DS Record not properly handled when "upstream DNS server" is set

[lekoOwO]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to report a bug and not ask a question or ask for help

• I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

Linux, AMD64 (aka x86_64)

Installation

GitHub releases or script from README

Setup

On one machine

AdGuard Home version

v0.107.36

Action

I've set up like

1.1.1.1
[/my.internal.domain/]192.168.0.1

to make queries to my.internal.domain forward to 192.168.0.1
but this makes the query for DS records of my.internal.domain forwarded to 192.168.0.1 too.

RFC3658 says that "DS RRsets MUST NOT appear at non-delegation points or at a zone's apex", thus the query for DS record of my.internal.domain should be forwarded to where we query internal.domain, that is, 1.1.1.1 .

Expected result

The query for DS record of my.internal.domain should be forwarded to where we query internal.domain, that is, 1.1.1.1

Actual result

The query for DS record is forwarded to 192.168.0.1

Additional information and/or screenshots

No response

[lekoOwO]

BTW, PowerDNS Recursor advises that user add their own DS records/NTA to its config file

IMPORTANT: When using DNSSEC validation (which is default), forwards to non-delegated (e.g. internal) zones that have a DNSSEC signed parent zone will validate as Bogus. To prevent this, add a Negative Trust Anchor (NTA) for this zone in the lua-config-file with addNTA("your.zone", "A comment"). If this forwarded zone is signed, instead of adding NTA, add the DS record to the lua-config-file. See the DNSSEC in the PowerDNS Recursor information.

Quoted from https://doc.powerdns.com/recursor/settings.html#forward-zones

but i think it can be done better by querying the DS records from the parent zone

[EugeneOne1]

@lekoOwO, hello and apologies for the late reply. We've finally pushed the fix for this, so could you please try installing the edge release and see if it now redirects DS requests to where they should go?

[EugeneOne1]

@lekoOwO, it's released within the v0.107.39. Consider reopening this issue if you'll face any bugs with our implementation.