CNAME chains are sometimes not followed when RPZs add a local CNAME rewrite

[Mynacol]

Describe the bug
When using a RPZ that injects CNAME redirects locally, unbound doesn't resolve the injected CNAME to IP addresses.

$ drill www.soundcloud.com aaaa
;; QUESTION SECTION:
;www.soundcloud.com.		IN	AAAA

;; ANSWER SECTION:
www.soundcloud.com.	300	IN	CNAME	dbt43jimgm1f3.cloudfront.net.

;; ADDITIONAL SECTION:
rpz.delegacy.monostack.org. 300	IN	SOA	updates.delegacy.monostack.org. hostmaster.monostack.org. 2025090500 60 30 86400 3600

To reproduce
Steps to reproduce the behavior:

1. Setup DeLegacy RPZ as described here.
2. Try to resolve domains such as www.api.ing.carrier.com, www.soundcloud.com or www.ecosia.org (A or AAAA record type).
3. Observe that unbound doesn't resolve the domain name to an IP address.

Expected behavior
Unbound follows (also with RPZ injected) CNAMEs until an IP address is found or an error prevents that.

$ drill www.soundcloud.com aaaa
;; QUESTION SECTION:
;; www.soundcloud.com.	IN	AAAA

;; ANSWER SECTION:
www.soundcloud.com.	85045	IN	CNAME	dbt43jimgm1f3.cloudfront.net.
dbt43jimgm1f3.cloudfront.net.	5	IN	CNAME	static.twitchcdn.net.
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:1e00:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:ee00:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:8400:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:ce00:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:7a00:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:2a00:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:de00:2:1912:75c0:93a1
static.twitchcdn.net.	60	IN	AAAA	2600:9000:2724:8000:2:1912:75c0:93a1

;; ADDITIONAL SECTION:
rpz.delegacy.monostack.org.	300	IN	SOA	updates.delegacy.monostack.org. hostmaster.monostack.org. 2025083100 60 30 86400 3600

System:

• Unbound version: 1.22.0
• OS: (maybe Debian?, but I was also affected on NixOS 24.11 already)
• unbound -V output:

Version 1.22.0

Configure line: --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/x86_64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --enable-cachedb --with-libhiredis --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.5.1 1 Jul 2025
Linked modules: dns64 python cachedb subnetcache respip validator iterator
TCP Fastopen feature available

BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues

Additional information
I actually switched to BIND, which correctly resolves all such situations, but multiple users of the RPZ face this issue with unbound. I lack details, but the issue should be reproducible (although not necessarily all the time).
See the following issues for some more details:

• https://codeberg.org/IPv6-Monostack/delegacy-rpz/issues/17
• https://codeberg.org/IPv6-Monostack/delegacy-rpz/issues/61
• https://codeberg.org/IPv6-Monostack/delegacy-rpz/issues/62

[Mynacol]

Thanks, that was very quick and painless!

[wcawijngaards]

The commit fixes when the rpz entry uses a wildcard, *.example.net CNAME static.example.org., and it was after a CNAME was already followed. There is a fix for query name and for nsdname matching. Thank you for reporting the issue!