plugin/pkg/response: classify nxdomain without soa as denial (#8199)

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

plugin/cache/cache.go

@@ -90,10 +90,23 @@ func key(qname string, m *dns.Msg, t response.Type, do, cd bool) (bool, uint64)
 	if t == response.OtherError || t == response.Meta || t == response.Update {
 		return false, 0
 	}
+	// Negative caching requires an SOA record to determine the denial TTL.
+	if t == response.NameError && !hasSOA(m) {
+		return false, 0
+	}
 
 	return true, hash(qname, m.Question[0].Qtype, do, cd)
 }
 
+func hasSOA(m *dns.Msg) bool {
+	for _, r := range m.Ns {
+		if r.Header().Rrtype == dns.TypeSOA {
+			return true
+		}
+	}
+	return false
+}
+
 var one = []byte("1")
 var zero = []byte("0")
 

plugin/cache/cache_test.go

@@ -122,6 +122,16 @@ func TestCacheInsertion(t *testing.T) {
 			},
 			shouldCache: true,
 		},
+		{
+			name: "test dns.RcodeNameError without SOA does not cache",
+			in: test.Case{
+				Rcode:              dns.RcodeNameError,
+				Qname:              "1.1.168.192.in-addr.arpa.",
+				Qtype:              dns.TypePTR,
+				RecursionAvailable: true,
+			},
+			shouldCache: false,
+		},
 		{
 			name: "test dns.RcodeServerFailure cache",
 			out: test.Case{