dnsimple · NelsonVides · Jul 1, 2025 · Jun 30, 2025 · Jun 30, 2025 · Jun 30, 2025
diff --git a/src/erldns_records.erl b/src/erldns_records.erl
@@ -49,7 +49,7 @@ optionally_convert_wildcard(Name, Qname) ->
 -doc """
 Get a wildcard variation of a Qname.
 
-Replaces the leading abel with an asterisk for wildcard lookup.
+Replaces the leading label with an asterisk for wildcard lookup.
 """.
 -spec wildcard_qname(dns:dname()) -> dns:dname().
 wildcard_qname(Qname) ->
@@ -137,7 +137,7 @@ match_wildcard_label() ->
 
 -spec match_delegation(dns:dname()) -> fun((dns:rr()) -> boolean()).
 match_delegation(Name) ->
-    fun(R) when is_record(R, dns_rr) -> R#dns_rr.data =:= #dns_rrdata_ns{dname = Name} end.
+    fun(#dns_rr{data = Data}) -> #dns_rrdata_ns{dname = Name} =:= Data end.
 
 -spec match_type_covered(dns:type()) -> fun((dns:rr()) -> boolean()).
 match_type_covered(Qtype) ->

diff --git a/src/erldns_dnssec.erl → src/pipes/erldns_dnssec.erl b/src/erldns_dnssec.erl → src/pipes/erldns_dnssec.erl
@@ -1,17 +1,3 @@
-%% Copyright (c) 2012-2020, DNSimple Corporation
-%%
-%% Permission to use, copy, modify, and/or distribute this software for any
-%% purpose with or without fee is hereby granted, provided that the above
-%% copyright notice and this permission notice appear in all copies.
-%%
-%% THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-%% WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-%% MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-%% ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-%% WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-%% ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-%% OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
 -module(erldns_dnssec).
 -moduledoc """
 DNSSEC implementation.

diff --git a/src/pipes/erldns_resolver.erl b/src/pipes/erldns_resolver.erl
@@ -37,18 +37,7 @@ call(Msg, _) ->
     Msg.
 
 call(Msg, _, []) ->
-    case erldns_config:use_root_hints() of
-        true ->
-            {Authority, Additional} = erldns_records:root_hints(),
-            Msg#dns_message{
-                aa = false,
-                rc = ?DNS_RCODE_REFUSED,
-                authority = Authority,
-                additional = Additional
-            };
-        _ ->
-            Msg#dns_message{aa = false, rc = ?DNS_RCODE_REFUSED}
-    end;
+    optionally_add_root_hints(Msg#dns_message{aa = false, rc = ?DNS_RCODE_REFUSED});
 call(Msg, #{host := Host}, AuthorityRecords) ->
     try
         resolve(Msg, AuthorityRecords, Host)
@@ -156,7 +145,7 @@ resolve_qname_and_qtype(Message, AuthorityRecords, Qname, Qtype, Host) ->
     Qname :: dns:dname(),
     Qtype :: dns:type(),
     Zone :: erldns:zone(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()]
 ) ->
     dns:message().
@@ -231,7 +220,7 @@ exact_match_resolution(Message, Qname, Qtype, Host, CnameChain, MatchedRecords,
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     MatchedRecords :: [dns:rr()],
     Zone :: erldns:zone()
@@ -250,8 +239,8 @@ resolve_exact_match(Message, Qname, Qtype, Host, CnameChain, MatchedRecords, Zon
             [] ->
                 % No records matched the qtype, call custom handler
                 Handlers = erldns_handler:get_versioned_handlers(),
-                HandlerRecords = lists:flatten(
-                    lists:map(call_handlers(Qname, Qtype, MatchedRecords, Message), Handlers)
+                HandlerRecords = lists:flatmap(
+                    call_handlers(Qname, Qtype, MatchedRecords, Message), Handlers
                 ),
                 erldns_dnssec:maybe_sign_rrset(Message, HandlerRecords, Zone);
             _ ->
@@ -281,7 +270,7 @@ resolve_exact_match(Message, Qname, Qtype, Host, CnameChain, MatchedRecords, Zon
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     MatchedRecords :: [dns:rr()],
     Zone :: erldns:zone(),
@@ -358,7 +347,7 @@ resolve_exact_type_match(
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     MatchedRecords :: [dns:rr()],
     Zone :: erldns:zone(),
@@ -448,7 +437,7 @@ resolve_exact_match_referral(Message, _, _MatchedRecords, _ReferralRecords, Auth
 -spec resolve_exact_match_with_cname(
     Message :: dns:message(),
     Qtype :: ?DNS_TYPE_CNAME,
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     MatchedRecords :: [dns:rr()],
     Zone :: erldns:zone(),
@@ -489,7 +478,7 @@ resolve_exact_match_with_cname(
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     BestMatchRecords :: [dns:rr()],
     Zone :: erldns:zone()
@@ -521,7 +510,7 @@ best_match_resolution(Message, Qname, Qtype, Host, CnameChain, BestMatchRecords,
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     BestMatchRecords :: [dns:rr()],
     Zone :: erldns:zone()
@@ -563,7 +552,7 @@ resolve_best_match(Message, Qname, Qtype, Host, CnameChain, BestMatchRecords, Zo
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     BestMatchRecords :: [dns:rr()],
     Zone :: erldns:zone(),
@@ -586,8 +575,8 @@ resolve_best_match_with_wildcard(
         [] ->
             % There is no exact type matches for the original qtype, ask the custom handlers for their records.
             Handlers = erldns_handler:get_versioned_handlers(),
-            HandlerRecords = lists:flatten(
-                lists:map(call_handlers(Qname, Qtype, MatchedRecords, Message), Handlers)
+            HandlerRecords = lists:flatmap(
+                call_handlers(Qname, Qtype, MatchedRecords, Message), Handlers
             ),
             Records = lists:map(erldns_records:replace_name(Qname), HandlerRecords),
             NewRecords = erldns_dnssec:maybe_sign_rrset(Message, Records, Zone),
@@ -619,7 +608,7 @@ resolve_best_match_with_wildcard(
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     BestMatchRecords :: [dns:rr()],
     Zone :: erldns:zone(),
@@ -662,7 +651,7 @@ resolve_best_match_with_wildcard_cname(
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     BestMatchRecords :: [dns:rr()],
     Zone :: erldns:zone(),
@@ -721,7 +710,7 @@ restart_query(Message, _Name, _Qtype, _Host, _CnameChain, _Zone, false) ->
     Message :: dns:message(),
     Qname :: dns:dname(),
     Qtype :: dns:type(),
-    Host :: dns:ip(),
+    Host :: erldns_pipeline:host(),
     CnameChain :: [dns:rr()],
     Zone :: erldns:zone(),
     InZone :: boolean()
@@ -875,8 +864,8 @@ additional_processing(Message, _Host, _Zone, []) ->
     Message;
 %% There are records with names that require additional processing.
 additional_processing(Message, Host, Zone, Names) ->
-    RRs = lists:flatten(
-        lists:map(fun(Name) -> erldns_zone_cache:get_records_by_name(Name) end, Names)
+    RRs = lists:flatmap(
+        fun(Name) -> erldns_zone_cache:get_records_by_name(Name) end, Names
     ),
     Records = lists:filter(erldns_records:match_types([?DNS_TYPE_A, ?DNS_TYPE_AAAA]), RRs),
     additional_processing(Message, Host, Zone, Names, Records).

diff --git a/src/zones/erldns_zone_cache.erl b/src/zones/erldns_zone_cache.erl
@@ -183,7 +183,7 @@ in_zone(Name) ->
         zone_not_found ->
             false;
         ZoneName ->
-            is_name_in_zone(NormalizedName, ZoneName)
+            is_name_in_zone(ZoneName, NormalizedName)
     end.
 
 -doc """
@@ -202,7 +202,7 @@ record_name_in_zone(ZoneName, Name) ->
             Pattern = {{{NormalizedZoneName, NormalizedName, '_'}, '_'}, [], [true]},
             case ets:select_count(zone_records_typed, [Pattern]) of
                 0 ->
-                    is_name_in_zone_with_wildcard(NormalizedName, ZoneName);
+                    is_name_in_zone_with_wildcard(NormalizedZoneName, NormalizedName);
                 _ ->
                     true
             end
@@ -320,26 +320,27 @@ put_zone_rrset({ZoneName, Digest, Records, _Keys}, RRFqdn, Type, Counter) ->
                 #{domain => [erldns, zones]}
             ),
             KeySets = Zone#zone.keysets,
+            NormalizedRRFqdn = dns:dname_to_lower(RRFqdn),
             SignedRRSet = sign_rrset(Zone#zone{records = Records, keysets = KeySets}),
             {RRSigRecsCovering, RRSigRecsNotCovering} = filter_rrsig_records_with_type_covered(
-                RRFqdn, Type
+                NormalizedRRFqdn, Type
             ),
             % RRSet records + RRSIG records for the type + the rest of RRSIG records for FQDN
-            CurrentRRSetRecords = get_records_by_name_and_type(RRFqdn, Type),
+            CurrentRRSetRecords = get_records_by_name_and_type(NormalizedRRFqdn, Type),
             ZoneRecordsCount = Zone#zone.record_count,
             % put zone_records_typed records first then create the records in zone_records
             TypedRecords = Records ++ SignedRRSet ++ RRSigRecsNotCovering,
-            put_zone_records_typed_entry(NormalizedZoneName, RRFqdn, TypedRecords),
+            put_zone_records_typed_entry(NormalizedZoneName, NormalizedRRFqdn, TypedRecords),
             UpdatedZoneRecordsCount =
                 ZoneRecordsCount +
                     (length(Records) - length(CurrentRRSetRecords)) +
                     (length(SignedRRSet) - length(RRSigRecsCovering)),
             update_zone_records_and_digest(ZoneName, UpdatedZoneRecordsCount, Digest),
-            write_rrset_sync_counter(NormalizedZoneName, RRFqdn, Type, Counter),
+            write_rrset_sync_counter(NormalizedZoneName, NormalizedRRFqdn, Type, Counter),
             ?LOG_DEBUG(
                 #{
                     what => rrset_update_completed,
-                    rrset => RRFqdn,
+                    rrset => NormalizedRRFqdn,
                     type => Type
                 },
                 #{domain => [erldns, zones]}
@@ -390,11 +391,9 @@ delete_zone_rrset(ZoneName, Digest, RRFqdn, Type, Counter) ->
                             erldns_records:match_type_covered(Type),
                             get_records_by_name_and_type(RRFqdn, ?DNS_TYPE_RRSIG_NUMBER)
                         ),
-                    Value = {
-                        {NormalizedZoneName, NormalizedRRFqdn, ?DNS_TYPE_RRSIG_NUMBER},
-                        RRSigsNotCovering
-                    },
-                    ets:insert(zone_records_typed, Value),
+                    do_put_zone_records_typed_entry(
+                        NormalizedZoneName, NormalizedRRFqdn, ?DNS_TYPE_RRSIG, RRSigsNotCovering
+                    ),
                     % only write counter if called explicitly with Counter value i.e. different than 0.
                     % this will not write the counter if called by put_zone_rrset/3 as it will prevent subsequent delete ops
                     case Counter of
@@ -469,7 +468,8 @@ insert_zone(#zone{} = Zone) ->
     ets:insert(zones, Zone).
 
 %% expects name to be already normalized
--spec prepare_zone_records(dns:dname(), map()) -> list().
+-spec prepare_zone_records(dns:dname(), #{dns:dname() => [dns:rr()]}) ->
+    [{dns:dname(), dns:dname(), dns:type(), [dns:rr()]}].
 prepare_zone_records(NormalizedName, RecordsByName) ->
     lists:flatmap(
         fun({Fqdn, Records}) ->
@@ -482,20 +482,20 @@ prepare_zone_records(NormalizedName, RecordsByName) ->
     ).
 
 %% expects name to be already normalized
-prepare_zone_records_typed_entry(NormalizedName, NormalizedFqdn, ListTypedRecords) ->
+prepare_zone_records_typed_entry(NormalizedZoneName, NormalizedRecordName, ListTypedRecords) ->
     lists:map(
-        fun({Type, Record}) ->
-            {{NormalizedName, NormalizedFqdn, Type}, Record}
+        fun({Type, Records}) ->
+            {NormalizedZoneName, NormalizedRecordName, Type, Records}
         end,
         ListTypedRecords
     ).
 
 %% expects name to be already normalized
--spec put_zone_records(list()) -> ok.
+-spec put_zone_records([{dns:dname(), dns:dname(), dns:type(), [dns:rr()]}]) -> ok.
 put_zone_records(RecordsByName) ->
     lists:foreach(
-        fun(Entry) ->
-            ets:insert(zone_records_typed, Entry)
+        fun({NormalizedZoneName, NormalizedRecordName, Type, Records}) ->
+            do_put_zone_records_typed_entry(NormalizedZoneName, NormalizedRecordName, Type, Records)
         end,
         RecordsByName
     ).
@@ -515,7 +515,7 @@ do_put_zone_records_typed_entry(NormalizedName, NormalizedFqdn, Type, Record) ->
     ets:insert(zone_records_typed, {{NormalizedName, NormalizedFqdn, Type}, Record}).
 
 %% expects name to be already normalized
-is_name_in_zone(NormalizedName, NormalizedZoneName) ->
+is_name_in_zone(NormalizedZoneName, NormalizedName) ->
     Pattern = {{{NormalizedZoneName, NormalizedName, '_'}, '$1'}, [], ['$1']},
     case lists:append(ets:select(zone_records_typed, [Pattern])) of
         [] ->
@@ -525,14 +525,14 @@ is_name_in_zone(NormalizedName, NormalizedZoneName) ->
                 [_] ->
                     false;
                 [_ | Labels] ->
-                    is_name_in_zone(dns:labels_to_dname(Labels), NormalizedZoneName)
+                    is_name_in_zone(NormalizedZoneName, dns:labels_to_dname(Labels))
             end;
         _ ->
             true
     end.
 
 %% expects name to be already normalized
-is_name_in_zone_with_wildcard(NormalizedName, NormalizedZoneName) ->
+is_name_in_zone_with_wildcard(NormalizedZoneName, NormalizedName) ->
     WildcardName = dns:dname_to_lower(erldns_records:wildcard_qname(NormalizedName)),
     Pattern = {{{NormalizedZoneName, WildcardName, '_'}, '_'}, [], [true]},
     case ets:select_count(zone_records_typed, [Pattern]) of
@@ -543,7 +543,7 @@ is_name_in_zone_with_wildcard(NormalizedName, NormalizedZoneName) ->
                 [_] ->
                     false;
                 [_ | Labels] ->
-                    is_name_in_zone_with_wildcard(dns:labels_to_dname(Labels), NormalizedZoneName)
+                    is_name_in_zone_with_wildcard(NormalizedZoneName, dns:labels_to_dname(Labels))
             end;
         _ ->
             true