1824414 - Confusing error message displayed when DNS reply has rcode REFUSED

Status: UNCONFIRMED

(Core :: Networking: DNS, enhancement, P3)

Description

[Marcus]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:110.0) Gecko/20100101 Firefox/110.0
Firefox for Android

Steps to reproduce:

The workstation/phone/tablet is configured to use a DNS server that filters adult content.
For each domainname with adult content the DNS server sends a valid DNS reply with rcode 5 (REFUSED) for blocked/filtered domains.

Actual results:

Enter a URL with adult content (xnxx.com).
Firefox shows an error messages that causes confusion (Hmm. We’re having trouble finding that site ...)

Expected results:

Firefox should give an appropriate clear message about what happened, e.g. "The DNS server refused to answer the query for xnxx.com" or similar.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: DNS' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Hi Marcus,

Firefox resolves domain names using the getaddrinfo call, so it has no way of distinguishing between NXDOMAIN and (some other error code).
Did you find that other browsers have a better behaviour in this case?

Thanks!

Comment 3

[Marcus]

Hi Valentin,
Hmmm, getaddrinfo is indeed not very helpful in propagating a DNS error status.
On ubuntu 22.10 I did a test with strace and getaddrinfo using the filtering DNS server (BIND 9.18.13) where resolv.conf has only one line with "nameserver <IP>"

• a lookup for a nonexisting domainname: getaddrinfo returns -2 Name or service not known (probably a NXDOMAIN), errno is 22 Invalid argument
• a lookup for a filtered domain (DNS server sends rcode REFUSED): getaddrinfo times out with 2 DNS lookup attempts and returns -3 Temporary failure in name resolution, errno is 11 Resource temporarily unavailable

It seems reasonable to assume a NXDOMAIN error for the first test.

In the second test getaddrinfo returns -3 Temporary failure which is almost always not a NXDOMAIN.
In this case I suggest to not display the NXDOMAIN error text but something better like "DNS_TEMPORARY_FAILURE - the DNS server(s) were unable to produce the IP address of <domainname>" or something similar.

I have requested the same enhancement for Chrome but have not yet received any feedback from the Chrome developers.

Thanks, Marcus

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Thank you Marcus. We'll keep this one in the backlog for now.