@serve.zone/dcrouter 34.0.0 → 34.1.0

package/ts/dns/manager.dns-authority.ts

@@ -5,6 +5,7 @@ import type {
   IDnsAuthorityDrift,
   IDnsAuthoritySettings,
   IDnsAuthorityZone,
+  IDnsDelegationParentAnswer,
   IDnsDelegationProbe,
   TDnsAuthorityState,
 } from '../../ts_interfaces/data/dns-authority.js';
@@ -40,6 +41,227 @@ const isUsableZoneName = (zoneArg: string): boolean => {
     && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(labelArg));
 };
 
+/** What the delegation probe uses of a smartdns client: DoH lookups, direct server queries, cleanup. */
+type TDelegationProbeClient = Pick<
+  plugins.smartdns.dnsClientMod.Smartdns,
+  'queryRecords' | 'queryServer' | 'terminate'
+>;
+type TProbeDohResult = Awaited<ReturnType<TDelegationProbeClient['queryRecords']>>;
+type TProbeServerResult = Awaited<ReturnType<TDelegationProbeClient['queryServer']>>;
+
+/** Timeout of each DNS-over-HTTPS lookup of a probe (D). */
+const PROBE_DOH_TIMEOUT_MS = 5_000;
+/**
+ * Timeout of each attempt of a parent server query (T). A truncated UDP answer
+ * is asked again over TCP with its own timeout, so one server costs at most 2·T.
+ */
+const PARENT_QUERY_TIMEOUT_MS = 2_000;
+/**
+ * No probe phase starts after this deadline. The phase in flight may still run
+ * to its own bound, so a probe ends within the deadline + max(D, 2·T) = 35 s,
+ * which is also the longest a claim holds the DNS mutation lock for its probe.
+ */
+const PROBE_DEADLINE_MS = 30_000;
+/** Proper suffixes of the zone tried as its parent zone, nearest first. */
+const PARENT_WALK_LIMIT = 8;
+/** Parent nameserver names whose addresses are looked up. */
+const PARENT_NAME_LIMIT = 8;
+/** Parent servers asked for the referral. */
+const PARENT_SERVER_LIMIT = 4;
+/** Conclusive parent answers needed, from as many different parent nameserver names. */
+const PARENT_AGREEMENT_MINIMUM = 2;
+
+/** One parent server address and the parent nameserver name it was resolved from. */
+interface IParentServer {
+  address: string;
+  nameserver: string;
+}
+
+type TParentZoneLookup =
+  | { status: 'found'; parentZone: string; nameservers: string[] }
+  | { status: 'failed'; detail: string };
+
+type TParentServerSelection =
+  | { status: 'selected'; servers: IParentServer[] }
+  | { status: 'failed'; detail: string };
+
+type TParentAnswerClass = Omit<IDnsDelegationParentAnswer, 'server' | 'nameserver'>;
+
+const describeError = (errorArg: unknown): string =>
+  errorArg instanceof Error ? errorArg.message : String(errorArg);
+
+const describeDohError = (resultArg: TProbeDohResult): string =>
+  resultArg.status === 'error'
+    ? `${resultArg.error.kind}/${resultArg.error.code}: ${resultArg.error.message}`
+    : resultArg.status;
+
+/** The address the probe asks, as `ip:port`, the way smartdns reports servers. */
+const formatParentServer = (addressArg: string): string =>
+  plugins.net.isIPv6(addressArg) ? `[${addressArg}]:53` : `${addressArg}:53`;
+
+const rcodeNames: Record<number, string> = {
+  0: 'NOERROR',
+  1: 'FORMERR',
+  2: 'SERVFAIL',
+  3: 'NXDOMAIN',
+  4: 'NOTIMP',
+  5: 'REFUSED',
+};
+const describeRcode = (rcodeArg: number): string => rcodeNames[rcodeArg] ?? `RCODE ${rcodeArg}`;
+
+/**
+ * Classify one parent server's answer to the non-recursive NS query for
+ * `zoneArg`. Only two shapes are conclusive, and everything else is not:
+ *
+ * - a referral: RCODE 0, AA=0, an empty answer section, at least one authority
+ *   NS and every authority NS owned by the zone, and an OPT record echoing DO=1.
+ *   Without that echo the server may simply not have sent the DS, so a referral
+ *   without one would not prove that there is none.
+ * - a negative: AA=1, NXDOMAIN or NODATA, an empty answer section, and SOA
+ *   records in the authority section that are all owned by the parent zone.
+ *
+ * Any other AA=1 answer is inconclusive, an AA=1 referral included: a server
+ * that hosts both the parent and the child answers for the child, and such an
+ * answer says nothing about the delegation.
+ */
+const classifyParentAnswer = (
+  zoneArg: string,
+  parentZoneArg: string,
+  resultArg: TProbeServerResult,
+): TParentAnswerClass => {
+  const inconclusive = (detailArg: string): TParentAnswerClass => ({ outcome: 'inconclusive', detail: detailArg });
+  if (resultArg.status === 'error') {
+    return inconclusive(`no usable answer (${resultArg.error.kind}/${resultArg.error.code}): ${resultArg.error.message}`);
+  }
+  if (resultArg.flags.tc) return inconclusive('the answer is truncated');
+  if (resultArg.flags.aa) {
+    const soaOwners = resultArg.authorities
+      .filter((recordArg) => recordArg.type === 'SOA')
+      .map((recordArg) => normalizeZone(recordArg.name));
+    const isNegative = (resultArg.rcode === 0 || resultArg.rcode === 3)
+      && resultArg.answers.length === 0
+      && soaOwners.length > 0
+      && soaOwners.every((ownerArg) => ownerArg === parentZoneArg);
+    if (isNegative) {
+      return {
+        outcome: 'negative',
+        detail: `${describeRcode(resultArg.rcode)} from ${parentZoneArg}: no delegation for ${zoneArg}`,
+      };
+    }
+    if (resultArg.answers.some((recordArg) => recordArg.type === 'NS' && normalizeZone(recordArg.name) === zoneArg)) {
+      return inconclusive(`authoritative for ${zoneArg} itself (AA=1 NS answer), not a referral from ${parentZoneArg}`);
+    }
+    return inconclusive(
+      `authoritative ${describeRcode(resultArg.rcode)} that is neither a referral nor a negative from ${parentZoneArg}`,
+    );
+  }
+  if (resultArg.rcode !== 0) return inconclusive(`${describeRcode(resultArg.rcode)} without AA`);
+  if (resultArg.answers.length > 0) return inconclusive('a non-authoritative answer section, not a referral');
+  const referralRecords = resultArg.authorities.filter((recordArg) => recordArg.type === 'NS');
+  if (referralRecords.length === 0) return inconclusive('no NS records in the authority section');
+  const foreignOwner = referralRecords.find((recordArg) => normalizeZone(recordArg.name) !== zoneArg);
+  if (foreignOwner) {
+    return inconclusive(`a referral for ${normalizeZone(foreignOwner.name) || '.'}, not for ${zoneArg}`);
+  }
+  if (resultArg.edns?.dnssecOk !== true) {
+    return inconclusive('the answer does not echo DO=1, so the absence of a DS is not proven');
+  }
+  const nameservers = [...new Set(
+    referralRecords.map((recordArg) => normalizeNameserver(recordArg.value)).filter(Boolean),
+  )].sort();
+  if (nameservers.length === 0) return inconclusive('referral NS records without a nameserver name');
+  const dsPresent = resultArg.authorities.some(
+    (recordArg) => recordArg.type === 'DS' && normalizeZone(recordArg.name) === zoneArg,
+  );
+  return {
+    outcome: 'referral',
+    nameservers,
+    dsPresent,
+    detail: `referral to ${nameservers.join(', ')}${dsPresent ? ' with a DS' : ' without a DS'}`,
+  };
+};
+
+/** What "identical" compares: the normalised NS set and DS presence, nothing else. */
+const parentAnswerKey = (answerArg: IDnsDelegationParentAnswer): string =>
+  answerArg.outcome === 'referral'
+    ? `referral:${(answerArg.nameservers ?? []).join(',')}|ds:${answerArg.dsPresent === true}`
+    : answerArg.outcome;
+
+/**
+ * Turn the parent servers' classified answers into a verdict: at least two
+ * conclusive answers, through at least two different parent nameserver names,
+ * all identical — any disagreement is undeterminable.
+ */
+const aggregateParentAnswers = (
+  zoneArg: string,
+  parentZoneArg: string,
+  expectedNameserversArg: string[],
+  answersArg: IDnsDelegationParentAnswer[],
+): IDnsDelegationProbe => {
+  const base = {
+    zone: zoneArg,
+    expectedNameservers: expectedNameserversArg,
+    parentZone: parentZoneArg,
+    parentAnswers: answersArg,
+  };
+  const undeterminable = (detailArg: string): IDnsDelegationProbe => ({
+    ...base,
+    verdict: 'undeterminable',
+    observedNameservers: [],
+    detail: detailArg,
+  });
+  const conclusive = answersArg.filter((answerArg) => answerArg.outcome !== 'inconclusive');
+  if (conclusive.length < PARENT_AGREEMENT_MINIMUM) {
+    return undeterminable(
+      `${conclusive.length} of ${answersArg.length} parent server(s) of ${parentZoneArg} gave a conclusive answer `
+        + `for ${zoneArg}; at least ${PARENT_AGREEMENT_MINIMUM} identical ones are needed`,
+    );
+  }
+  if (new Set(conclusive.map(parentAnswerKey)).size > 1) {
+    return undeterminable(
+      `the parent servers of ${parentZoneArg} disagree about ${zoneArg}: `
+        + conclusive.map((answerArg) => `${answerArg.server} (${answerArg.nameserver}) ${answerArg.detail}`).join('; '),
+    );
+  }
+  const agreeingNames = [...new Set(conclusive.map((answerArg) => answerArg.nameserver))];
+  if (agreeingNames.length < PARENT_AGREEMENT_MINIMUM) {
+    return undeterminable(
+      `the conclusive answers for ${zoneArg} all came through one parent nameserver name (${agreeingNames.join(', ')}); `
+        + `at least ${PARENT_AGREEMENT_MINIMUM} different names are needed`,
+    );
+  }
+  const agreed = conclusive[0];
+  if (agreed.outcome === 'negative') {
+    return {
+      ...base,
+      verdict: 'not-delegated',
+      observedNameservers: [],
+      detail: `${parentZoneArg} has no delegation for ${zoneArg}`,
+    };
+  }
+  const delegatedTo = agreed.nameservers ?? [];
+  const dsPresent = agreed.dsPresent === true;
+  const ours = delegatedTo.filter((nameserverArg) => expectedNameserversArg.includes(nameserverArg));
+  if (ours.length === 0) {
+    return {
+      ...base,
+      verdict: 'not-delegated',
+      observedNameservers: delegatedTo,
+      dsPresent,
+      detail: `${parentZoneArg} delegates ${zoneArg} to ${delegatedTo.join(', ')}, which does not include any of our `
+        + `nameservers (${expectedNameserversArg.join(', ')})`,
+    };
+  }
+  return {
+    ...base,
+    verdict: 'delegated',
+    observedNameservers: delegatedTo,
+    dsPresent,
+    detail: `${parentZoneArg} delegates ${zoneArg} to ${delegatedTo.join(', ')}`
+      + (dsPresent ? `; ${parentZoneArg} publishes a DS for ${zoneArg}` : ''),
+  };
+};
+
 /**
  * DnsAuthorityManager — owns which zones dcrouter may answer for
  * authoritatively, and proves that claim rather than accepting it.
@@ -54,9 +276,9 @@ const isUsableZoneName = (zoneArg: string): boolean => {
  * any domain and manufacture that proof — the identical self-assertion vector
  * that `createDcrouterDomain` used to have.
  *
- * So a zone earns authority by delegation instead: its public NS records must
- * name our `dnsNsDomains`. An ops-API caller cannot fake that without actually
- * controlling the domain, so the proof stays unforgeable while becoming
+ * So a zone earns authority by delegation instead: its delegation in the parent
+ * zone must name our `dnsNsDomains`. An ops-API caller cannot fake that without
+ * actually controlling the domain, so the proof stays unforgeable while becoming
  * mutable at runtime. It is also the comparison that was missing — claimed
  * authority versus real delegation, checked by the mechanism itself rather than
  * by an audit bolted on afterwards.
@@ -101,7 +323,7 @@ export class DnsAuthorityManager {
   private reconciler?: TDnsAuthorityReconciler;
   private stopped = false;
   private activeProbes = new Map<string, Promise<IDnsDelegationProbe>>();
-  private ownedProbeClients = new Set<plugins.smartdns.dnsClientMod.Smartdns>();
+  private ownedProbeClients = new Set<TDelegationProbeClient>();
 
   constructor(
     private getExpectedNameservers: () => string[],
@@ -223,18 +445,43 @@ export class DnsAuthorityManager {
   // ==========================================================================
 
   /**
-   * Ask the public DNS whether `zone` is delegated to our nameservers.
+   * Ask the parent zone's own servers whether `zone` is delegated to our
+   * nameservers.
+   *
+   * A recursive lookup of the zone cannot prove this. For a zone delegated to
+   * us but not claimed yet, a public resolver follows the delegation to our
+   * servers, which REFUSE the zone because it is not claimed, so the resolver
+   * answers SERVFAIL and the zone could never be claimed. The delegation itself
+   * lives in the parent zone, so the probe reads it there:
    *
-   * Deliberately uses `strategy: 'doh'` — a single DNS-over-HTTPS attempt
-   * against a public resolver, with no system-resolver fallback. smartdns'
-   * `getNameServers()` uses `dns.resolveNs`, i.e. the *system* resolver, which on
-   * a dcrouter host may be dcrouter itself: it would happily answer with the very
-   * NS records we generated, making the probe self-confirming. An independent
-   * vantage point is the whole point of the proof.
+   *  1. Find the parent zone over DNS-over-HTTPS: the nearest proper suffix of
+   *     the zone with an NS RRset (at most 8 levels). The zone itself, and every
+   *     name below it, is never looked up over DoH: that is the circular query.
+   *     A failed lookup at any level is undeterminable; a level is never
+   *     skipped, which could pick a grandparent.
+   *  2. Look up A and AAAA of up to 8 parent nameserver names (sorted, names at
+   *     or below the zone dropped) over DoH, and pick up to 4 distinct addresses:
+   *     one per name first, IPv4 before IPv6, then further addresses round by
+   *     round. Fewer than 2 names with an address is undeterminable.
+   *  3. Ask each picked server, in parallel, for the zone's NS with RD=0 and
+   *     DO=1, over UDP (TCP when truncated). A signed parent then sends the DS
+   *     with the referral, so DS presence needs no further query.
+   *  4. Classify every answer (`classifyParentAnswer`) and require at least 2
+   *     identical conclusive answers through at least 2 different parent
+   *     nameserver names (`aggregateParentAnswers`). Glue, TTLs, case and order
+   *     are not compared.
+   *
+   * DoH never decides a verdict; only the parent's servers do. The DoH
+   * lookups never use the system resolver: on a dcrouter host that may be
+   * dcrouter itself, which would make the probe self-confirming.
    *
    * The three verdicts are kept distinct on purpose. A timeout is not evidence
    * that a zone is not ours; collapsing 'undeterminable' into 'not-delegated'
    * would let a transient resolver fault revoke authority.
+   *
+   * Known limitation: the parent servers of a zone below a zone we already
+   * serve are our own, which answer for the parent authoritatively, so such a
+   * zone is undeterminable.
    */
   public probeDelegation(zoneArg: string): Promise<IDnsDelegationProbe> {
     if (this.stopped) return Promise.reject(new Error('DNS authority manager is stopped'));
@@ -249,11 +496,11 @@ export class DnsAuthorityManager {
     return run;
   }
 
-  private createProbeClient(): plugins.smartdns.dnsClientMod.Smartdns {
+  private createProbeClient(): TDelegationProbeClient {
     return new plugins.smartdns.dnsClientMod.Smartdns({
       strategy: 'doh',
       allowDohFallback: false,
-      timeoutMs: 10_000,
+      timeoutMs: PROBE_DOH_TIMEOUT_MS,
     });
   }
 
@@ -285,69 +532,172 @@ export class DnsAuthorityManager {
     const smartdnsClient = this.createProbeClient();
     this.ownedProbeClients.add(smartdnsClient);
     try {
+      const deadline = Date.now() + PROBE_DEADLINE_MS;
+      const undeterminable = (detailArg: string, parentZoneArg?: string): IDnsDelegationProbe => ({
+        zone,
+        verdict: 'undeterminable',
+        observedNameservers: [],
+        expectedNameservers,
+        detail: detailArg,
+        ...(parentZoneArg ? { parentZone: parentZoneArg } : {}),
+      });
 
-      let result: Awaited<ReturnType<typeof smartdnsClient.queryRecords>>;
-      try {
-        result = await smartdnsClient.queryRecords(zone, 'NS');
-      } catch (error: unknown) {
-        return {
-          zone,
-          verdict: 'undeterminable',
-          observedNameservers: [],
-          expectedNameservers,
-          detail: `delegation lookup threw: ${(error as Error).message}`,
-        };
-      }
+      const parent = await this.findParentZone(smartdnsClient, zone, deadline);
+      if (parent.status === 'failed') return undeterminable(parent.detail);
 
-      if (result.status === 'error') {
-        return {
-          zone,
-          verdict: 'undeterminable',
-          observedNameservers: [],
-          expectedNameservers,
-          detail: `delegation lookup failed (${result.error.kind}/${result.error.code}): ${result.error.message}`,
-        };
+      if (Date.now() >= deadline) {
+        return undeterminable('the probe deadline passed before the parent servers were resolved', parent.parentZone);
       }
+      const selection = await this.selectParentServers(smartdnsClient, zone, parent.parentZone, parent.nameservers);
+      if (selection.status === 'failed') return undeterminable(selection.detail, parent.parentZone);
 
-      if (result.status === 'missing') {
-        return {
-          zone,
-          verdict: 'not-delegated',
-          observedNameservers: [],
-          expectedNameservers,
-          detail: result.missingReason === 'nxdomain'
-            ? `${zone} does not exist in public DNS`
-            : `${zone} has no NS records in public DNS`,
-        };
+      if (Date.now() >= deadline) {
+        return undeterminable('the probe deadline passed before the parent servers were asked', parent.parentZone);
       }
+      const answers = await Promise.all(selection.servers.map((serverArg) =>
+        this.askParentServer(smartdnsClient, zone, parent.parentZone, serverArg)));
+      return aggregateParentAnswers(zone, parent.parentZone, expectedNameservers, answers);
+    } finally {
+      // Keep ownership if confirmed termination fails; stop() can retry it.
+      await smartdnsClient.terminate();
+      this.ownedProbeClients.delete(smartdnsClient);
+    }
+  }
 
-      const observedNameservers: string[] = [...new Set<string>(
+  /** One DoH lookup; a thrown lookup is a failed one. */
+  private async lookUpOverDoh(
+    clientArg: TDelegationProbeClient,
+    nameArg: string,
+    typeArg: 'NS' | 'A' | 'AAAA',
+  ): Promise<TProbeDohResult | { status: 'thrown'; message: string }> {
+    try {
+      return await clientArg.queryRecords(nameArg, typeArg);
+    } catch (error: unknown) {
+      return { status: 'thrown', message: describeError(error) };
+    }
+  }
+
+  /** Step 1: the nearest proper suffix of the zone with an NS RRset, over DoH. */
+  private async findParentZone(
+    clientArg: TDelegationProbeClient,
+    zoneArg: string,
+    deadlineArg: number,
+  ): Promise<TParentZoneLookup> {
+    const labels = zoneArg.split('.');
+    const candidates = labels.slice(1).map((_labelArg, indexArg) => labels.slice(indexArg + 1).join('.'));
+    for (const [index, candidate] of candidates.entries()) {
+      if (index >= PARENT_WALK_LIMIT) {
+        return { status: 'failed', detail: `no parent zone of ${zoneArg} found within ${PARENT_WALK_LIMIT} levels` };
+      }
+      if (Date.now() >= deadlineArg) {
+        return { status: 'failed', detail: `the probe deadline passed while looking for the parent zone of ${zoneArg}` };
+      }
+      const result = await this.lookUpOverDoh(clientArg, candidate, 'NS');
+      if (result.status === 'thrown') {
+        return { status: 'failed', detail: `parent zone lookup for ${candidate} threw: ${result.message}` };
+      }
+      if (result.status === 'error') {
+        return { status: 'failed', detail: `parent zone lookup for ${candidate} failed (${describeDohError(result)})` };
+      }
+      if (result.status === 'missing') continue;
+      const nameservers = [...new Set(
         result.records
-          .map((record): string => normalizeNameserver(String(record.value ?? '')))
-          .filter((nameserver): nameserver is string => Boolean(nameserver)),
+          .filter((recordArg) => recordArg.type === 'NS' && normalizeZone(recordArg.name) === candidate)
+          .map((recordArg) => normalizeNameserver(String(recordArg.value ?? '')))
+          .filter(Boolean),
       )];
-      const matches = observedNameservers.filter((observed) => expectedNameservers.includes(observed));
-      if (matches.length === 0) {
-        return {
-          zone,
-          verdict: 'not-delegated',
-          observedNameservers,
-          expectedNameservers,
-          detail: `${zone} is delegated to ${observedNameservers.join(', ') || 'nothing'}, which does not include any of our nameservers (${expectedNameservers.join(', ')})`,
-        };
-      }
+      if (nameservers.length === 0) continue;
+      return { status: 'found', parentZone: candidate, nameservers };
+    }
+    return { status: 'failed', detail: `no parent zone of ${zoneArg} found` };
+  }
+
+  /**
+   * Step 2: up to 4 distinct parent server addresses over DoH, one per parent
+   * nameserver name first. An address belongs to the first name (in sorted
+   * order) that resolves to it, so one server never counts for two names.
+   */
+  private async selectParentServers(
+    clientArg: TDelegationProbeClient,
+    zoneArg: string,
+    parentZoneArg: string,
+    nameserversArg: string[],
+  ): Promise<TParentServerSelection> {
+    const names = [...new Set(nameserversArg)]
+      .filter((nameArg) => nameArg !== zoneArg && !nameArg.endsWith(`.${zoneArg}`))
+      .sort()
+      .slice(0, PARENT_NAME_LIMIT);
+    const addressesOf = (
+      resultArg: TProbeDohResult | { status: 'thrown'; message: string },
+      familyArg: 4 | 6,
+    ): string[] => resultArg.status === 'success'
+      ? [...new Set(
+        resultArg.records
+          .map((recordArg) => String(recordArg.value ?? '').trim().toLowerCase())
+          .filter((addressArg) => plugins.net.isIP(addressArg) === familyArg),
+      )].sort()
+      : [];
+    const resolved = await Promise.all(names.map(async (nameserverArg) => {
+      const [ipv4, ipv6] = await Promise.all([
+        this.lookUpOverDoh(clientArg, nameserverArg, 'A'),
+        this.lookUpOverDoh(clientArg, nameserverArg, 'AAAA'),
+      ]);
+      return { nameserver: nameserverArg, addresses: [...addressesOf(ipv4, 4), ...addressesOf(ipv6, 6)] };
+    }));
+
+    const claimed = new Set<string>();
+    const perName = resolved
+      .map((entryArg) => ({
+        nameserver: entryArg.nameserver,
+        addresses: entryArg.addresses.filter((addressArg) => {
+          if (claimed.has(addressArg)) return false;
+          claimed.add(addressArg);
+          return true;
+        }),
+      }))
+      .filter((entryArg) => entryArg.addresses.length > 0);
+    if (perName.length < PARENT_AGREEMENT_MINIMUM) {
       return {
-        zone,
-        verdict: 'delegated',
-        observedNameservers,
-        expectedNameservers,
-        detail: `${zone} is delegated to ${matches.join(', ')}`,
+        status: 'failed',
+        detail: `only ${perName.length} of the ${names.length} usable nameserver name(s) of ${parentZoneArg} `
+          + `(${names.join(', ') || 'none'}) have a resolvable address; at least ${PARENT_AGREEMENT_MINIMUM} are needed`,
       };
-    } finally {
-      // Keep ownership if confirmed termination fails; stop() can retry it.
-      await smartdnsClient.terminate();
-      this.ownedProbeClients.delete(smartdnsClient);
     }
+
+    const servers: IParentServer[] = [];
+    for (let round = 0; servers.length < PARENT_SERVER_LIMIT; round++) {
+      const picks = perName
+        .filter((entryArg) => round < entryArg.addresses.length)
+        .map((entryArg) => ({ address: entryArg.addresses[round], nameserver: entryArg.nameserver }));
+      if (picks.length === 0) break;
+      servers.push(...picks.slice(0, PARENT_SERVER_LIMIT - servers.length));
+    }
+    return { status: 'selected', servers };
+  }
+
+  /** Step 3: the non-recursive NS query for the zone to one parent server. */
+  private async askParentServer(
+    clientArg: TDelegationProbeClient,
+    zoneArg: string,
+    parentZoneArg: string,
+    serverArg: IParentServer,
+  ): Promise<IDnsDelegationParentAnswer> {
+    const identity = { server: formatParentServer(serverArg.address), nameserver: serverArg.nameserver };
+    let result: TProbeServerResult;
+    try {
+      result = await clientArg.queryServer({
+        server: serverArg.address,
+        name: zoneArg,
+        type: 'NS',
+        recursionDesired: false,
+        dnssecOk: true,
+        transport: 'udp',
+        timeoutMs: PARENT_QUERY_TIMEOUT_MS,
+      });
+    } catch (error: unknown) {
+      return { ...identity, outcome: 'inconclusive', detail: `the query threw: ${describeError(error)}` };
+    }
+    return { ...identity, ...classifyParentAnswer(zoneArg, parentZoneArg, result) };
   }
 
   // ==========================================================================
@@ -357,6 +707,8 @@ export class DnsAuthorityManager {
   /**
    * Claim authority over a zone, but only against a positive delegation proof.
    * An undeterminable probe refuses the mutation — never assume either way.
+   * A delegation whose parent zone publishes a DS for the zone is refused as
+   * well (`dsPresent`); the DS has to be removed at the registrar first.
    */
   public async verifyZone(zoneArg: string, verifiedBy: string): Promise<IDnsAuthorityMutationResult> {
     const zone = normalizeZone(zoneArg);
@@ -375,6 +727,14 @@ export class DnsAuthorityManager {
           : `Cannot verify ${zone}: ${probe.detail}`,
       };
     }
+    if (probe.dsPresent) {
+      return {
+        success: false,
+        probe,
+        message: `Cannot verify ${zone}: ${probe.parentZone ?? 'the parent zone'} publishes a DS for ${zone}, `
+          + 'and dcrouter refuses zones with a DS. Remove the DS at the registrar, then verify again.',
+      };
+    }
 
     const entry: IDnsAuthorityZone = {
       zone,
@@ -527,7 +887,10 @@ export class DnsAuthorityManager {
         observedNameservers: probe.observedNameservers,
         expectedNameservers: probe.expectedNameservers,
         detail: `${zone} is delegated to ${probe.observedNameservers.join(', ')} but is not in the authority set, `
-          + 'so dcrouter refuses to serve it authoritatively and will not request certificates for it',
+          + 'so dcrouter refuses to serve it authoritatively and will not request certificates for it'
+          + (probe.dsPresent
+            ? `; ${probe.parentZone ?? 'the parent zone'} publishes a DS for ${zone}, which blocks the claim until it is removed`
+            : ''),
       });
     }
 

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '34.0.0',
+  version: '34.1.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }