# NAMESERVER11: Test for unknown EDNS OPTION-CODE

## Test case identifier
**NAMESERVER11**

## Table of contents

* [Objective](#objective)
* [Scope](#scope)
* [Inputs](#inputs)
* [Summary](#summary)
* [Test procedure](#test-procedure)
* [Outcome(s)](#outcomes)
* [Special procedural requirements](#special-procedural-requirements)
* [Intercase dependencies](#intercase-dependencies)
* [Terminology](#terminology)

## Objective

EDNS is a mechanism to announce capabilities of a DNS implementation,
and is now basically required by any new functionality in DNS such as
DNSSEC ([RFC 6891]).

[RFC 6891][RFC 6891, section 6.1.2], section 6.1.2, states that any OPTION-CODE values
not understood by a responder or requestor MUST be ignored. Unknown OPTION-CODE values
must be processed as though the OPTION-CODE was not even there.

In this test case, we will query with an unknown EDNS OPTION-CODE and expect
that the OPTION-CODE is not present in the response for the query.

## Scope

It is assumed that *Child Zone* is also tested and reported by [Connectivity01]. This
test case will just ignore non-responsive name servers or name servers not
giving a correct DNS response for an authoritative name server.

It is assumed that *Child Zone* has been tested and reported by [Nameserver02].
Running this test case without running [Nameserver02] can give an incomplete
report status of *Child Zone*.

## Inputs

"Child Zone" - The domain name to be tested.

## Summary

Message Tag                       | Level   | Arguments         | Message ID for message tag
:---------------------------------|:--------|-------------------|---------------------------------------------
N11_NO_EDNS                       | WARNING | ns_ip_list        | The DNS response, on query with unknown EDNS option-code, does not contain any EDNS from name servers "{ns_ip_list}".
N11_NO_RESPONSE                   | WARNING | ns_ip_list        | There is no response on query with unknown EDNS option-code from name servers "{ns_ip_list}".
N11_RETURNS_UNKNOWN_OPTION_CODE   | WARNING | ns_ip_list        | The DNS response, on query with unknown EDNS option-code, contains an unknown EDNS option-code from name servers "{ns_ip_list}".
N11_UNEXPECTED_ANSWER_SECTION     | WARNING | ns_ip_list        | The DNS response, on query with unknown EDNS option-code, does not contain the expected SOA record in the answer section from name servers "{ns_ip_list}".
N11_UNEXPECTED_RCODE              | WARNING | ns_ip_list, rcode | The DNS response, on query with unknown EDNS option-code, has unexpected RCODE name "{rcode}" from name servers "{ns_ip_list}".
N11_UNSET_AA                      | WARNING | ns_ip_list        | The DNS response, on query with unknown EDNS option-code, is unexpectedly not authoritative from name servers "{ns_ip_list}".


The value in the Level column is the default severity level of the message. The
severity level can be changed in the [Zonemaster-Engine profile]. Also see the
[Severity Level Definitions] document.

The argument names in the Arguments column lists the arguments used in the
message. The argument names are defined in the [argument list].

## Test procedure

In this section and unless otherwise specified below, the term "[EDNS Query]"
follows the specification for DNS queries as specified in [DNS Query and Response Defaults].
The handling of the DNS responses on the DNS queries follow, unless otherwise specified below,
what is specified for [EDNS Response] in the same specification.

1. Create the following empty sets:
   1. Name server IP address ("No Response on Unknown Option Code")
   2. Name server IP address and [RCODE Name] ("Unexpected RCODE on Unknown Option Code")
   3. Name server IP address ("No EDNS on Unknown Option Code")
   4. Name server IP address ("Unexpected Answer Section on Unknown Option Code")
   5. Name server IP address ("Unset AA on Unknown Option Code")
   6. Name server IP address ("Returns Unknown Option Code")

2. Create a [EDNS Query] with query type SOA, *Child Zone* as query name and with
   no EDNS options or flags ("SOA Query").

3. Create a [EDNS Query] with query type SOA, *Child Zone* as query name and with
   EDNS OPTION-CODE set to anything other than what is already assigned in
   the [IANA-DNSSYSTEM-PARAMETERS] and no other EDNS options or flags
   ("SOA Query with EDNS Option").

4. Obtain the set of name server IP addresses using [Method4] and [Method5]
   ("Name Server IP").

5. For each name server in *Name Server IP* do:

   1. Send *SOA Query* to the name server and collect the response.
   2. Go to next name server if at least one of the following criteria is met:
      1. There is no DNS response from the server.
      2. EDNS is unset in the response.
      3. The [RCODE Name] in the response is not "NoError".
      4. The AA flag is unset in the response.
      5. The answer section has no SOA record with *Child Zone* as owner name.
   3. Send *SOA Query with EDNS Option* to the name server and collect the
      response.
      1. If there is no DNS response from the server then add the name server to
         the *No Response on Unknown Option Code* set.
      2. Else, if the [RCODE Name] in the response is not "NoError" then add the
         name server and [RCODE Name] to the
         *Unexpected RCODE on Unknown Option Code* set.
         server.
      3. Else, if EDNS is unset in the response then add the name server to
         the *No EDNS on Unknown Option Code* set.
      4. Else, if the answer section has no SOA record with *Child Zone* as owner
         name then add the name server to the
         *Unexpected Answer Section on Unknown Option Code* set.
      5. Else, if the AA flag is unset in the response then add the name server
         to the *Unset AA on Unknown Option Code* set.
      6. Else, if the "OPTION-CODE" from the query is present in the response,
         then add name server to the *Returns Unknown Option Code* set.
      7. Else, no issues were found.

5. If the *No Response on Unknown Option Code* set is non-empty, then output
   *[N11_NO_RESPONSE]* with the name servers IP addresses from the set.

6. If the *Unexpected RCODE on Unknown Option Code* set is non-empty, then for
   each [RCODE NAME] in the set output *[N11_UNEXPECTED_RCODE]* with the
   [RCODE Name] and the name servers IP addresses for that [RCODE NAME] in the
   set.

7. If the *No EDNS on Unknown Option Code* set is non-empty, then output
   *[N11_NO_EDNS]* with the name servers IP addresses from the set.

8. If the *Unexpected Answer Section on Unknown Option Code* set is non-empty,
   then output *[N11_UNEXPECTED_ANSWER_SECTION]* with the name servers IP
   addresses from the set.

9. If the *Unset AA on Unknown Option Code* set is non-empty, then output
   *[N11_UNSET_AA]* with the name servers IP addresses from the set.

11. If the *Returns Unknown Option Code* set is non-empty, then output
    *[N11_RETURNS_UNKNOWN_OPTION_CODE]* with the name servers IP addresses from
    the set.


## Outcome(s)

The outcome of this Test Case is "fail" if there is at least one message
with the severity level *[ERROR]* or *[CRITICAL]*.

The outcome of this Test Case is "warning" if there is at least one message
with the severity level *[WARNING]*, but no message with severity level
*ERROR* or *CRITICAL*.

In other cases, no message or only messages with severity level
*[INFO]* or *[NOTICE]*, the outcome of this Test Case is "pass".

## Special procedural requirements

If either IPv4 or IPv6 transport is disabled, skip sending queries over that
transport protocol. A message will be outputted reporting that the transport
protocol has been skipped.

## Intercase dependencies

None.

## Terminology

No special terminology for this test case.


[Argument list]:                        ../ArgumentsForTestCaseMessages.md
[Connectivity01]:                       ../Connectivity-TP/connectivity01.md
[CRITICAL]:                             ../SeverityLevelDefinitions.md#critical
[DNS Query and Response Defaults]:      ../DNSQueryAndResponseDefaults.md
[EDNS Query]:                            ../DNSQueryAndResponseDefaults.md#default-setting-in-edns-query
[EDNS Response]:                         ../DNSQueryAndResponseDefaults.md#default-handling-of-an-edns-response
[ERROR]:                                ../SeverityLevelDefinitions.md#error
[IANA-DNSSYSTEM-PARAMETERS]:            https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-11
[INFO]:                                 ../SeverityLevelDefinitions.md#info
[Message Tag Specification]:            MessageTagSpecification.md
[Method4]:                              ../Methods.md#method-4-obtain-glue-address-records-from-parent
[Method5]:                              ../Methods.md#method-5-obtain-the-name-server-address-records-from-child
[Methods]:                              ../Methods.md
[N11_NO_EDNS]:                          #summary
[N11_NO_RESPONSE]:                      #summary
[N11_RETURNS_UNKNOWN_OPTION_CODE]:      #summary
[N11_UNEXPECTED_ANSWER_SECTION]:        #summary
[N11_UNEXPECTED_RCODE]:                 #summary
[N11_UNSET_AA]:                         #summary
[NOTICE]:                               ../SeverityLevelDefinitions.md#notice
[Nameserver02]:                         ../Nameserver-TP/nameserver02.md
[RCODE Name]:                           https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
[RFC 6891, section 6.1.2]:              https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2
[RFC 6891]:                             https://datatracker.ietf.org/doc/html/rfc6891
[Severity Level Definitions]:           ../SeverityLevelDefinitions.md
[Test Case Identifier Specification]:   TestCaseIdentifierSpecification.md
[WARNING]:                              ../SeverityLevelDefinitions.md#warning
[Zonemaster-Engine profile]:            ../../../configuration/profiles.md
