From bdc7684609f6c6b87cde21a76f0432387442b82c Mon Sep 17 00:00:00 2001
From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 15 Sep 2020 15:03:34 +0200
Subject: [PATCH] rec: Log when going Bogus because of a missing SOA in
 authority

A missing SOA in the authority section of negative (NXDOMAIN, NODATA)
answers in a DNSSEC-secure zone currently leads to a Bogus result,
because the needed NSEC/NSEC3 could not be validated.

(cherry picked from commit 832f4fbdd7ef50d0e0ff5135ee6e270acc22df9d)
---
 pdns/syncres.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 24b0a8f505..f31137df72 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -3452,6 +3452,7 @@ bool SyncRes::processAnswer(unsigned int depth, LWResult& lwr, const DNSName& qn
     LOG(prefix<<qname<<": status=NXDOMAIN, we are done "<<(negindic ? "(have negative SOA)" : "")<<endl);
 
     if (state == Secure && (lwr.d_aabit || sendRDQuery) && !negindic) {
+      LOG(prefix<<qname<<": NXDOMAIN without a negative indication (missing SOA in authority) in a DNSSEC secure zone, going Bogus"<<endl);
       updateValidationState(state, Bogus);
     }
 
@@ -3466,6 +3467,7 @@ bool SyncRes::processAnswer(unsigned int depth, LWResult& lwr, const DNSName& qn
     LOG(prefix<<qname<<": status=noerror, other types may exist, but we are done "<<(negindic ? "(have negative SOA) " : "")<<(lwr.d_aabit ? "(have aa bit) " : "")<<endl);
 
     if(state == Secure && (lwr.d_aabit || sendRDQuery) && !negindic) {
+      LOG(prefix<<qname<<": NODATA without a negative indication (missing SOA in authority) in a DNSSEC secure zone, going Bogus"<<endl);
       updateValidationState(state, Bogus);
     }
 
-- 
2.47.2