Check TLSA lookups for false bogus verdicts too

jcoffey-dev commented

2026-10-05 05:11:52 +00:00

Owner

Mail to chuckmckinnon.com sat in the queue for days with "Error fetching
TLSA record: DNSSEC validation failed". Its MX, mail.usefulinsight.com,
is on Cloudflare, and behind Hetzner's resolvers
_25._tcp.mail.usefulinsight.com answers TLSA with a signed CNAME to the
zone apex, which has no TLSA record. That is the second hickory 0.26.3
bug #72 works around: it checks the denial against the name first asked
for, not the CNAME's target, and calls a valid answer bogus.

#72 put MX and address lookups through validated_lookup but left the
TLSA lookup calling hickory directly. It goes through validated_lookup
now: a signed CNAME is followed, the denial at the target validates, and
the result is "no TLSA record", so delivery goes ahead without DANE as
it should. A TLSA record that rechecks as insecure is treated as no
policy, since DANE needs a signed one.

Cloudflare's own resolver answers that name with a compact denial at the
name itself, which hickory already accepts, so the new ignored test
takes a resolver from INBUXA_TEST_DNS_TCP. Run against 185.12.64.2 over
an SSH bridge from host1, hickory alone fails with "DNSSEC validation
failed", as in production, and validated_lookup returns a non-bogus
denial. smtp lib tests pass; check --all-targets is clean.

Mail to chuckmckinnon.com sat in the queue for days with "Error fetching TLSA record: DNSSEC validation failed". Its MX, mail.usefulinsight.com, is on Cloudflare, and behind Hetzner's resolvers _25._tcp.mail.usefulinsight.com answers TLSA with a signed CNAME to the zone apex, which has no TLSA record. That is the second hickory 0.26.3 bug #72 works around: it checks the denial against the name first asked for, not the CNAME's target, and calls a valid answer bogus. #72 put MX and address lookups through validated_lookup but left the TLSA lookup calling hickory directly. It goes through validated_lookup now: a signed CNAME is followed, the denial at the target validates, and the result is "no TLSA record", so delivery goes ahead without DANE as it should. A TLSA record that rechecks as insecure is treated as no policy, since DANE needs a signed one. Cloudflare's own resolver answers that name with a compact denial at the name itself, which hickory already accepts, so the new ignored test takes a resolver from INBUXA_TEST_DNS_TCP. Run against 185.12.64.2 over an SSH bridge from host1, hickory alone fails with "DNSSEC validation failed", as in production, and validated_lookup returns a non-bogus denial. smtp lib tests pass; check --all-targets is clean.

jcoffey-dev added 1 commit 2026-10-05 05:11:52 +00:00

Check TLSA lookups for false bogus verdicts too

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

ci / github (pull_request) Successful in 6m46s

Details

github/ci (branch) GitHub Actions

Details

c4a6e4d117

Mail to chuckmckinnon.com sat in the queue for days with "Error fetching
TLSA record: DNSSEC validation failed". Its MX, mail.usefulinsight.com,
is on Cloudflare, and behind Hetzner's resolvers
_25._tcp.mail.usefulinsight.com answers TLSA with a signed CNAME to the
zone apex, which has no TLSA record. That is the second hickory 0.26.3
bug #72 works around: it checks the denial against the name first asked
for, not the CNAME's target, and calls a valid answer bogus.

#72 put MX and address lookups through validated_lookup but left the
TLSA lookup calling hickory directly. It goes through validated_lookup
now: a signed CNAME is followed, the denial at the target validates, and
the result is "no TLSA record", so delivery goes ahead without DANE as
it should. A TLSA record that rechecks as insecure is treated as no
policy, since DANE needs a signed one.

Cloudflare's own resolver answers that name with a compact denial at the
name itself, which hickory already accepts, so the new ignored test
takes a resolver from INBUXA_TEST_DNS_TCP. Run against 185.12.64.2 over
an SSH bridge from host1, hickory alone fails with "DNSSEC validation
failed", as in production, and validated_lookup returns a non-bogus
denial. smtp lib tests pass; check --all-targets is clean.

jcoffey-dev merged commit 133d41df36 into main

2026-10-05 05:18:43 +00:00

jcoffey-dev deleted branch fix/tlsa-false-bogus

2026-10-05 05:18:43 +00:00

jcoffey-dev referenced this pull request

2026-10-05 05:19:05 +00:00

Release 2026.10.5 #143

Check TLSA lookups for false bogus verdicts too #142