From: Ondřej Surý <ondrej@isc.org>
Date: Thu, 2 Jul 2026 13:35:56 +0000 (+0200)
Subject: Add a system test resolving through a signed apex DNAME
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=38992e02bb02fbc0dd23634e80ad9f1c22a23c83;p=thirdparty%2Fbind9.git

Add a system test resolving through a signed apex DNAME

The dnssec system test signs a DNAME-at-apex zone but only ever
queried the apex directly; nothing resolved a name under the DNAME
through the validating resolver, so a validator regression on that
path went unnoticed.

Assisted-by: Claude:claude-fable-5
---

diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
index c0a786cc6cf..918032ad1c4 100644
--- a/bin/tests/system/dnssec/tests_validation.py
+++ b/bin/tests/system/dnssec/tests_validation.py
@@ -182,6 +182,19 @@ def test_positive_validation_nsec3():
     isctest.check.rr_count_eq(res2.answer, 1)
 
 
+def test_positive_validation_dname_at_apex():
+    # an apex DNAME is signed by the DNSKEY living at the DNAME owner
+    # name itself; fetching that key must not be mistaken for a
+    # non-advancing alias chain (GL #6176)
+    msg = isctest.query.create("a.dname-at-apex-nsec3.example", "A")
+    res = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.noerror(res)
+    isctest.check.adflag(res)
+    answers = {(str(rr.name), rr.rdtype) for rr in res.answer}
+    assert ("dname-at-apex-nsec3.example.", rdatatype.DNAME) in answers
+    assert ("a.example.", rdatatype.A) in answers
+
+
 def test_positive_validation_optout():
     # positive answer
     msg = isctest.query.create("a.optout.example", "A")