From adc33d694dcef90774a3cf026c81fe7481cc2d2f Mon Sep 17 00:00:00 2001 From: Leon Hubrich Date: Wed, 10 Jun 2026 14:06:22 +0200 Subject: [PATCH] technitium-dns-server: fix missing DNSSEC DO bit in authoritative responses Assisted-by: Claude Code (Fable 5) --- .../technitium-dns-server/dnssec-do-bit-fix.patch | 13 +++++++++++++ pkgs/by-name/te/technitium-dns-server/package.nix | 6 ++++++ 2 files changed, 19 insertions(+) create mode 100644 pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch diff --git a/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch new file mode 100644 index 000000000000..aaafec50add1 --- /dev/null +++ b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch @@ -0,0 +1,13 @@ +diff --git a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs +index 352ea6c0..41a9a1c7 100644 +--- a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs ++++ b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs +@@ -3536,7 +3536,7 @@ namespace DnsServerCore.Dns.ZoneManagers + } + } + +- return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, udpPayloadSize: _dnsServer.UdpPayloadSize, options: eDnsOptions); ++ return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, _dnsServer.UdpPayloadSize, request.DnssecOk ? EDnsHeaderFlags.DNSSEC_OK : EDnsHeaderFlags.None, eDnsOptions); + } + } + diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix index a5375f487124..f143be229523 100644 --- a/pkgs/by-name/te/technitium-dns-server/package.nix +++ b/pkgs/by-name/te/technitium-dns-server/package.nix @@ -41,6 +41,12 @@ buildDotnetModule rec { libmsquic ]; + # Confirmed correct by upstream, remove when fixed in a release: + # https://github.com/TechnitiumSoftware/DnsServer/issues/1967 + patches = [ + ./dnssec-do-bit-fix.patch + ]; + passthru.tests = { inherit (nixosTests) technitium-dns-server; };