Version
Technitium DNS Server 15.4
Description
When running in full recursive mode with DNSSEC Validation enabled and IPv6 Support = Enable IPv6, the recursive resolver eventually throws the following exception:
textSystem.ArgumentOutOfRangeException: Index must be within the bounds of the List. (Parameter 'index')
at System.Collections.Generic.List`1.Insert(Int32 index, T item)
at TechnitiumLibrary.Net.Dns.DnsClient.RecursiveResolveAsync(...) in DnsClient.cs:line 618
After multiple occurrences of this exception, the recursive resolver enters a stuck state and starts returning:
text"Waiting for resolver. Please try again."
NoReachableAuthority – ... returned RCODE=ServerFailure
A service restart is required to recover.
Steps to Reproduce
- Configure Technitium for pure recursive resolution (no forwarders).
- Enable DNSSEC Validation.
- Set IPv6 Support to Enable IPv6.
- Allow normal client traffic (especially domains that trigger DNSSEC validation against UltraDNS / other problematic authoritative servers).
- Observe logs for the ArgumentOutOfRangeException and eventual resolver hang.
Relevant Log Excerpts
TechnitiumLibrary.Net.Dns.DnsClientResponseDnssecValidationException: Attack detected! Failed to resolve the request 'vmwservices.com. DNSKEY IN'. Received a response with RCODE: Refused from Name server: edns161.ultradns.biz (204.74.67.161)
...
System.ArgumentOutOfRangeException: Index must be within the bounds of the List. (Parameter 'index')
at System.Collections.Generic.List`1.Insert(Int32 index, T item)
at TechnitiumLibrary.Net.Dns.DnsClient.RecursiveResolveAsync(...) in DnsClient.cs:line 618
Later:
DnsClient failed to resolve the request 'google.com. A IN': request timed out for name server [local server].
...
"Waiting for resolver. Please try again."
Additional Context
- The issue appears to be triggered by a combination of DNSSEC validation failures (especially against UltraDNS name servers returning Refused for DNSKEY) and IPv6 name server timeouts.
- Once the ArgumentOutOfRangeException starts occurring, the internal state of the recursive resolver becomes corrupted and only recovers after a full service restart.
- Disabling DNSSEC Validation or setting IPv6 Support to “Disable IPv6” significantly reduces the frequency of the problem.
Expected Behavior
The recursive resolver should handle DNSSEC validation failures and IPv6 timeouts gracefully without throwing an unhandled ArgumentOutOfRangeException or entering a permanent “Waiting for resolver” state.
Yes, AI helped me write this. I suck at these and I wanted to be sure I provided as much useful information as possible.
Version
Technitium DNS Server 15.4
Description
When running in full recursive mode with DNSSEC Validation enabled and IPv6 Support = Enable IPv6, the recursive resolver eventually throws the following exception:
After multiple occurrences of this exception, the recursive resolver enters a stuck state and starts returning:
Steps to Reproduce
Relevant Log Excerpts
Later:
Additional Context
Expected Behavior
The recursive resolver should handle DNSSEC validation failures and IPv6 timeouts gracefully without throwing an unhandled ArgumentOutOfRangeException or entering a permanent “Waiting for resolver” state.
Yes, AI helped me write this. I suck at these and I wanted to be sure I provided as much useful information as possible.