From 9226f8a3aa2b8396083ecfb7697afa461c44df4b Mon Sep 17 00:00:00 2001
From: Omkhar Arasaratnam <omkhar@gmail.com>
Date: Sat, 4 Jul 2026 20:02:53 -0400
Subject: [PATCH] plugin/pkg/dnsutil: guard Join against an empty label slice
 (#8225)

---
 plugin/pkg/dnsutil/join.go      | 3 +++
 plugin/pkg/dnsutil/join_test.go | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/plugin/pkg/dnsutil/join.go b/plugin/pkg/dnsutil/join.go
index b3a40db42..e33722e2e 100644
--- a/plugin/pkg/dnsutil/join.go
+++ b/plugin/pkg/dnsutil/join.go
@@ -10,6 +10,9 @@ import (
 // the root label it is ignored. Not other syntax checks are performed.
 func Join(labels ...string) string {
 	ll := len(labels)
+	if ll == 0 {
+		return "."
+	}
 	if labels[ll-1] == "." {
 		return strings.Join(labels[:ll-1], ".") + "."
 	}
diff --git a/plugin/pkg/dnsutil/join_test.go b/plugin/pkg/dnsutil/join_test.go
index 1a50a3c99..05bdcc0c7 100644
--- a/plugin/pkg/dnsutil/join_test.go
+++ b/plugin/pkg/dnsutil/join_test.go
@@ -19,3 +19,12 @@ func TestJoin(t *testing.T) {
 		}
 	}
 }
+
+func TestJoinEmpty(t *testing.T) {
+	// Join called with no labels must not index labels[ll-1] out of range; it
+	// returns the root name. Callers on the MX/SRV path can reach Join with an
+	// empty label slice.
+	if x := Join(); x != "." {
+		t.Errorf("expected %q, got %q", ".", x)
+	}
+}