From: Miod Vallat <miod.vallat@powerdns.com>
Date: Fri, 10 Jul 2026 10:22:07 +0000 (+0200)
Subject: Ignore the closing SOA record in IXFR-turned-AXFR.
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dede2afda4ca69cca48cd6ace21ff167aae91dff;p=thirdparty%2Fpdns.git

Ignore the closing SOA record in IXFR-turned-AXFR.

Fixes: #12984

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
---

diff --git a/pdns/auth-secondarycommunicator.cc b/pdns/auth-secondarycommunicator.cc
index 4e9036cd05..48044df86e 100644
--- a/pdns/auth-secondarycommunicator.cc
+++ b/pdns/auth-secondarycommunicator.cc
@@ -887,7 +887,8 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
           if (!g_slogStructured) {
             ctx.logPrefix[0] = 'A'; // IXFR -> AXFR
           }
-          bool firstNSEC3 = true;
+          bool firstNSEC3{true};
+          bool soa_received{false};
           rrs.reserve(axfr.size());
           for (const auto& dr : axfr) { // NOLINT(readability-identifier-length)
             auto rr = DNSResourceRecord::fromWire(dr); // NOLINT(readability-identifier-length)
@@ -898,8 +899,12 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
               continue;
             }
             if (dr.d_type == QType::SOA) {
+              if (soa_received) {
+                continue; // skip the last SOA
+              }
               auto sd = getRR<SOARecordContent>(dr); // NOLINT(readability-identifier-length)
               ctx.soa_serial = sd->d_st.serial;
+              soa_received = true;
             }
             rrs.emplace_back(std::move(rr));
           }