Strange reference to localhost IP addresses in Consistency05

[matsduf]

When running a test on mnc001.mcc240.pub.3gppnetwork.org or mnc002.mcc240.pub.3gppnetwork.org Zonemaster refer to localhost IP addresses (127.0.0.1 and ::1) that cannot be found when doing lookups with e.g. dig. Below the result of tests with zonemaster-cli are presented.

In the results note e.g dns358.fi.telia.net./127.0.0.1 and ns.hi3gaccess.se./::1.

$ zonemaster-cli --test consistency05 mnc001.mcc240.pub.3gppnetwork.org

Seconds Level    Testcase       Message
======= ======== ============== =======
   8.04 ERROR    Consistency05  Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (dns358.fi.telia.net./127.0.0.1;dns358.fi.telia.net./::1) and any equivalent address record found in authoritative zone (dns358.fi.telia.net./88.194.40.67).
   8.05 ERROR    Consistency05  Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (dns2.telia.com./127.0.0.1;dns2.telia.com./::1) and any equivalent address record found in authoritative zone (dns2.telia.com./2001:2040:c001:401::6;dns2.telia.com./81.228.10.67).
   8.06 ERROR    Consistency05  Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (dns1.telia.com./127.0.0.1;dns1.telia.com./::1) and any equivalent address record found in authoritative zone (dns1.telia.com./2001:2040:c001:101::5;dns1.telia.com./81.228.11.67).
   8.07 ERROR    Consistency05  Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (dns49.de.telia.net./127.0.0.1;dns49.de.telia.net./::1) and any equivalent address record found in authoritative zone (dns49.de.telia.net./2001:2030:c000:5::4;dns49.de.telia.net./213.248.77.82).

$ zonemaster-cli --test consistency05 mnc002.mcc240.pub.3gppnetwork.org

Seconds Level    Testcase       Message
======= ======== ============== =======
   6.31 ERROR    Consistency05  Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (ns.hi3gaccess.se./127.0.0.1;ns.hi3gaccess.se./2a02:aa0::53;ns.hi3gaccess.se./80.251.192.244;ns.hi3gaccess.se./::1) and any equivalent address record found in authoritative zone (ns.hi3gaccess.se./2a02:aa0::53;ns.hi3gaccess.se./80.251.192.244).
   6.33 ERROR    Consistency05  Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (ns2.hi3gaccess.se./127.0.0.1;ns2.hi3gaccess.se./2a02:aa0::54;ns2.hi3gaccess.se./80.251.192.245;ns2.hi3gaccess.se./::1) and any equivalent address record found in authoritative zone (ns2.hi3gaccess.se./2a02:aa0::54;ns2.hi3gaccess.se./80.251.192.245).

Test results can also be found on https://zonemaster.se/en/result/2c989f23ca522ccc/ and https://zonemaster.se/en/result/23250942dd4ef08c/, respectively.

[matsduf]

PR zonemaster/zonemaster#1514 adds two test scenarios that in the test zone environment reproduce the bug reported in this issue.

What triggers the bug in Zonemaster is the fact that that some of the NS of the parent zone (3gppnetwork.org) host a root zone with wildcard records, e.g.

$ dig @ns3.1630167.cloudns.net '*' A +noedns

; <<>> DiG 9.20.24 <<>> @ns3.1630167.cloudns.net * A +noedns
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1989
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;*.				IN	A

;; ANSWER SECTION:
*.			120	IN	A	127.0.0.1

;; AUTHORITY SECTION:
.			120	IN	NS	localhost.

;; Query time: 4 msec
;; SERVER: 2a06:fb00:2::3:36#53(ns3.1630167.cloudns.net) (UDP)
;; WHEN: Wed Jul 01 15:57:00 UTC 2026
;; MSG SIZE  rcvd: 57

You can test with RR type AAAA and TXT too. You can test the other ".cloudns." servers too. And you can replace "*" with any name of you choice, e.g. "dns2.telia.com".

Zonemaster should not be affected by that root zone.

[matsduf]

I want to add the following for you to better understand what is going on.

During the process of Consistency05 Zonemaster sends queries for address records (A and AAAA) for the names that the out-of-bailiwick NS points at (i.e. the name server names) to the name servers of the parent zone. When DNS records are returned (such in this case when some parent servers host a root zone with wildcard address records) they are included as glue records in the delegation from the parent zone. It is not expected to send such queries, and in most cases no records are returned in the response (rather a REFUSED).

Consistency05 must be updated to get rid of the behavior.

To see the queries that Zonemaster sends, run zonemaster-cli with debug level 3. Preferably limiting the tests to the specific test case. With "--raw" only the tag is outputted, not the entire message.

zonemaster-cli --level debug3 --raw --test consistency05 mnc001.mcc240.pub.3gppnetwork.org

Look for "127.0.0.1" to see the unwanted responses.