Undelegated test failing due to queries to delegated zone

[LeonGr-RIPENCC]

I have a problem where a zonemaster test for a child zone fails, because the parent zone refuses to answer, even though it's an undelegated test. I believe this may be related to #1451, but it's a slight different situation:

We want to create the following delegations in 127.in-addr.arpa:

0.228.127.in-addr.arpa NS ns1.example.net
0.228.127.in-addr.arpa NS ns2.example.net

So we do an undelegated test of 0.228.127.in-addr.arpa with zonemaster, specifying nameservers ns1.example.net and ns2.example.net.

However, the following delegations currently still exists in 127.in-addr.arpa:

228.127.in-addr.arpa NS ns1.example.net
228.127.in-addr.arpa NS ns2.example.net

So zonemaster will ask ns1.example.net and ns2.example.net for the SOA/NS records for 228.127.in-addr.arpa, but those return REFUSED, since these records have been replaced with records for 0.228.127.in-addr.arpa.
This causes test BASIC02 to fail with B02_NO_DELEGATION. Even though the specified nameservers return the expected records.

Could this have been prevented by still serving SOA and NS records in the 228.127.in-addr.arpa zone, instead of REFUSED? Or is this a problem with zonemaster?

[matsduf]

You want to test a possible delegation to ns1 and ns2.example.net. Should those have the same IP addresses as the actual ns1 and ns2 in the public DNS tree? Else you have to specify the A and AAAA records for those.

[matsduf]

ns1 and ns2.example.net do not exist in the public DNS tree, which means that you have to provide the IP addresses. Or do you have a local root? If so you can provide a local hint to Zonemaster.

[LeonGr-RIPENCC]

Hi Mats, thank you for your response. I should have specified that ns1 and ns2.example.net are just examples. In the actual test the user used nameservers that exist in the public DNS tree. 0.228.127.in-addr.arpa is also an example. The actual address used was a non-RFC1918 address.

[matsduf]

Using your example IP space above, is the following a correct scenario?

228.127.in-addr.arpa is hosted on dns0 and dns1.example.net and works correctly

0.228.127.in-addr.arpa is delegated from 228.127.in-addr.arpa with:

228.127.in-addr.arpa. NS ns10.example.net.
228.127.in-addr.arpa. NS ns20.example.net.

but neither ns10 nor ns20 has the zone (or parent) and replies with REFUSED on queries on that zone. Now you want to do an undelegated test of

228.127.in-addr.arpa. NS ns30.example.net.
228.127.in-addr.arpa. NS ns40.example.net.

where ns30 and ns40 are configured with that zone and will reply with NOERROR on an SOA query.

[LeonGr-RIPENCC]

It's a little bit different, I'll try to explain it in a different way. The nameservers should not change, ns10.example.net and ns20.example.net will keep being used.

In 127.in-addr.arpa there is currently a delegation for the entire /16:

228.127.in-addr.arpa NS ns10.example.net
228.127.in-addr.arpa NS ns20.example.net

The goal is to remove the /16 delegation from 127.in-addr.arpa and replace it with a number of /24 delegations. All /24s will also be hosted on ns10 and ns20:

0.228.127.in-addr.arpa NS ns10.example.net
0.228.127.in-addr.arpa NS ns20.example.net
1.228.127.in-addr.arpa NS ns10.example.net
1.228.127.in-addr.arpa NS ns20.example.net
...

ns10 and ns20 are already configured to support the goal scenario: ns10 and ns20 previously replied with NOERROR on a SOA query for 228.127.in-addr.arpa, but now replies with REFUSED.
ns10 and ns20 now reply with NOERROR on a SOA query for 0.228.127.in-addr.arpa, 1.228.127.in-addr.arpa, etc.

To test whether ns10 and ns20 are configured correctly, we do an undelegated test for 0.228.127.in-addr.arpa. Unfortunately, the test fails during the delegated test, because the nameserver with the 127.in-addr.arpa zone still has the /16 delegation, and ns10 and ns20 reply with REFUSED for queries for 228.127.in-addr.arpa.

[matsduf]

Thank you for the clarification. I will create new [test scenarios for Basci02] to make sure we can replicate the issue. I will also include the scenario I described above (but which was not correct for your case).

The behavior is unfortunate. For an undelegated test, the parent zone is irrelevant.

https://github.com/zonemaster/zonemaster/blob/master/docs/public/specifications/test-zones/Basic-TP/basic02.md: [test scenarios for Basci02]