Python: Get the RA flag from DNS

Question

I'm trying to specifically get the Recursion Available (RA) flag from the DNS. According to the RFC 1035, if there's no recursion it should return zero, otherwise non-zero. If a DNS response is blocked by Quad9 DNS service it returns an "NXDOMAIN" with a "RA:0"

However, using DNSPython is always returns non-zero (128). Can this hardcoded in the library?

import dns
import dns.resolver

# Allowed Domain
# should return an IP address with "RA" non-zero
domain = "google.com"

# Blocked domain 
# Should return NXDOMAIN with "RA" to 0
#domain = "takelady.net" ---> UNCOMMENT

# Set Resolver to Quad9 (quad9.net)
my_resolver = dns.resolver.Resolver()
my_resolver.nameservers = ['9.9.9.9']

try:
    dns_response = dns.resolver.query(domain, "A")

    for resp in dns_response:
        print("[+]", resp.to_text())

    print("RA flag:", dns.flags.RA)
    
except dns.resolver.NXDOMAIN:
    print("[+] NXDOMAIN")
    print("RA flag:", dns.flags.RA)
    pass

except dns.resolver.NoAnswer:
    print("[+] NoAnswer")
    pass

except dns.resolver.Timeout:
    print("[+] Timeout")
    pass

Allowed Response:

[+] 172.217.214.100
[+] 172.217.214.101
[+] 172.217.214.138
[+] 172.217.214.139
[+] 172.217.214.113
[+] 172.217.214.102
RA flag: 128

Blocked Response:

[+] NXDOMAIN
RA flag: 128

score 1 · Accepted Answer · answered Jul 16 '20 at 21:09

1

You do not use the resolver object you have created, so queries go to the system resolver. You should use this instead:

dns_response = my_resolver.query(domain, "A")

query() performs search list processing, so you should clear the search list first, like this:

    my_resolver = dns.resolver.Resolver()
    my_resolver.nameservers = ['9.9.9.9']
    my_resolver.search = []

Finally, the NXDOMAIN response results in an exception, and you need to read the flags from the response object in the exception, like this:

except dns.resolver.NXDOMAIN as e:
    print("[+] NXDOMAIN")
    for (name, resp) in e.responses().items():
        print(name, "RA flag:", resp.flags & dns.flags.RA)

answered Jul 16 '20 at 21:09

Florian Weimer

32,022
3
48
92

I am having the "NameError: name 'e' is not defined" error within the "e.responses().items()" -> any import is missing? – Andre Jul 17 '20 at 07:32
Did you include the `as e` on the `except` line? – Florian Weimer Jul 17 '20 at 07:33
Well-spotted! but still having an error, code here: https://pastebin.com/WPFCdxK5 – Andre Jul 17 '20 at 08:50
AttributeError: 'NXDOMAIN' object has no attribute 'responses' – Andre Jul 17 '20 at 08:53
What are your Python and dnspython version? Your code works for me with Python 3.7.3 and dnspython 1.16.0. – Florian Weimer Jul 17 '20 at 10:00
Tested with 3.6.3 (1.15.0) - will try to upgrade to 1.16 – Andre Jul 17 '20 at 10:22
I did upgrade to dnspython 1.16.0 and worked fine! Thanks for taking the time to help me. – Andre Jul 17 '20 at 15:41

Python: Get the RA flag from DNS

1 Answers1