DNS checks read a long TXT record the server splits across lines #64

Merged

jcoffey-dev merged 1 commits from fix/zone-split-txt into main

2026-09-29 17:24:22 +00:00

jcoffey-dev commented

2026-09-29 17:22:44 +00:00

Owner

The server writes a TXT value longer than 255 bytes the way BIND does (dns-update's bind.rs): quoted chunks inside parentheses, one per line. parseZone read a line at a time, so an RSA DKIM key parsed as the record ( and never matched what public DNS returned.

Effect on a real server: the Security page (SS-13) says "example.com is missing DKIM in public DNS" for every domain with an RSA key, and the DNS wizard's record checks and the domain hover card show DKIM missing too.

Fix: join the lines inside parentheses into one record first, dropping the parentheses (but not any inside a quoted value). Tests added for both. Found while building the public demo, which reproduces the false warning against its simulated DNS.

The server writes a TXT value longer than 255 bytes the way BIND does (dns-update's `bind.rs`): quoted chunks inside parentheses, one per line. `parseZone` read a line at a time, so an RSA DKIM key parsed as the record `(` and never matched what public DNS returned. Effect on a real server: the Security page (SS-13) says "example.com is missing DKIM in public DNS" for every domain with an RSA key, and the DNS wizard's record checks and the domain hover card show DKIM missing too. Fix: join the lines inside parentheses into one record first, dropping the parentheses (but not any inside a quoted value). Tests added for both. Found while building the public demo, which reproduces the false warning against its simulated DNS.

jcoffey-dev added 1 commit 2026-09-29 17:22:44 +00:00

DNS checks read a long TXT record the server splits across lines

ci / build (pull_request) Successful in 1m18s

Details

ci / publish (pull_request) Skipped

Details

d6c991e163

The server writes a TXT value longer than 255 bytes the way BIND does:
quoted chunks inside parentheses, one per line. The zone parser read a
line at a time, so an RSA DKIM key was the record "(" and never matched
what public DNS returned. The Security page (SS-13), the DNS wizard's
record checks and the domain hover card all reported DKIM missing for
every domain with an RSA key.

Lines inside parentheses are now joined into one record first, with the
parentheses dropped and any inside a quoted value kept.

jcoffey-dev merged commit f4c738fc40 into main

2026-09-29 17:24:22 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-admin#64