resolver: DS query for local authoritative zone returns SERVFAIL

hello,

i'm using BIND 9.20.26 on FreeBSD 15.0.  i'm having an issue where a DS
query for a zone unexpectedly returns SERVFAIL:

  # dig 64-127.69.155.90.in-addr.arpa ds @::1 +noall +answer +comments
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ; COOKIE: 4202c41987065998010000006a82cc3a5e9251f76a4ae608 (good)

when returning the error, BIND logs:

  Aug 17 09:54:18 amaranth named[43811]: query-errors: info: client
  @0x3c5a4b759000 ::1#18083 (64-127.69.155.90.in-addr.arpa): view resolver:
  query failed (SERVFAIL) for 64-127.69.155.90.in-addr.arpa/IN/DS at query.c:7651

but no other useful information.

a query for a different rrtype, such as NS, works fine:

  # dig 64-127.69.155.90.in-addr.arpa ns @::1 +noall +answer +comments
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25297
  ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ; COOKIE: ab68fd7c1fd103a0010000006a82cc5fedde6474d363832f (good)
  ;; ANSWER SECTION:
  64-127.69.155.90.in-addr.arpa. 3600 IN  NS      ns3.le-fay.org.
  64-127.69.155.90.in-addr.arpa. 3600 IN  NS      ns1.le-fay.org.
  64-127.69.155.90.in-addr.arpa. 3600 IN  NS      ns2.le-fay.org.

querylog for both queries shows:

  2026-08-17T09:54:18.452 queries: info: client @0x3c5a4b759000 ::1#18083 
  (64-127.69.155.90.in-addr.arpa): view resolver: query: 
  64-127.69.155.90.in-addr.arpa IN DS +E(0)K (::1)

  2026-08-17T09:54:55.512 queries: info: client @0x3c5a4a9f5000 ::1#64036
  (64-127.69.155.90.in-addr.arpa): view resolver: query:
   64-127.69.155.90.in-addr.arpa IN NS +E(0)K (::1)

this zone is not signed, it contains no DS records (or any other DNSSEC
related records) and there are no DS records in the parent zone.  for
reference, a copy of the zone (AXFR output) is available here:
  https://www.le-fay.org/files/tmp/64-127.69.155.90.in-addr.arpa.txt

the zone is configured via a catalogue zone in a view:

  view "resolver" {
	  attach-cache "resolver";
	  match-destinations { [...] };
	  dns64 64:ff9b::/96 { clients { none; }; };
	  disable-empty-zone "d.f.ip6.arpa";
	  include "/usr/local/etc/namedb/stub-zones.conf";

	  zone "catalog.invalid" {
		  type secondary;
		  file "/var/db/named/secondary/catalog.invalid.zone";
		  primaries { [...] };
		  notify no;
		  min-refresh-time 300;
		  max-refresh-time 300;
	  };

	  catalog-zones {
		  zone "catalog.invalid"
			  zone-directory "/var/db/named/secondary"
			  default-primaries { [...] };
	  };
  };

the same catalogue zone is also configured in another view, which is identical
aside from DNS64 being enabled in that view.  both views exhibit the same
SERVFAIL behaviour.

i don't think this is expected behaviour -- does anyone have any idea
what's going on here?

thanks.
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.