From ca62633f083ab080a3d4e7ceab55b1f76b051ffd Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Thu, 29 Oct 2026 08:58:26 +0100 Subject: [PATCH] resolved: explain why .alt is not a negative trust anchor RFC 9476 reserves the .alt pseudo-TLD for names that are resolved by protocols other than DNS. #32284 proposes adding .alt to the built-in negative trust anchors. We don't need that entry. dns_name_dont_resolve() returns true for .alt names. We never send a lookup of a .alt name to a DNS server, and we synthesize an NXDOMAIN reply instead. Lookups of .alt names never go through DNSSEC validation. Let's explain why the list has no .alt entry in a comment next to the list, so that the same question doesn't come up again. (cherry picked from commit 993c81a79766ef5d8e243d73bb0b637562d7eef4) --- src/resolve/resolved-dns-trust-anchor.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/resolve/resolved-dns-trust-anchor.c b/src/resolve/resolved-dns-trust-anchor.c index f1ffee23b3f..02e21bf49e1 100644 --- a/src/resolve/resolved-dns-trust-anchor.c +++ b/src/resolve/resolved-dns-trust-anchor.c @@ -192,6 +192,11 @@ static int dns_trust_anchor_add_builtin_negative(DnsTrustAnchor *d) { "170.0.0.192.in-addr.arpa\0" "171.0.0.192.in-addr.arpa\0"; + /* RFC 9476 reserves the .alt pseudo-TLD for names that are resolved by protocols other than DNS. + * dns_name_dont_resolve() returns true for .alt names. We hence never send a lookup of a .alt name + * to a DNS server, and synthesize an NXDOMAIN reply instead. Lookups of .alt names never go through + * DNSSEC validation. The list above doesn't need an entry for .alt for that reason. */ + int r; assert(d);