Question regarding NS lookups made by Coredns

[Jack200062]

Question regarding NS lookups made by Coredns

[chrisohaver]

The question is: With the default coredns setup, meaning there is only "forward /etc/resolv.conf" line in Corefile, can there be any other reasons why Coredns would make such NS lookups?

The health checks are only done when CoreDNS fails to get a DNS response from the upstream (e.g. timeout, connection refused, etc). DNS protocol error type responses (such as REFUSED, NOTIMPL, SERVFAIL, etc), are not considered failures in this context, and those responses are passed along to the client.

[Jack200062]

In forward plugin doc. There is a sentence saying:

Any response that is not a network error (REFUSED, NOTIMPL, SERVFAIL, etc) is taken as a healthy upstream

That's why I thought that if coredns would receive a SERVFAIL response from upstream, it would perform health check with recursive NS . lookup. Am I wrong? Could you clarify please this moment to me, thanks!

[chrisohaver]

I thought that if coredns would receive a SERVFAIL response from upstream, it would perform health check with recursive NS . lookup. Am I wrong? Could you clarify please this moment to me, thanks!

"Any response that is not a network error (REFUSED, NOTIMPL, SERVFAIL, etc) is taken as a healthy upstream"

Therefore...

"A response of SERVFAIL is considered a healthy upstream"

Since in this case the server is considered healthy, no health check is performed.

This is as designed.

[chrisohaver]

"Any response that is not a network error (REFUSED, NOTIMPL, SERVFAIL, etc) is taken as a healthy upstream"

The phrasing in this sentence is ambiguous. "(REFUSED, NOTIMPL, SERVFAIL, etc)" are examples of responses that are not network errors. They are not examples of responses that are network errors. Those Response codes are specifically called out because they look like errors, but they are not network errors.

Nevertheless REFUSED, NOTIMPL, SERVFAIL cannot be network errors, because they are DNS response codes, and the only way you can get a dns response code back is if there was a successful network connection.