From: Otto Moerbeek <otto.moerbeek@open-xchange.com>
Date: Wed, 6 May 2026 08:09:13 +0000 (+0200)
Subject: If EDNS is mandatory, do it always in the first iteration (#YWH-PGM6095-290)
X-Git-Tag: rec-5.3.8^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b2f7567b5e2ba8d13ea0bf5c8ecd47ee2db14330;p=thirdparty%2Fpdns.git

If EDNS is mandatory, do it always in the first iteration (#YWH-PGM6095-290)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>
---

diff --git a/pdns/recursordist/syncres.cc b/pdns/recursordist/syncres.cc
index 430e340188..c9182c73b6 100644
--- a/pdns/recursordist/syncres.cc
+++ b/pdns/recursordist/syncres.cc
@@ -1483,13 +1483,16 @@ LWResult::Result SyncRes::asyncresolveWrapper(const ComboAddress& address, bool
 
   for (int tries = 0; tries < 2; ++tries) {
 
-    if (mode == EDNSStatus::NOEDNS) {
+    // We might have recorded (due to transient or spoofing issues) the target as not supporting
+    // EDNS. But if we plan to do DNSSEC validation, actually force EDNS for the first try so DNSSEC
+    // has a chance.
+    if ((tries == 0 && ednsMANDATORY) || mode != EDNSStatus::NOEDNS) {
+      EDNSLevel = 1;
+    }
+    else {
       t_Counters.at(rec::Counter::noEdnsOutQueries)++;
       EDNSLevel = 0; // level != mode
     }
-    else if (ednsMANDATORY || mode != EDNSStatus::NOEDNS) {
-      EDNSLevel = 1;
-    }
 
     DNSName sendQname(domain);
     if (g_lowercaseOutgoing) {