CVE-2024-25638 (Java, published 2024-07-22T14:15Z)
Description: value: dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dnsjava/dnsjava
Files changed:
EXAMPLES.md
README.adoc
pom.xml
src/main/java/org/xbill/DNS/A6Record.java
src/main/java/org/xbill/DNS/AAAARecord.java
src/main/java/org/xbill/DNS/AFSDBRecord.java
src/main/java/org/xbill/DNS/APLRecord.java
src/main/java/org/xbill/DNS/ARecord.java
src/main/java/org/xbill/DNS/CAARecord.java
src/main/java/org/xbill/DNS/CDNSKEYRecord.java
src/main/java/org/xbill/DNS/CDSRecord.java
src/main/java/org/xbill/DNS/CERTRecord.java
src/main/java/org/xbill/DNS/CNAMERecord.java
src/main/java/org/xbill/DNS/ClientSubnetOption.java
src/main/java/org/xbill/DNS/CookieOption.java
src/main/java/org/xbill/DNS/DHCIDRecord.java
src/main/java/org/xbill/DNS/DLVRecord.java
src/main/java/org/xbill/DNS/DNAMERecord.java
src/main/java/org/xbill/DNS/DNSKEYRecord.java
src/main/java/org/xbill/DNS/DNSSEC.java
src/main/java/org/xbill/DNS/DSRecord.java
src/main/java/org/xbill/DNS/DohResolver.java
src/main/java/org/xbill/DNS/EDNSOption.java
src/main/java/org/xbill/DNS/ExtendedErrorCodeOption.java
src/main/java/org/xbill/DNS/GPOSRecord.java
src/main/java/org/xbill/DNS/HINFORecord.java
src/main/java/org/xbill/DNS/HTTPSRecord.java
src/main/java/org/xbill/DNS/IPSECKEYRecord.java
src/main/java/org/xbill/DNS/ISDNRecord.java
src/main/java/org/xbill/DNS/KEYRecord.java
src/main/java/org/xbill/DNS/KXRecord.java
src/main/java/org/xbill/DNS/LOCRecord.java
src/main/java/org/xbill/DNS/MBRecord.java
src/main/java/org/xbill/DNS/MDRecord.java
src/main/java/org/xbill/DNS/MFRecord.java
src/main/java/org/xbill/DNS/MGRecord.java
src/main/java/org/xbill/DNS/MINFORecord.java
src/main/java/org/xbill/DNS/MRRecord.java
src/main/java/org/xbill/DNS/MXRecord.java
src/main/java/org/xbill/DNS/NAPTRRecord.java
src/main/java/org/xbill/DNS/NSAPRecord.java
src/main/java/org/xbill/DNS/NSAP_PTRRecord.java
src/main/java/org/xbill/DNS/NSEC3PARAMRecord.java
src/main/java/org/xbill/DNS/NSEC3Record.java
src/main/java/org/xbill/DNS/NSECRecord.java
src/main/java/org/xbill/DNS/NSIDOption.java
src/main/java/org/xbill/DNS/NSRecord.java
src/main/java/org/xbill/DNS/NULLRecord.java
src/main/java/org/xbill/DNS/NXTRecord.java
src/main/java/org/xbill/DNS/NioTcpClient.java
src/main/java/org/xbill/DNS/NioUdpClient.java
src/main/java/org/xbill/DNS/OPENPGPKEYRecord.java
src/main/java/org/xbill/DNS/OPTRecord.java
src/main/java/org/xbill/DNS/Opcode.java
src/main/java/org/xbill/DNS/PTRRecord.java
src/main/java/org/xbill/DNS/PXRecord.java
src/main/java/org/xbill/DNS/RPRecord.java
src/main/java/org/xbill/DNS/RRSIGRecord.java
src/main/java/org/xbill/DNS/RTRecord.java
src/main/java/org/xbill/DNS/SIGRecord.java
src/main/java/org/xbill/DNS/SMIMEARecord.java
src/main/java/org/xbill/DNS/SOARecord.java
src/main/java/org/xbill/DNS/SPFRecord.java
src/main/java/org/xbill/DNS/SRVRecord.java
src/main/java/org/xbill/DNS/SSHFPRecord.java
src/main/java/org/xbill/DNS/SVCBBase.java
src/main/java/org/xbill/DNS/SVCBRecord.java
src/main/java/org/xbill/DNS/TKEYRecord.java
src/main/java/org/xbill/DNS/TLSARecord.java
src/main/java/org/xbill/DNS/TSIG.java
src/main/java/org/xbill/DNS/TSIGRecord.java
src/main/java/org/xbill/DNS/TXTRecord.java
src/main/java/org/xbill/DNS/TcpKeepaliveOption.java
src/main/java/org/xbill/DNS/Type.java
src/main/java/org/xbill/DNS/URIRecord.java
src/main/java/org/xbill/DNS/WKSRecord.java
src/main/java/org/xbill/DNS/X25Record.java
src/main/java/org/xbill/DNS/ZoneMDRecord.java
src/main/java/org/xbill/DNS/lookup/LookupSession.java
src/main/java/org/xbill/DNS/lookup/NoSuchRRSetException.java
src/test/java/org/xbill/DNS/dnssec/ResolveExample.java
Commit message: Fix links to RFCs and IANA registries


Vulnerable code:
        // http://data.iana.org/root-anchors/root-anchors.xml
3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://www.rfc-editor.org/rfc/rfc5155.html#section-10.3[RFC5155].
https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1[RFC8624] for recommended values.
https://www.rfc-editor.org/rfc/rfc8624.html#section-3.3[RFC8624] for recommended values.
The Extended DNS Errors (EDE, https://www.rfc-editor.org/rfc/rfc8914.html[RFC8914]) also provides the failure reason, although in less detail.
* Uses http://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
 * @see <a href="https://tools.ietf.org/html/rfc6563">RFC 6563: Moving A6 to Historic Status</a>
 * @see <a href="https://tools.ietf.org/html/rfc3596">RFC 3596: DNS Extensions to Support IP Version
 *     6</a>
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://tools.ietf.org/html/rfc3123">RFC 3123: A DNS RR Type for Lists of Address
 *     Prefixes (APL RR)</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc6844">RFC 6844: DNS Certification Authority
 *     Authorization (CAA) Resource Record</a>
 * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
 *     via CDS/CDNSKEY</a>
 * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
 *     via CDS/CDNSKEY</a>
 * @see <a href="https://tools.ietf.org/html/rfc4398">RFC 4398: Storing Certificates in the Domain
 *     Name System (DNS)</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * The Client Subnet EDNS Option, defined in <a href="https://tools.ietf.org/html/rfc7871">Client
 * subnet in DNS requests</a>.
 * Cookie EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7873
 * @see <a href="https://tools.ietf.org/html/rfc4701">RFC 4701: A DNS Resource Record (RR) for
 *     Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
 * @see <a href="https://tools.ietf.org/html/rfc4431">RFC 4431: The DNSSEC Lookaside Validation
 *     (DLV) DNS Resource Record</a>
 * @see <a href="https://tools.ietf.org/html/rfc6672">RFC 6672: DNAME Redirection in the DNS</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
     * Delete DS record in parent zone, RFC8078.
    /** ECDSA Curve P-256 with SHA-256 public key * */
    /** ECDSA Curve P-384 with SHA-384 public key * */
    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
     * SM2 signing algorithm with SM3 hashing algorithm. <a
     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * GOST R 34.10-2012 <a
     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
    /** SHA-1, RFC3658. */
    /** SHA-256, RFC4509. */
    /** GOST R 34.11-94, RFC5933. */
    /** SHA-384, RFC6605. */
     * SM3 hashing algorithm. <a
     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * GOST R 34.10-2012 <a
     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
 * Proof-of-concept <a href="https://tools.ietf.org/html/rfc8484">DNS over HTTP (DoH)</a> resolver.
 * This class is not suitable for high load scenarios because of the shortcomings of Java's built-in
 * HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
    /** Apple's DNS Long-Lived Queries protocol, draft-sekar-dns-llq-06 */
    /** Dynamic DNS Update Leases, draft-sekar-dns-ul-02 */
    /** Name Server Identifier, RFC 5001 */
    /** DNSSEC Algorithm Understood (DAU), RFC 6975 */
    /** DNSSEC DS Hash Understood (DHU), RFC 6975 */
    /** DNSSEC NSEC3 Hash Understood (N3U), RFC 6975 */
    /** Client Subnet, RFC 7871 */
    /** (EDNS) EXPIRE Option, RFC 7314 */
    /** Cookie, RFC 7873 */
    /** TCP Keepalive, RFC 7828 */
    /** EDNS(0) Padding Option, RFC 7830 */
    /** CHAIN Query Requests in DNS, RFC 7901 */
    /** Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC), RFC 8145 */
    /** Extended DNS Errors, RFC 8914. */
    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
   * state [RFC4035].
   * @see <a href="https://www.rfc-editor.org/rfc/rfc9250.html#section-4.5-3">RFC9250, 4.5</a>
   * @see <a href="https://www.rfc-editor.org/rfc/rfc9276.html#section-3.2">RFC9276, 3.2</a>
   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp,
   *     12</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC8198</a>
 * @see <a href="https://tools.ietf.org/html/rfc1712">RFC 1712: DNS Encoding of Geographical
 *     Location</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * HTTPS Service Location and Parameter Binding Record
 * @see <a
 *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a href="https://tools.ietf.org/html/rfc4025">RFC 4025: A Method for Storing IPsec Keying
 *     Material in DNS</a>
    /** A DSA key is present, in the format defined in [RFC2536] */
    /** A RSA key is present, in the format defined in [RFC3110] */
    /** An ECDSA key is present, in the format defined in [RFC6605] */
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System Security
 *     Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc3755">RFC 3755: Legacy Resolver Compatibility for
 *     Delegation Signer (DS)</a>
 * @see <a href="https://tools.ietf.org/html/rfc2230">RFC 2230: Key Exchange Delegation Record for
 *     the DNS</a>
 * @see <a href="https://tools.ietf.org/html/rfc1876">RFC 1876: A Means for Expressing Location
 *     Information in the Domain Name System</a>
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc7505">RFC 7505: A "Null MX" No Service Resource
 *     Record for Domains That Accept No Mail</a>
 * @see <a href="https://tools.ietf.org/html/rfc3403">RFC 3403: Dynamic Delegation Discovery System
 *     (DDDS) Part Three: The Domain Name System (DNS) Database</a>
 * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
 * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
 * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
 *     Authenticated Denial of Existence</a>
 * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
 *     Authenticated Denial of Existence</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc5001">RFC 5001: DNS Name Server Identifier (NSID)
 *     Option</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc2065">RFC 2065: Domain Name System Security
 *     Extensions</a>
      // https://tools.ietf.org/html/rfc7766#section-8
    // https://tools.ietf.org/html/rfc6335#section-6
 * @see <a href="https://tools.ietf.org/html/rfc7929">RFC 7929: DNS-Based Authentication of Named
 *     Entities (DANE) Bindings for OpenPGP</a>
 * @see <a href="https://tools.ietf.org/html/rfc6891">RFC 6891: Extension Mechanisms for DNS</a>
  /** DNS Stateful Operations (DSO, RFC8490) */
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc2163">RFC 2163: Using the Internet DNS to Distribute
 *     MIXER Conformant Global Address Mapping (MCGAM)</a>
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see KEYRecord <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System
 *     Security Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc8162">RFC 8162: Using Secure DNS to Associate
 *     Certificates with Domain Names for S/MIME</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc7208">RFC 7208: Sender Policy Framework (SPF) for
 *     Authorizing Use of Domains in Email, Version 1</a>
 * @see <a href="https://tools.ietf.org/html/rfc2782">RFC 2782: A DNS RR for specifying the location
 *     of services (DNS SRV)</a>
 * @see <a href="https://tools.ietf.org/html/rfc4255">RFC 4255: Using DNS to Securely Publish Secure
 *     Shell (SSH) Key Fingerprints</a>
 * @see <a
 *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a
 *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a href="https://tools.ietf.org/html/rfc2930">RFC 2930: Secret Key Establishment for DNS
 *     (TKEY RR)</a>
 * @see <a href="https://tools.ietf.org/html/rfc6698">RFC 6698: The DNS-Based Authentication of
 *     Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
    /** Full certificate; the Certificate binary structure defined in [RFC5280] */
    /** SubjectPublicKeyInfo; DER-encoded binary structure defined in [RFC5280] */
    /** SHA-256 hash of selected content [RFC6234] */
    /** SHA-512 hash of selected content [RFC6234] */
    // https://www.rfc-editor.org/rfc/rfc8945.html#section-5.4
     * href="https://www.rfc-editor.org/rfc/rfc8945.html#section-5.3.1">RFC 8945, 5.3.1</a>.
 * @see <a href="https://tools.ietf.org/html/rfc2845">RFC 2845: Secret Key Transaction
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * TCP Keepalive EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7828
   * Endpoint identifier
   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
   *     Nimrod Routing Architecture</a>
   * Nimrod locator
   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
   *     Nimrod Routing Architecture</a>
   * @see <a href="https://tools.ietf.org/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
   *     href="https://tools.ietf.org/html/draft-reid-dnsext-rkey-00">draft-reid-dnsext-rkey-00</a>
   *     href="https://tools.ietf.org/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
   * @see <a
   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
   * @see <a
   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a href="https://tools.ietf.org/html/rfc7553">RFC 7553: The Uniform Resource Identifier
 *     (URI) DNS Resource Record</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
   * @see <a href="https://tools.ietf.org/html/rfc1010">RFC 1010: Assigned Numbers</a>
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://www.rfc-editor.org/rfc/rfc8976.html">RFC8976</a>
   * record (<a href="https://www.rfc-editor.org/rfc/rfc1035.html">RFC1035, Section 3.3.13]</a>) for
   * which the zone digest was generated.
        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC1034 3.6.2");
 * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC2136 Section 2.2.
  static void main(String[] args) throws Exception {
    // http://data.iana.org/root-anchors/root-anchors.xml

Fixed code:
        // https://data.iana.org/root-anchors/root-anchors.xml
3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://datatracker.ietf.org/doc/html/rfc5155#section-10.3[RFC5155].
https://datatracker.ietf.org/doc/html/rfc8624#section-3.1[RFC8624] for recommended values.
https://datatracker.ietf.org/doc/html/rfc8624#section-3.3[RFC8624] for recommended values.
The Extended DNS Errors (EDE, https://datatracker.ietf.org/doc/html/rfc8914[RFC8914]) also provides the failure reason, although in less detail.
* Uses https://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6563">RFC 6563: Moving A6 to Historic
 *     Status</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3596">RFC 3596: DNS Extensions to Support
 *     IP Version 6</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3123">RFC 3123: A DNS RR Type for Lists of
 *     Address Prefixes (APL RR)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6844">RFC 6844: DNS Certification
 *     Authority Authorization (CAA) Resource Record</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
 *     the Parent via CDS/CDNSKEY</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
 *     the Parent via CDS/CDNSKEY</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4398">RFC 4398: Storing Certificates in
 *     the Domain Name System (DNS)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * The Client Subnet EDNS Option.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871">RFC 7871</a>
 * Cookie EDNS0 Option.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873">RFC 7873</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4701">RFC 4701: A DNS Resource Record (RR)
 *     for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4431">RFC 4431: The DNSSEC Lookaside
 *     Validation (DLV) DNS Resource Record</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6672">RFC 6672: DNAME Redirection in the
 *     DNS</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
     * Delete DS record in parent zone.
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078/">RFC 8078</a>
    /** ECDSA Curve P-256 with SHA-256 public key. */
    /** ECDSA Curve P-384 with SHA-384 public key. */
    /**
     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
     */
    /**
     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
     */
     * SM2 signing algorithm with SM3 hashing algorithm.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * @since 3.6
     * GOST R 34.10-2012.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
     * @since 3.6
    /**
     * SHA-1.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3658/">RFC 3658</a>
     */
    /**
     * SHA-256.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc4509/">RFC 4509</a>
     */
    /**
     * GOST R 34.11-94.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5933/">RFC 5933</a>
     */
    /**
     * SHA-384.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605/">RFC 6605</a>
     */
     * GOST R 34.11-2012.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
     * @since 3.6
     * SM3 hashing algorithm.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * @since 3.6
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
 * Proof-of-concept <a href="https://datatracker.ietf.org/doc/html/rfc8484">DNS over HTTP (DoH)</a>
 * resolver. This class is not suitable for high load scenarios because of the shortcomings of
 * Java's built-in HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
    /**
     * Apple's DNS Long-Lived Queries protocol.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
     */
    /**
     * Dynamic DNS Update Leases.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/html/draft-sekar-dns-ul-03">draft-sekar-dns-ul-03</a>
     */
    /**
     * Name Server Identifier.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001/">RFC 5001</a>
     */
    /**
     * DNSSEC Algorithm Understood (DAU).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
     */
    /**
     * DNSSEC DS Hash Understood (DHU).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
     */
    /**
     * DNSSEC NSEC3 Hash Understood (N3U).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
     */
    /**
     * Client Subnet.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871/">RFC 7871</a>
     */
    /**
     * (EDNS) EXPIRE Option.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7314/">RFC 7314</a>
     */
    /**
     * Cookie.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873/">RFC 7873</a>
     */
    /**
     * TCP Keepalive.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7828/">RFC 7828</a>
     */
    /**
     * EDNS(0) Padding Option.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7830/">RFC 7830</a>
     */
    /**
     * CHAIN Query Requests in DNS.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7901/">RFC 7901</a>
     */
    /**
     * Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8145/">RFC 8145</a>
     */
    /**
     * Extended DNS Errors.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8914/">RFC 8914</a>
     */
    /**
     * DNS EDNS Tags.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
     */
    /**
     * DNS EDNS Tags.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
     */
    /**
     * Report Channel.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9567/">RFC 9567</a>
     * @since 3.6
     */
    public static final int REPORT_CHANNEL = 18;

      codes.add(REPORT_CHANNEL, "Report-Channel");
   * state.
   *
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc4035>RFC 4035</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9250#section-4.5-3">RFC 9250, 4.5</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9276#section-3.2">RFC 9276, 3.2</a>
   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp-01</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC 8198</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1712">RFC 1712: DNS Encoding of
 *     Geographical Location</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * HTTPS Service Location and Parameter Binding Record.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4025">RFC 4025: A Method for Storing IPsec
 *     Keying Material in DNS</a>
    /**
     * A DSA key is present.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc2536">RFC 2536</a>
     */
    /**
     * A RSA key is present.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3110">RFC 3110</a>
     */
    /**
     * An ECDSA key is present.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605">RFC 6605</a>
     */
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name System
 *     Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3755">RFC 3755: Legacy Resolver
 *     Compatibility for Delegation Signer (DS)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2230">RFC 2230: Key Exchange Delegation
 *     Record for the DNS</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1876">RFC 1876: A Means for Expressing
 *     Location Information in the Domain Name System</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7505">RFC 7505: A "Null MX" No Service
 *     Resource Record for Domains That Accept No Mail</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3403">RFC 3403: Dynamic Delegation
 *     Discovery System (DDDS) Part Three: The Domain Name System (DNS) Database</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
 *     Records</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
 *     Records</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
 *     Hashed Authenticated Denial of Existence</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
 *     Hashed Authenticated Denial of Existence</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001">RFC 5001: DNS Name Server Identifier
 *     (NSID) Option</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2065">RFC 2065: Domain Name System
 *     Security Extensions</a>
      // https://datatracker.ietf.org/doc/html/rfc7766#section-8
    // https://datatracker.ietf.org/doc/html/rfc6335#section-6
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7929">RFC 7929: DNS-Based Authentication
 *     of Named Entities (DANE) Bindings for OpenPGP</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6891">RFC 6891: Extension Mechanisms for
 *     DNS</a>
  /**
   * DNS Stateful Operations (DSO).
   *
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8490">RFC 8490</a>
   */
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2163">RFC 2163: Using the Internet DNS to
 *     Distribute MIXER Conformant Global Address Mapping (MCGAM)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see KEYRecord <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name
 *     System Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8162">RFC 8162: Using Secure DNS to
 *     Associate Certificates with Domain Names for S/MIME</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7208">RFC 7208: Sender Policy Framework
 *     (SPF) for Authorizing Use of Domains in Email, Version 1</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2782">RFC 2782: A DNS RR for specifying
 *     the location of services (DNS SRV)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4255">RFC 4255: Using DNS to Securely
 *     Publish Secure Shell (SSH) Key Fingerprints</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2930">RFC 2930: Secret Key Establishment
 *     for DNS (TKEY RR)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6698">RFC 6698: The DNS-Based
 *     Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
    /**
     * Full certificate; the Certificate binary structure.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
     */
    /**
     * SubjectPublicKeyInfo; DER-encoded binary structure.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
     */
    /**
     * SHA-256 hash of selected content.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
     */
    /**
     * SHA-512 hash of selected content.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
     */
    // https://datatracker.ietf.org/doc/html/rfc8945#section-5.4
     * href="https://datatracker.ietf.org/doc/html/rfc8945#section-5.3.1">RFC 8945, 5.3.1</a>.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2845">RFC 2845: Secret Key Transaction
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * TCP Keepalive EDNS0 Option, as defined in https://datatracker.ietf.org/doc/html/rfc7828
   * DNS Resource Records for Nimrod Routing Architecture, Endpoint identifier.
   * @see <a
   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
   * DNS Resource Records for Nimrod Routing Architecture, Nimrod locator.
   * @see <a
   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
   * @see <a
   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-rkey-01</a>
   *     href="https://datatracker.ietf.org/doc/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7553">RFC 7553: The Uniform Resource
 *     Identifier (URI) DNS Resource Record</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc1010">RFC 1010: Assigned Numbers</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8976">RFC 8976</a>
   * record (<a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035, Section 3.3.13]</a>)
   * for which the zone digest was generated.
        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC 1034 3.6.2");
 * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC 2136, Section 2.2.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2136#section-2">RFC 2136</a>
  public static void main(String[] args) throws Exception {
    // https://data.iana.org/root-anchors/root-anchors.xml