EDNS Compliance Tester

Checking: 'www.bfopcu.eg.net' as at 2024-04-11T03:19:41Z

www.bfopcu.eg.net. @195.43.0.49 (ns.eunet.eg.net.): dns=nosoa zflag=nosoa edns=nosoa edns1=ok edns@512=ok,notc ednsopt=nosoa edns1opt=ok do=nosoa ednsflags=nosoa docookie=nosoa edns512tcp=ok optlist=nosoa

The Following Tests Failed

Warning: test failures may indicate that some DNS clients cannot resolve the zone or will get a unintended answer or resolution will be slower than necessary.

Warning: failure to address issues identified here may make future DNS extensions that you want to use ineffective. In particular echoing back unknown EDNS options and unknown EDNS flags will break future signaling between DNS client and DNS server. We already have examples of this where you cannot depend on the AD flag bit meaning anything in replies because too many DNS servers just echo it back. Similarly the EDNS Client Subnet (ECS) option cannot just be sent to everyone in part because of servers just echoing it back.

• Plain DNS (dns)

  dig +norec +noad +noedns soa zone @server
  expect: SOA
  expect: NOERROR

• Plain EDNS (edns)

  This is the style of the initial query that BIND 9.0.x sends.

  dig +nocookie +norec +noad +edns=0 soa zone @server
  expect: SOA
  expect: NOERROR
  expect: OPT record with version set to 0
  expect: EDNS over IPv6
  See RFC6891

• EDNS - Unknown Option Handling (ednsopt)

  dig +nocookie +norec +noad +ednsopt=100 soa zone @server
  expect: SOA
  expect: NOERROR
  expect: OPT record with version set to 0
  expect: that the option will not be present in response
  See RFC6891, 6.1.2 Wire Format

• EDNS - DNSSEC (do)

  This is the style of then initial query that BIND 9.1.0 - BIND 9.10.x sends.

  dig +nocookie +norec +noad +dnssec soa zone @server
  expect: SOA
  expect: NOERROR
  expect: OPT record with version set to 0
  expect: DO flag in response if RRSIG is present in response
  See RFC3225

• EDNS - Unknown Flag Handling (ednsflags)

  dig +nocookie +norec +noad +ednsflags=0x80 soa zone @server
  expect: SOA
  expect: NOERROR
  expect: OPT record with version set to 0
  expect: Z bits to be clear in response
  See RFC6891, 6.1.4 Flags

• EDNS - DNSSEC with DNS COOKIE Option (docookie)

  This is the style of the initial query that BIND 9.11.0 and BIND 9.10.4 Windows onwards send.

  dig +cookie +norec +noad +dnssec soa zone @server
  expect: SOA
  expect: NOERROR
  expect: OPT record with version set to 0
  expect: DO flag in response if RRSIG is present in response
  See RFC3225, RFC6891, and RFC7873.

• EDNS - Supported Options Probe (optlist)

  dig +edns +noad +norec +nsid +subnet=0.0.0.0/0 +expire +cookie -q zone @server
  expect: NOERROR
  expect: OPT record with version set to 0
  See RFC6891

• Plain DNS with last reserved header bit set (zflag)

  dig +norec +noad +noedns +zflag soa zone @server
  expect: SOA
  expect: NOERROR
  expect: Z bit to be clear in response
  See RFC1035, 4.1.1. Header section format

Codes

• ok - test passed.
• nosoa - SOA record not found when expected.

To retrieve this report in the future: https://ednscomp.isc.org/ednscomp/366ebbeee0

The source code for the tester can be downloaded from ISC Open Source Projects / DNS-Compliance-Testing.

For more information about EDNS please see the main site.

© 2015 Internet Systems Consortium - Powered By: CGIC (License) - Thomas Boutell