Baike.dev
Log in
Back to tool/Back to issues
#7756·coredns

DNSSEC resolve error on not present record types

Author: Al2KlimovCreated Dec 9, 2025Updated Aug 19, 2026
Labelsbug

$ dig +short @9.9.9.9 NS acme.al2klimov.de ns1.al2klimov.de. $ dig +short @9.9.9.9 A ns1.al2klimov.de 162.55.223.79 $ dig +short @9.9.9.9 AAAA ns1.al2klimov.de 2a01:4f8:c0c:a5b1::1

ns1.al2klimov.de:53 is a CoreDNS-1.13.1 with this config:

acme.al2klimov.de {
  forward . 127.0.0.1:553
  dnssec {
    key file /run/credentials/coredns.service/acme.al2klimov.de
  }
}

And it seems this config works perfectly fine:

$ dig +short @9.9.9.9 A acme.al2klimov.de 162.55.223.79 $ dig +short @9.9.9.9 AAAA acme.al2klimov.de 2a01:4f8:c0c:a5b1::1

Even records not present on purpose work fine:

$ dig @9.9.9.9 CAA lolcat.acme.al2klimov.de
; <<>> DiG 9.20.15 <<>> @9.9.9.9 CAA lolcat.acme.al2klimov.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61945
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;lolcat.acme.al2klimov.de.	IN	CAA

;; AUTHORITY SECTION:
acme.al2klimov.de.	3600	IN	SOA	ns1.al2klimov.de. soa\.acme\.d60dbb83.bildschirm-sperren.de. 2025120608 28800 7200 604800 86400

;; Query time: 182 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Tue Dec 09 21:06:53 CET 2025
;; MSG SIZE  rcvd: 130

Just when the domain name, e.g acme.al2klimov.de, is basically there, but doesn't have a particular record type, e.g CAA, things break:

$ dig @9.9.9.9 CAA acme.al2klimov.de
; <<>> DiG 9.20.15 <<>> @9.9.9.9 CAA acme.al2klimov.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 46496
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 10 (RRSIGs Missing)
;; QUESTION SECTION:
;acme.al2klimov.de.		IN	CAA

;; Query time: 326 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Tue Dec 09 21:08:12 CET 2025
;; MSG SIZE  rcvd: 52

I've looked directly at the source and that behaves normally:

$ dig @ns1.al2klimov.de CAA acme.al2klimov.de
; <<>> DiG 9.20.15 <<>> @ns1.al2klimov.de CAA acme.al2klimov.de
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44143
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;acme.al2klimov.de.		IN	CAA

;; Query time: 30 msec
;; SERVER: 2a01:4f8:c0c:a5b1::1#53(ns1.al2klimov.de) (UDP)
;; WHEN: Tue Dec 09 21:12:49 CET 2025
;; MSG SIZE  rcvd: 46

This can only mean that a DNSSEC-validating resolver can't be sure that record type actually doesn't exist, i.e missing NSEC.

What happened:

Not present record types of present domain names cause SERVFAIL on DNSSEC resolvers.

What you expected to happen:

On not present record types of present domain names, DNSSEC resolvers return the SOA record.

How to reproduce it (as minimally and precisely as possible):

See the wall of text above.

Anything else we need to know?:

CAA is queried by Let's Encrypt. As that fails, LE refuses to renew certificates.

Environment:

  • the version of CoreDNS: 1.13.1
  • Corefile: see above
  • logs, if applicable: see below
  • OS (e.g: cat /etc/os-release): NixOS 25.11 (Xantusia)
  • Others:
Dec 06 08:01:53 mta systemd[1]: Starting Coredns dns server...
Dec 06 08:01:54 mta systemd[1]: Started Coredns dns server.
Dec 06 08:01:56 mta coredns[1389]: maxprocs: Leaving GOMAXPROCS=2: CPU quota undefined
Dec 06 08:01:56 mta coredns[1389]: acme.al2klimov.de.:53
Dec 06 08:01:56 mta coredns[1389]: CoreDNS-1.13.1
Dec 06 08:01:56 mta coredns[1389]: linux/arm64, go1.25.4,

Source: coredns/coredns

View original on GitHubView discussion on GitHub