No NXDOMAIN when the answer is empty

[42wim]

Subtle bug, we found in production. dig works, but some applications fail.

We only need to send the SOA record when the answer is empty, not NXDOMAIN (because the resource exists, it only doesn't have the required type), otherwise no other records will be asked.

@ryanbreen could you merge this ?

[ryanbreen]

Should we send NODATA? https://engineering.opendns.com/2014/06/23/nxdomain-nodata-debugging-dns-dual-stacked-hosts/

[42wim]

Seems like NODATA is the same as NOERROR (pseudo OPCODE)

From the document: 'From the output we can see that our status code is “noerror”, and there is no answer section, this is dig’s way of showing a NODATA response'

See https://www.ietf.org/rfc/rfc2308.txt on page 4 - 2.2 - No Data

NODATA is indicated by an answer with the RCODE set to NOERROR and no relevant answers in the answer section. The authority section will contain an SOA record, or there will be no NS records there. NODATA responses have to be algorithmically determined from the response's contents as there is no RCODE value to indicate NODATA. In some cases to determine with certainty that NODATA is the correct response it can be necessary to send another query.

[ryanbreen]

Cool, makes sense to me. Thanks!