NOERROR with bind backend, NXDOMAIN with gmysql

[Priviatech]

• Program: Authoritative
• Issue type: Bug report

Short description

A mail operator pointed out a DKIM reccord without any selector (i.e _domainkey.domain.com) should return a NOERROR code, not a NXDOMAIN (no mention of this in RFC 6376, but Google, Microsoft and Yahoo respect that). This mail operator checks _domainkey.domain.com before selector._domainkey.domain.com.

PowerDNS returns NOERROR with bind backend, but NXDOMAIN with gmysql backend

Environment

• Operating system: Debian 12
• Software version: PowerDNS Authoritative Server 4.7.3
• Software source: Debian repository

Steps to reproduce

With bind backend:

1. Setup PowerDNS with bind backend
2. Add domain.com
3. Set a TXT record for selector1._domainkey.domain.com
4. Ask for _domainkey.domain.com
   With gmysql backend:
5. Setup PowerDNS with gmysql backend
6. Add domain.com
7. Set a TXT record for selector1._domainkey.domain.com
8. Ask for _domainkey.domain.com

Expected behaviour

Get a NOERROR answer in both cases

Actual behaviour

Getting a NOERROR with bind backend, but a NXDOMAIN with gmysql backend

Other information

• One can reproduce with two backends running at once: one bind and one gmysql. Domains on bind backend returns NOERROR, domains on Gmysql return NXDOMAIN

• A workaround is to put an empty TXT record for _domainkey.domain.com

[pieterlexis]

did you rectify the zone in the database after modifying it? See: https://doc.powerdns.com/authoritative/backends/generic-sql.html#handling-dnssec-signed-zones

[Priviatech]

did you rectify the zone in the database after modifying it? See: https://doc.powerdns.com/authoritative/backends/generic-sql.html#handling-dnssec-signed-zones

I runned
pdnsutil rectify-all-zones:

Jul 07 16:42:08 [bindbackend] Done parsing domains, 0 rejected, 1 new, 0 removed
Rectifying domain1.com: Adding empty non-terminals for non-DNSSEC zone 'domain1.com', 1 updates
Rectifying domain2.com: Adding empty non-terminals for non-DNSSEC zone 'domain2.com', 1 updates
Rectified 2 zones.

domain1.com is on gmysql backend > Still get NXDOMAIN on no-selector-DKIM record
domain2.com is on bind backend

[pieterlexis]

The database results are cached for a minute or so (query cache), so please retry :). Also, please let us know the real domains (as mentioned in our support policy) so we can query/test this ourselves?

[Priviatech]

Hmmm, ok just saw that rectify-zone adds a NULL _domainkey.domain.com record.

Is it mandatory only for subdomains starting with an underscore?

Anyway thank you very much!