as112

Pre-Alpha. This page describes behavior that may change.

Ze's as112 plugin runs an AS112 anycast DNS node: an authoritative sink for misdirected reverse-DNS queries about RFC 1918 and link-local address space (RFC 7534), plus the EMPTY.AS112.ARPA DNAME-redirection zone (RFC 7535). It answers on four fixed anycast host addresses that are Go constants, never operator-typed IPs. While the node is serving, Ze can originate the covering prefixes into BGP under a health watchdog and withdraw them the moment the node stops answering.

What it does

Function	Status	Notes
Authoritative sink	Production	Serves the RFC 7534 Direct Delegation empty zones and the RFC 7535 EMPTY.AS112.ARPA DNAME-redirection zone with fixed SOA/NS data. Authoritative-only, recursion disabled.
BGP origination	Via redistribute or hand-authored	The four covering prefixes are announced into BGP while the node serves, then withdrawn on serving loss.
DoT / DoH	Optional	RFC 7858 DNS-over-TLS and RFC 8484 DNS-over-HTTPS listeners, same authoritative answer policy as cleartext.

The four canonical anycast addresses (192.175.48.1, 192.31.196.1, 2620:4f:8000::1, 2001:4:112::1) are registered against the interface address-ownership registry and bound on lo automatically. Because that registration is a same-process call into the iface engine, as112 must run as an internal plugin; it refuses to start and logs an error if it detects it is running out-of-process.

Minimal config

This is the entire config a plain (non-BGP) AS112 node needs:

service {
    as112 {
        enabled true
        hostname "node1.example.net"
    }
}

The anycast addresses are never typed into config. hostname, facility, and location populate the HOSTNAME.AS112.{NET,ARPA} TXT answer so operators can tell which anycast instance replied.

Configuration reference

All leaves live under service { as112 { ... } }.

Leaf	Type	Default	Notes
enabled	boolean	false	Enable the AS112 anycast DNS node.
address-family	enum	both	both, ipv4-only, or ipv6-only for a single-stack node.
hostname	string (0-63)	(empty)	Node-identification string in the HOSTNAME TXT answer.
facility	string (0-100)	(empty)	Facility / site name in the HOSTNAME TXT answer.
location	string (0-100)	(empty)	City / country in the HOSTNAME TXT answer.
allow-from	leaf-list (ip-prefix)	(empty = answer all)	Optional client-source allow list. Loopback and on-box sources are always permitted so the healthcheck is never blocked.
asn	asn (1-4294967295)	112	Origin AS the covering prefixes carry when redistributed. Ignored unless import as112 is set.
community	leaf-list	(empty)	Optional BGP communities on the covering prefixes (AA:NN or well-known names such as no-export, nopeer). Ignored unless import as112 is set.
watchdog	boolean	true	Health-gate the BGP announcement on serving state. Ignored unless import as112 is set.

The combined hostname, facility, and location TXT payload is bounded so the HOSTNAME response always fits 512 octets without EDNS0.

BGP origination

The covering prefixes announced into BGP are the /24s and /48s (192.175.48.0/24, 192.31.196.0/24, 2620:4f:8000::/48, 2001:4:112::/48), never the /32 and /128 host addresses bound on lo. Neither side hardcodes the other: as112 never reads bgp {} config and BGP holds no AS112 knowledge.

The easy path models the node as a virtual router and redistributes its covering prefixes with one import as112 line. Origin AS and communities come from the source-level asn and community leaves. With watchdog true (the default), the routes are announced only while the DNS node is serving (RFC 7534) and withdrawn on serving loss, enabled false, or shutdown.

service {
    as112 {
        enabled true
        asn 112              # origin AS on the wire (default 112); an operator/private ASN overrides
        community [ nopeer ] # optional propagation restriction
        # watchdog true      # default: announce only while serving
    }
}
redistribute {
    destination bgp {
        import as112         # the trigger; without this line nothing is announced
    }
}

To an iBGP peer the AS_PATH is [asn] (for example [112]); to an eBGP peer the local AS is prepended, giving [localAS, asn].

For per-peer origin AS or community, dedicated peer-group policy, or full anycast-path liveness, a hand-authored healthcheck probe gating a watchdog-controlled update block remains available. That composition reuses existing BGP mechanisms; there is no turnkey as112 { bgp { ... } } block.

DoT and DoH

Optional DNS-over-TLS (RFC 7858) and DNS-over-HTTPS (RFC 8484) listeners bind the same anycast addresses (and loopback) on their own ports and share one certificate. They serve the same static empty-zone answers as the cleartext listener; the transport changes, the authoritative answer policy does not.

service {
    as112 {
        enabled true
        tls {
            enabled true
            listen-port 853         # RFC 7858 domain-s
            cert-file "as112.pem"   # unset cert-file/key-file selects an ephemeral cert
            key-file  "as112.key"
        }
        doh {
            enabled true
            listen-port 443
            path "/dns-query"       # RFC 8484
        }
    }
}

Doctor checks

ze doctor surfaces AS112 problems before the daemon serves.

Code	Severity	Guards
doctor-as112-watchdog-missing-withdraw	warning	A BGP update block announces an AS112 covering prefix without watchdog { withdraw true }. The marker's absence defaults the route to already-announced, so it would advertise before AS112 health is confirmed (RFC 7534).
doctor-as112-global-origin-uncoordinated	warning	asn.local 112 plus replace-as faces a non-private remote ASN, making the node an uncoordinated global AS112 origin.
doctor-as112-redistribute-origin-uncoordinated	warning	Redistributed asn 112 reaches an eBGP session to a public ASN, the redistribute-path equivalent of the same coordination hazard.
doctor-as112-port-unavailable	warning	The fixed UDP/TCP port 53 cannot be bound (needs CAP_NET_BIND_SERVICE or root, or the port is in use).
doctor-tls-missing / doctor-tls-expired / doctor-tls-invalid	warning	The DoT/DoH certificate material is missing, expired, or invalid when a secure listener is enabled.

The watchdog-withdraw and global-origin checks live in the neutral internal/component/doctor package so neither the plugin nor the BGP engine has to import the other.

Interoperability

The BGP origination is verified against live FRR and BIRD peers under QEMU. The as112-origin-as-frr scenario confirms that replace-as presents AS_PATH origin 112 to an external FRR peer while a second peer-group presents Ze's real local AS to an external BIRD peer, both controlled independently. Further scenarios cover custom origin AS and community propagation on both the hand-authored and redistribute paths.

See also

• BGP redistribute for the import as112 origination path.
• BGP watchdog and BGP healthcheck for the hand-authored origination composition.
• GeoDNS / DNS: the shared authoritative DNS harness (internal/core/dnsserver) that AS112 and GeoDNS both build on.

Adapted from main/docs/guide/as112.md.