17 Testing DNS software

17.1 Layers of evidence

Unit tests establish local invariants: name limits, record parsing, lookup outcomes, leap conversion. Property tests explore parser state spaces that examples miss. Golden fixtures establish compatibility with an external file format. Integration tests cross process and socket boundaries. Live interoperability tests compare behavior with independent clients and servers.

rgbdns uses all of these. A useful local sequence is:

cargo fmt --check
cargo test
cargo clippy --all-targets --all-features -- -D warnings

Network tests bind unprivileged loopback ports. CDB tests compile canonical fixtures and compare entries. Daemontools tests exercise process replacement, rotation, and TAI64 filter behavior. Packet properties assert that arbitrary input does not panic and that supported structured messages survive encode/decode round trips.

17.2 Adversarial cases worth keeping

Every DNS implementation should retain regression cases for:

• a compression pointer to itself or a pointer cycle;
• a pointer or RDATA length just beyond the packet;
• maximum-length labels and names;
• counts that cannot be satisfied by the remaining bytes;
• duplicate or malformed OPT records;
• tiny advertised transport limits;
• CNAME loops and excessive chains;
• wildcard names blocked by existing nodes;
• delegation cuts beneath an authoritative apex;
• NODATA versus NXDOMAIN;
• AXFR without a closing SOA;
• an enormous log line;
• configuration counts at and beyond each bound.

Tests should assert protocol meaning, not only that the process remains alive. A safe FORMERR is better than a crash, but a silent NOERROR can still be a serious bug.

17.3 Conformance as an executable specification

The conformance suite turns protocol prose into named, reviewable cases. Its scope is the DNS surface rgbdns implements; it does not imply support for every extension ever assigned by IANA. The principal coverage is:

This is more useful than a single “RFC compliant” label. A test name identifies the rule, a packet fixture demonstrates it, and a failure points to a specific semantic regression.

RFC 8906 is especially valuable because it tests how a server behaves at the edges of what it understands. An unknown ordinary type is not a protocol error: the answer depends on whether the owner name exists. An unknown opcode is different. Because that opcode may define a body layout unlike QUERY, the server must produce NOTIMP from the header without first interpreting the body as an ordinary question. Unknown EDNS options are structurally validated and then ignored. An unsupported EDNS version produces BADVERS while retaining an OPT response.

The independent drill integration test supplies another boundary. It launches the real tinydns binary and asks the ldns client to make UDP, TCP, EDNS, mixed-case, and unknown-type queries. This catches accidental agreement between rgbdns’s own encoder and decoder: the request and response cross an implementation boundary.

The complete focused matrix is:

cargo test --test rfc_conformance
cargo test --test wire_security
cargo test --test packet_properties
cargo test --test drill_interop

The generated suite exercises forty thousand cases per complete run. It feeds arbitrary bytes to the decoder, reparses every accepted packet, generates structured messages for semantic round trips, and changes ASCII letter case without changing DNS name identity. A separate truncation corpus tries every prefix of a valid structured packet. These properties do not prove the absence of all parser defects, but they explore combinations that hand-written examples rarely anticipate.

17.4 Hardening found by conformance work

Conformance testing improved the implementation rather than merely describing it.

The name decoder now records valid prior name boundaries. A compression pointer must be backward and must target one of those boundaries. Merely pointing at earlier bytes that happen to resemble a label sequence is rejected. This closes a class of ambiguous parses without forbidding legal compression.

Stub responses are bound to the request ID, QR bit, opcode, and exact question. TCP responses carrying TC are rejected. AXFR applies the same identity checks and additionally requires authoritative, non-truncated messages, controlled question repetition, an empty authority section, matching opening and closing SOAs, and records confined to the requested zone. These rules prevent a plausible-looking but unrelated response from being accepted as the answer to the outstanding operation.

Zone loading rejects a CNAME owner that also has other data and rejects multiple different CNAME targets. Before transmission, RRsets are normalized to their minimum TTL and duplicate records are removed. Negative answers cap the SOA TTL at the SOA MINIMUM field as RFC 2308 requires. EDNS OPT records in the wrong section and duplicate OPT records produce FORMERR.

The UDP and TCP daemons now share one bounded transport module. TCP connections carry deadlines, use a fixed worker pool, accept multiple framed queries, and support pipelined requests. This removes duplicated socket code while making RFC 7766 behavior an invariant shared by the authoritative and specialized servers.

17.5 Benchmarks and evidence-driven optimization

Correctness gates run before performance conclusions. The benchmark is a dependency-free stable-Rust harness in benches/dns_core.rs; the same harness is available as examples/dns_core_bench.rs for quick release-mode runs:

cargo bench --bench dns_core
RGBDNS_BENCH_ITERATIONS=10000 \
  cargo run --release --example dns_core_bench

It warms every operation, passes values through std::hint::black_box, and reports nanoseconds per operation. Measurements are comparable only on the same host, toolchain, power state, and iteration count. Wire size is reported beside CPU time because DNS compression exchanges encoder work for fewer network bytes.

The July 2026 checkpoint used release mode on one aarch64 Android host:

Three structural changes explain most of the gains.

First, Zone maintains an index of every node, including empty non-terminals. A clearly absent name can return NXDOMAIN without scanning the records of a thousand-name zone. Conditional records still take the visibility path, so the index does not erase time or location semantics.

Second, response truncation searches the number of tail records to remove instead of encoding once for every removed record. It preserves the question and OPT record as long as possible and validates the final candidate against the transport limit.

Third, the packet writer records complete names and suffixes for RFC 1035 compression. RRsets tend to repeat the immediately preceding owner, so a last-owner cache avoids rebuilding and hashing suffix keys on the dominant path. The first compression design encoded the 64-record case in 34,075 ns; the cache reduced that to 5,309 ns.

The remaining encoder regression is intentional and visible. Compression makes the example packet roughly half as large while taking more local CPU than the old uncompressed writer. That is a defensible trade for an authoritative server because it reduces datagram pressure, TCP bytes, and downstream decode work. Recording the regression matters: optimization should reveal tradeoffs, not hide them behind one favorable number.