN A ;; ANSWER SECTION: www.tsp.gov. 900 IN A 74.113.204.129 ;; AUTHORITY SECTION: tsp.gov. 900 IN NS ns1.tsp.gov. tsp.gov. 900 IN NS ns2.tsp.gov. ;; ADDITIONAL SECTION: ns1.tsp.gov. 900 IN A 74.113.206.34 ns2.tsp.gov. 900 IN A 74.113.204.34 ;; Query time: 19 msec ;; SERVER: 74.113.204.34#53(74.113.204.34) ;; WHEN: Tue Jan 02 15:10:38 EST 2018 ;; MSG SIZE rcvd: 113 When I query this host through an Unbound resolver with edns client subnet enabled for 0.0.0.0, it returns a SERVFAIL. Removing send-client-subnet from the Unbound's config allows it to resolve. Is there any config I'm missing to allow Unbound to fallback to querying without edns client subnet if a query with it fails? Or is there a way to blacklist just those authoritatives without having to whitelist all other subnets? Thanks, -Dan
