Skip to content

AXFRDDNS: Add missing ALPN token 'dot'#4207

Open
Mr-Foo wants to merge 1 commit intoDNSControl:mainfrom
Mr-Foo:fix/axfrddns-alpn
Open

AXFRDDNS: Add missing ALPN token 'dot'#4207
Mr-Foo wants to merge 1 commit intoDNSControl:mainfrom
Mr-Foo:fix/axfrddns-alpn

Conversation

@Mr-Foo
Copy link
Copy Markdown

@Mr-Foo Mr-Foo commented Apr 25, 2026

AXFRDDNS does not comply with RFC 9103 "DNS Zone Transfer over TLS " section 7.1 "Connection Establishment", which states:

During connection establishment, the Application-Layer Protocol
Negotiation (ALPN) token "dot" [DoT-ALPN] MUST be selected in the TLS
handshake. [1]

Without ALPN bind (tested 9.20.22) refuses to return the zone:

(16.172.in-addr.arpa): view default: query failed (no ALPN) for 16.172.in-addr.arpa/IN/AXFR at query.c:12143

While dnscontrol logs:

INFO#1: Domain "16.172.in-addr.arpa" provider axfrddns Error: [Error] AXFRDDNS: nameserver refused to transfer the zone 16.172.in-addr.arpa: dns: bad xfr rcode: 2

Since the requirement in RFC 9103 is strict, I propose to unconditionally add NextProtos: dot.

[1] RFC 9103

@Mr-Foo
Copy link
Copy Markdown
Author

Mr-Foo commented Apr 25, 2026

@hnrgrgr please review.

@TomOnTime
Copy link
Copy Markdown
Collaborator

Thank you for sending this!

Right now the project is in transition but I hope to be able to address this once we've moved to our new git org.

@Mr-Foo
Copy link
Copy Markdown
Author

Mr-Foo commented Apr 30, 2026

Thank you for your consideration.

I will be happy to revisit this PR once you are ready.

@TomOnTime
Copy link
Copy Markdown
Collaborator

CC @hnrgrgr for confirmation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants