`hickory-dns` responds to `dig A doesnotexist.fqdn.com.` with NOERROR instead of with NXDOMAIN about hickory-dns

[bluejekyll]

There's an interesting case where it's NXDOMAIN if there are no other records at that name, but if there are any, then it's supposed to be NOERROR and no record to indicate other records besides the one queried do exist at that name.

using CLI resolver from our library, I'm getting an A record at that name:

>  resolve doesnotexist.nameservers.com 
Querying for doesnotexist.nameservers.com A from udp:8.8.8.8:53, tcp:8.8.8.8:53, udp:8.8.4.4:53, tcp:8.8.4.4:53, udp:[2001:4860:4860::8888]:53, tcp:[2001:4860:4860::8888]:53, udp:[2001:4860:4860::8844]:53, tcp:[2001:4860:4860::8844]:53
Success for query doesnotexist.nameservers.com IN A
        doesnotexist.nameservers.com. 7200 IN A 208.91.197.132

Maybe this was changed after your test?

[japaric]

using CLI resolver from our library, I'm getting an A record at that name:

that's because that CLI resolver has internet access and access to the public DNS network. I guess something similar if I run dig @1.1.1.1 A doesnotexist.nameservers.com (note the public DNS resolver 1.1.1.1)

In contrast to that, all the nodes in the test are in a private, local network with no internet access so they never contact root servers like a.root-servers.net. the name servers in the tests do not contain a doesnotexist.nameservers.com A record; nor wildcard records that would match the A doesnotexist.nameservers.com query

[bluejekyll]

Got it. For what it's worth, DNS has this reserved the .test. TLD for testing use cases, which can be better to use as it ensures that no requests ever go to the internet for the TLD. It might (depends on what is being tested I guess) a good idea to generally use that.

[bluejekyll]

rereading this, it does look like this should be an NXDOMAIN. I have been wanting to setup some test cases in the hickory repo itself for tests like this so that we can more easily guarantee behavior. I'm trying to figure out why we would end up with a NOERROR in this case, definitely seems like it should be NXDOMAIN. It looks like there's a bit of a recursive set of references here... I wonder if that got triggered by looping? I'd have to recreate this test case.