Wildcard NSEC validation uses original query name instead of CNAME target across unsigned→signed zone boundary
www.vice.com returns SERVFAIL with DNSSEC Bogus. The domain is unsigned and CNAMEs into savageplatform.go-vip.net, which is signed with a wildcard (*.go-vip.net). I suspect the wildcard NSEC validation fails because it checks whether the NSEC records cover the original query name (www.vice.com.) rather than the CNAME target (savageplatform.go-vip.net.). A name from an entirely different zone will never be covered by go-vip.net's NSEC records, so this always fails.
Version: v0.35.0 Build time: 20260905-163954
The zone security classification from #1926 works, Blocky correctly follows the CNAME across the unsigned to signed boundary. But the NSEC coverage check downstream still carries the original query name through instead of switching to the followed name.
www.vice.com. (unsigned, no DS)
→ CNAME savageplatform.go-vip.net. (signed, wildcard *.go-vip.net)Expected
Blocky checks NSEC non-existence for savageplatform.go-vip.net. → wildcard *.go-vip.net applies → Secure → answer served.
Actual
I think blocky checks NSEC non-existence for www.vice.com. → not covered by go-vip.net NSEC records → Bogus → SERVFAIL.
Logs
[2026-09-16 11:18:07] WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07] WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07] WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=A (www.vice.com.) req_id=76fc85d5-1010-4043-a8ec-4847965989aa
[2026-09-16 11:18:07] INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=7 instance=blocky-m45ck question_name=www.vice.com. question_type=A response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS
[2026-09-16 11:18:07] WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07] WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07] WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=AAAA (www.vice.com.) req_id=a0cc315c-2549-4ade-8770-485b3e62f49c
[2026-09-16 11:18:07] INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=6 instance=blocky-m45ck question_name=www.vice.com. question_type=AAAA response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS
[2026-09-16 11:18:07] WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07] WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07] WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=A (www.vice.com.) req_id=2110338d-1527-49f6-82f7-1d009264e58c
[2026-09-16 11:18:07] INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=3 instance=blocky-m45ck question_name=www.vice.com. question_type=A response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUS
[2026-09-16 11:18:07] WARN dnssec: All RRSIG verification attempts failed for savageplatform.go-vip.net. (tried 1 signatures), last error: wildcard validation failed: wildcard NSEC validation failed: no NSEC record covers query name www.vice.com. to prove non-existence
[2026-09-16 11:18:07] WARN dnssec: Answer validation failed for www.vice.com.: Bogus
[2026-09-16 11:18:07] WARN dnssec: DNSSEC validation failed for www.vice.com. - returning SERVFAIL client_ip=**** client_names=**** question=AAAA (www.vice.com.) req_id=e57dd0e7-5d70-404e-beb2-08b4e7cd1758
[2026-09-16 11:18:07] INFO queryLog: query resolved client_ip=**** client_names=**** duration_ms=3 instance=blocky-m45ck question_name=www.vice.com. question_type=AAAA response_code=SERVFAIL response_reason=DNSSEC validation failed: bogus signatures response_type=BOGUSdnsviz.net analysis:
Config
dnssec:
validate: true
maxChainDepth: 15
maxUpstreamQueries: 50
maxNSEC3Iterations: 100
cacheExpirationHours: 2Related
- #1926 similar about unsigned→signed CNAME , but addressed zone classification, not the NSEC name substitution
- I don't think the transient/timeout fixes (#2120, #2127, #2139) are applicable here, the responses are very fast
Source: 0xERR0R/blocky