NTAs do not work with "forward only;" to a validating resolver
If named is configured to perform DNSSEC validation and also forwards all queries (forward only;) to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data.
To reproduce the issue:
- Configure a
namedinstance withforward only; forwarders { 2620:ff:c000:0:1::64:20; };(OARC Validating Resolver) - Add an NTA for
dnssec-failed.org:rndc nta dnssec-failed.org. - Send a query for bogus data:
dig @localhost dnssec-failed.org.- it will SERVFAIL instead of returning an insecure response