Description of problem: (Based upon the information at https://dnsflagday.net/), There are numerous DNS Vendors that will be removing workarounds for bad responses to EDNS queries. From https://www.isc.org/blogs/dns-flag-day/, it advises "On the authoritative side, PowerDNS 4.1 is fully compliant; 4.0 has some corner cases that ednscomp notices but that are not a problem in practice – disabling caching removes those edge cases." Specifically, using the test utility on dnsflagday.net, it reports the following: EDNS - Unknown Version Handling (edns1) dig +nocookie +norec +noad +edns=1 +noednsneg soa zone @server expect: BADVERS expect: OPT record with version set to 0 expect: not to see SOA See RFC6891, 6.1.3. OPT Record TTL Field Use EDNS - Unknown Version with Unknown Option Handling (edns1opt) dig +nocookie +norec +noad +edns=1 +noednsneg +ednsopt=100 soa zone @server expect: BADVERS expect: OPT record with version set to 0 expect: not to see SOA expect: that the option will not be present in response See RFC6891 Version-Release number of selected component (if applicable): 4.0.6-2.el7 How reproducible: Always Steps to Reproduce: 1. Install pdns, with a public facing IP Address 2. Use that IP Address as the nameserver for a domain 3. Test against dnsflagday.net Actual results: EDNS - Unknown Version Handling (edns1) dig +nocookie +norec +noad +edns=1 +noednsneg soa mboxlogin.com @ns1.nameserverns.com expect: BADVERS expect: OPT record with version set to 0 expect: not to see SOA See RFC6891, 6.1.3. OPT Record TTL Field Use EDNS - Unknown Version with Unknown Option Handling (edns1opt) dig +nocookie +norec +noad +edns=1 +noednsneg +ednsopt=100 soa mboxlogin.com @ns1.nameserverns.com expect: BADVERS expect: OPT record with version set to 0 expect: not to see SOA expect: that the option will not be present in response See RFC6891 Expected results: That the check on https://dnsflagday.net/ does not result in the above 2 errors. Additional info: https://www.isc.org/blogs/dns-flag-day/ is claiming that pdns 4.0.x (what is in EPEL 7) has edge cases, but pdns 4.1.x should be fully compliant with what is expected for EDNS handling.
pdns-4.1.6-1.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bcf7340f15
pdns-4.1.6-1.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bcf7340f15
pdns-4.1.6-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.