From: Mark Andrews <marka@isc.org>
Date: Fri, 30 Jan 2026 02:45:39 +0000 (+1100)
Subject: Correctly identify forwarded queries with DNSTAP
X-Git-Tag: v9.21.19~24^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=38b626d58d9e7ee8075ec096861fe880e4dba73f;p=thirdparty%2Fbind9.git

Correctly identify forwarded queries with DNSTAP

Queries using forwarders where not being correctly identified
when using dnstap.
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index f09b502ba67..38e4411820e 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2862,7 +2862,7 @@ resquery_send(resquery_t *query) {
 	/*
 	 * Log the outgoing query via dnstap.
 	 */
-	if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) {
+	if (ISFORWARDER(query->addrinfo)) {
 		dtmsgtype = DNS_DTTYPE_FQ;
 	} else {
 		dtmsgtype = DNS_DTTYPE_RQ;
@@ -9421,7 +9421,13 @@ rctx_logpacket(respctx_t *rctx) {
 	}
 	dns_compress_invalidate(&cctx);
 
-	if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) {
+	/*
+	 * Check if the response came from a forwarder to correctly
+	 * classify as Forward Response (FR) vs Recursive Response (RR)
+	 * for DNSTAP logging. This is more accurate than using the RD
+	 * flag which only indicates the original query intent.
+	 */
+	if (ISFORWARDER(rctx->query->addrinfo)) {
 		dtmsgtype = DNS_DTTYPE_FR;
 	} else {
 		dtmsgtype = DNS_DTTYPE_RR;