Pdns: Weird behavior with non-terminals

[azurit]

Short description

I noticed one quite a big problem with non-terminals - they are causing that master and slave are having different behavior while resolving wildcard subdomains. Imagine this zone:

example.com A 1.1.1.1
*.example.com A 1.1.1.1

With only this, both master and slave (both running PowerDNS) will be able to resolve this hostname:
one.two.example.com

Now add this record:
test.two.example.com A 2.2.2.2

After AXFR, slave will add non-terminal record for two.example.com AND stops resolving two.example.com and *.two.example.com (with NOERROR but empty answer) except test.two.example.com, which resolves fine. Master continues resolving everything.

Sorry for not beeing short.

Environment

PowerDNS 4.0.3
Debian Stretch 64bit

[mnordhoff]

The slaves are working correctly. That's how empty non-terminals and wildcards are supposed to behave. It may not be what you want, but it's how DNS is designed.

As the documentation you linked before says, you can add ENT records on the master by running "pdnsutil rectify-zone example.com", and by making sure to run it in the future whenever you update the zone.

(For example, if you upgrade to PowerDNS 4.1, you can set the API-RECTIFY metadata to automatically rectify when changes are made using the API.)

Then the master and slaves will both behave like the slaves do now.

Can you just set "two.example.com A 1.1.1.1" and "*.two.example.com A 1.1.1.1" records?

[azurit]

I don't understand this 'feature', we are having really huge problems beacuse of it. What is the recommended way of using wildcard records while dealing with 'empty non-terminals'?

We are generating HTTPS certificates using Let's Encrypt, which needs to authorize a domain by creating this TXT DNS record:
_acme-challenge.subdomain.domain.tld

But, when you we do this, the subdomain.domain.tld stops working because of empty non-terminals (because we have only A records domain.tld and *.domain.tld for HUGE simplification of services to us and our users).

[Habbie]

Hello! You have posted a comment on a closed ticket. Such comments are often not noticed, and will certainly be forgotten about.

Furthermore, you are asking a question, not reporting a bug or sending in a feature request. Questions are best handled via IRC or mailing list- see https://www.powerdns.com/opensource.html for more details. Good luck!