From 0c53fe2717262daa73cddc14d2c32309fce5cb16 Mon Sep 17 00:00:00 2001 From: Mario Fetka Date: Sun, 26 Jul 2026 19:52:05 +0200 Subject: [PATCH] Avoid reserved test zone in SMTP DNSSEC fixture --- contrib/testing/smtp-dane-mta-sts-check.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/contrib/testing/smtp-dane-mta-sts-check.py b/contrib/testing/smtp-dane-mta-sts-check.py index ba4f7a3..be85889 100755 --- a/contrib/testing/smtp-dane-mta-sts-check.py +++ b/contrib/testing/smtp-dane-mta-sts-check.py @@ -31,7 +31,10 @@ import time TOKEN = f"smtp27-{os.getpid()}-{int(time.time())}" -ZONE = "smtp27.test" +# libunbound correctly synthesizes NXDOMAIN for the RFC 6761 .test zone +# before consulting forwarders. Use a disposable private test TLD so the +# embedded resolver exercises the same validating path as an Internet domain. +ZONE = "smtp27.bongo-test" DNS_RESOLVER = "127.0.0.53" DNS_AUTHORITY = "127.0.0.1" # Avoid mDNS' wildcard UDP/5353 listener, which may be active on desktops. @@ -121,11 +124,11 @@ ROUTES = ( Route("sts-testing", "127.0.0.5", None, sts_mode="testing"), Route("sts-mismatch", "127.0.0.6", "trusted", - sts_mode="enforce", sts_mx="other.smtp27.test"), + sts_mode="enforce", sts_mx=f"other.{ZONE}"), Route("dane-precedence", "127.0.0.7", "trusted", sts_mode="enforce", tlsa="invalid"), Route("sts-cache", "127.0.0.8", "trusted", - sts_mode="enforce", sts_mx="*.smtp27.test"), + sts_mode="enforce", sts_mx=f"*.{ZONE}"), Route("sts-plain", "127.0.0.10", None, sts_mode="enforce"), ) @@ -394,7 +397,6 @@ def write_dns_configs(directory: Path, trust_anchor: str) -> None: f' pidfile: "{directory / "unbound.pid"}"\n' f' logfile: "{directory / "unbound.log"}"\n' " use-syslog: no\n" - ' local-zone: "test." nodefault\n' f' trust-anchor-file: "{directory / "anchor"}"\n' "stub-zone:\n" f' name: "{ZONE}."\n'