[Unbound-users] Behaviour when authorative zone is more specific than stub-zone

[Patrik Lundin]

Hello,

This question is based on a thread over at the OpenBSD misc@ mailing
list. The most recent post pretty much summarises it:
http://marc.info/?l=openbsd-misc&m=140958733719308&w=2

It seems more than one person has been trying to use a stub-zone
clause in unbound along the following lines:
===
stub-zone:
        name: "10.in-addr.arpa."
        stub-addr: some-ip-addr
===

... The NSD server would then be authorative for a more specific zone like
"0.0.10.in-addr.arpa".

Is the result described in the thread above expected by the people on
this list? I'll insert my test result here for easy reference:

> 
> To me the following is seen:
> # dig @127.0.0.1 -x 10.0.0.1 <-- works
> # dig @127.0.0.1 -x 10.0.0.2 <-- fails
> # dig @127.0.0.1 -x 10.0.0.3 <-- works
> # dig @127.0.0.1 -x 10.0.0.4 <-- works
> 
> Basically the first lookup works, the second ends up at IANA (as if the
> stub-zone configuration did not exist), and any
> following lookups work again.
>

My current idea (as written in a different message in the thread) is
that it is just undefined behaviour from telling unbound that the server
is authorative for a zone that it actually is not.

I just think it would be interesting to your opinions instead of relying on my
own hunch. The easy soluition is of course to use matching zone names in both
configurations.

Regards,
Patrik Lundin