| CARVIEW |
Select Language
HTTP/2 200
date: Wed, 16 Jul 2025 21:25:35 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
link: ; rel=preload; as=fetch; crossorigin=use-credentials
referrer-policy: no-referrer-when-downgrade
server-timing: issue_layout-fragment;desc="issue_layout fragment";dur=222.385422,issue_conversation_content-fragment;desc="issue_conversation_content fragment";dur=546.580197,issue_conversation_sidebar-fragment;desc="issue_conversation_sidebar fragment";dur=47.09604,nginx;desc="NGINX";dur=1.207791,glb;desc="GLB";dur=95.514863
strict-transport-security: max-age=31536000; includeSubdomains; preload
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, Accept,Accept-Encoding, Accept, X-Requested-With
x-content-type-options: nosniff
x-frame-options: deny
x-voltron-version: fd8fbbc
x-xss-protection: 0
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=YwkPeQnzDwbkZ2PO3yw5QWXngqiJLqKkmAgiU0gw%2FqAtPG34o79d%2BYYe5kxiizIbccpu%2FA5sz0XR8y9weP3qNKCgBLM1KjZiXYbOHVVUwIQe7loPpZXy3rqvqXKdfOkH3WAimRc3ada5rhIr%2F5ZN00ijxt2EBwrFDn0Czon3x1vtTOK9JiT4Vh69zphXcqQ9%2B6gpEqgiAvKQFnZ8%2F9rJBI74CLUte9Zo0QydC4%2Bxq%2Bf5%2FAodmxK5Qog%2B%2FMhinbwJYUouHA6hTJ%2BLaOqj32g74g%3D%3D--CBEKDJHNztTm%2BVab--3hUyTk34JggxGFttrWBQwA%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1697876109.1752701135; Path=/; Domain=github.com; Expires=Thu, 16 Jul 2026 21:25:35 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Thu, 16 Jul 2026 21:25:35 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: CDD2:202162:BBDE8:102101:687818CF
NSD returns 3 NSEC3 records for NODATA response · Issue #190 · NLnetLabs/nsd · GitHub
No one assignedNo labelsNo typeNo projectsNo milestoneNone yetNo branches or pull requests
Skip to content
Navigation Menu
{{ message }}
-
-
Notifications
You must be signed in to change notification settings - Fork 112
Closed
Description
While debugging queries for ira.go.ug/DS, I have noticed that NSD returns 3 NSEC3 records in the authority section. I don't believe the extra NSEC3 record causes any harm. However, operationally, it has a consequence, which is a bigger response, compared to say BIND or Knot DNS. If an NSD server limits the UDP buffer size to 1232 (as is the recommendation these days), it causes truncation, and the client tries again over TCP. Compare the following responses:
NSD with 4096-byte buffer size:
; <<>> DiG 9.16.20 <<>> +norec +dnssec ira.go.ug ds @ns.icann.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14066
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;ira.go.ug. IN DS
;; AUTHORITY SECTION:
ug. 14400 IN SOA root.eahd.or.ug. servers.i3c.co.ug. 2017250138 86400 3600 2592000 14400
ug. 14400 IN RRSIG SOA 8 1 14400 20210923210000 20210814210000 63693 ug. [omitted]
8r4475uh5oosjqhv6dhdmccf6mllupgv.ug. 14400 IN NSEC3 1 1 10 799D670A 90U6TO1ODSNCOIFUT34IFNPP1IECC15L NS SOA RRSIG DNSKEY NSEC3PARAM
8r4475uh5oosjqhv6dhdmccf6mllupgv.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
dpk1ca38i2bp09sfh57ishifd8ebi04s.ug. 14400 IN NSEC3 1 1 10 799D670A IA8GCNUUS76RKVEMFSB6O4KQ09S1I5CS NS DS RRSIG
dpk1ca38i2bp09sfh57ishifd8ebi04s.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
qk9e3k4slop401t887vvsnna8lq2fjbs.ug. 14400 IN NSEC3 1 1 10 799D670A SS5UP489HPGNTUTRSH295N0AGS13GJ08 NS DS RRSIG
qk9e3k4slop401t887vvsnna8lq2fjbs.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
NSD with 1232-byte buffer:
;; Truncated, retrying in TCP mode.
; <<>> DiG 9.16.20 <<>> +norec +dnssec +nsid ira.go.ug ds @ns-ug.afrinic.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64509
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; NSID: 73 30 34 2d 6e 73 32 2e 6a 6e 62 ("s04-ns2.jnb")
;; QUESTION SECTION:
;ira.go.ug. IN DS
;; AUTHORITY SECTION:
ug. 14400 IN SOA root.eahd.or.ug. servers.i3c.co.ug. 2017250135 86400 3600 2592000 14400
ug. 14400 IN RRSIG SOA 8 1 14400 20210923210000 20210814210000 63693 ug. [omitted]
8r4475uh5oosjqhv6dhdmccf6mllupgv.ug. 14400 IN NSEC3 1 1 10 799D670A 90U6TO1ODSNCOIFUT34IFNPP1IECC15L NS SOA RRSIG DNSKEY NSEC3PARAM
8r4475uh5oosjqhv6dhdmccf6mllupgv.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
dpk1ca38i2bp09sfh57ishifd8ebi04s.ug. 14400 IN NSEC3 1 1 10 799D670A IA8GCNUUS76RKVEMFSB6O4KQ09S1I5CS NS DS RRSIG
dpk1ca38i2bp09sfh57ishifd8ebi04s.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
qk9e3k4slop401t887vvsnna8lq2fjbs.ug. 14400 IN NSEC3 1 1 10 799D670A SS5UP489HPGNTUTRSH295N0AGS13GJ08 NS DS RRSIG
qk9e3k4slop401t887vvsnna8lq2fjbs.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
And a BIND server:
; <<>> DiG 9.16.20 <<>> +norec +dnssec +nsid ira.go.ug ds @root.eahd.or.ug
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10510
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;ira.go.ug. IN DS
;; AUTHORITY SECTION:
8R4475UH5OOSJQHV6DHDMCCF6MLLUPGV.ug. 14400 IN NSEC3 1 1 10 799D670A 90U6TO1ODSNCOIFUT34IFNPP1IECC15L NS SOA RRSIG DNSKEY NSEC3PARAM
8R4475UH5OOSJQHV6DHDMCCF6MLLUPGV.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
ug. 14400 IN SOA root.eahd.or.ug. servers.i3c.co.ug. 2017250138 86400 3600 2592000 14400
ug. 14400 IN RRSIG SOA 8 1 14400 20210923210000 20210814210000 63693 ug. [omitted]
DPK1CA38I2BP09SFH57ISHIFD8EBI04S.ug. 14400 IN NSEC3 1 1 10 799D670A IA8GCNUUS76RKVEMFSB6O4KQ09S1I5CS NS DS RRSIG
DPK1CA38I2BP09SFH57ISHIFD8EBI04S.ug. 14400 IN RRSIG NSEC3 8 2 14400 20210923210000 20210814210000 63693 ug. [omitted]
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Milestone
Relationships
Development
Issue actions
You can’t perform that action at this time.