Tracking issue for Let's Encrypt deployment requirements

[divergentdave]

Let's Encrypt is interested in deploying Hickory DNS in order to handle recursive resolution. This tracking issue lists other issues that need to be resolved before deploying Hickory DNS there.

• Recursive resolver benchmarks #3435
• Recursor does not cache negative responses #2595
• Recursive resolver: consider making QNAME minimization optional #2917
• Store one Proof per RRset, instead of per record #3011 - Store proofs per-rrset #3422
• Recursor: Name server pool cache does not check TTL #2574
• Recursor: Retransmission policy #2645
• make validating Recursor cache intermediate DNSSEC validations #2294
• Resolver: Deduplicate connections to name servers #2738
• Insufficient validation of wildcard expanded positive responses #2882
• Do not resolve publically-routable DNS names to private/loopback IP addresses #347 (Do not resolve private/reserved addresses on public zones #3298 added recursor support)
• Incorrect NSEC validation #3143
• Recursor: CNAME chasing results in duplicate records #3153
• Validating resolver returns SERVFAIL when an insecure zone name server doesn't return SOA in no data response #3128
• Recursor does not handle error responses correctly #3142
• Validating a message with no RRSIGs may trigger infinite recursion #3042
• NSEC3: Limit number of iterations #2626
• RFC 8906: Correctly responding to queries in the presence of internal errors #2572
• recursor fails when cname is returned from an intermediate NS request #2788
• Prometheus metrics #2032
• Add aws-lc-rs as a crypto backend #2716
• Add case randomization config option to resolver and recursor #2683
• DNSSEC validation incorrectly returning bogus instead of insecure #2714
• Add a configurable do-not-query-list #1723 (an IP block list is sufficient, a name block list is not required)
• Add the ability to deny usage of SocketAddrs for outbound ports #1722 (a UDP port block list is sufficient, a TCP port block list is not required)
• Add more substantial caching to the recursor #1720
• Add new algorithms to the NameserverPool for rotating nameservers used when making queries #1721
• Concurrent access to the DNS cache for better performance #2261
• Multiple round-trip encoding issues identified by fuzzer #2353
• DNSSEC false positives #2389
• Add NSEC3 support to hickory-server #2391
• CAA RDATA should hold invalid issuer names as-is #2415
• Recursor: follow NS referrals other than the first one #2466
• Truncated responses may be cached #2608
• IP allow/deny-lists for the server #1719

[djc]

• Sorted the list to drift all the closed issues to the end
• Replaced Randomize capitalization of queries for spoofing resistance #2390 with the open PR Add case randomization config option to resolver and recursor #2683