DNS64: Not resolving and synthesizing correctly for CNAME chain (rfc6147#section-5.1.5)

[GoetzGoerisch]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to report a bug and not ask a question or ask for help

• I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

Linux, ARM64

Installation

GitHub releases or script from README

Setup

On one machine

AdGuard Home version

v0.107.48

Action

AdGuard configured for DNS64

AdGuardHome.yml:

...
  use_dns64: true
  dns64_prefixes:
    - 64:ff9b::/96
...

$ nslookup -debug -type=aaaa 'www.zdf.de' 'fd23:ff12:fde5:20::53'
Server:		fd23:ff12:fde5:20::53
Address:	fd23:ff12:fde5:20::53#53

------------
    QUESTIONS:
	www.zdf.de, type = AAAA, class = IN
    ANSWERS:
    ->  www.zdf.de
	canonical name = ssl.zdf.de.edgekey.net.
	ttl = 240
    ->  ssl.zdf.de.edgekey.net
	canonical name = e8383.e6.akamaiedge.net.
	ttl = 240
    AUTHORITY RECORDS:
    ->  e6.akamaiedge.net
	origin = n0e6.akamaiedge.net
	mail addr = hostmaster.akamai.com
	serial = 1713621457
	refresh = 1000
	retry = 1000
	expire = 1000
	minimum = 1800
	ttl = 240
    ADDITIONAL RECORDS:
------------
Non-authoritative answer:
www.zdf.de	canonical name = ssl.zdf.de.edgekey.net.
ssl.zdf.de.edgekey.net	canonical name = e8383.e6.akamaiedge.net.

Expected result

Expected to follow https://datatracker.ietf.org/doc/html/rfc6147#section-5.1.5
AAAA record is correctly synthesized from AdGuardHome and the upstream CNAME chain and A record.

Output from Cloudflare DNS64 server for comparison

nslookup -debug -type=aaaa 'www.zdf.de' '2606:4700:4700::64'
Server:		2606:4700:4700::64
Address:	2606:4700:4700::64#53

------------
    QUESTIONS:
	www.zdf.de, type = AAAA, class = IN
    ANSWERS:
    ->  www.zdf.de
	canonical name = ssl.zdf.de.edgekey.net.
	ttl = 2434
    ->  ssl.zdf.de.edgekey.net
	canonical name = e8383.e6.akamaiedge.net.
	ttl = 34
    ->  e8383.e6.akamaiedge.net
	has AAAA address 64:ff9b::687a:252c
	ttl = 8
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------
Non-authoritative answer:
www.zdf.de	canonical name = ssl.zdf.de.edgekey.net.
ssl.zdf.de.edgekey.net	canonical name = e8383.e6.akamaiedge.net.
Name:	e8383.e6.akamaiedge.net
Address: 64:ff9b::687a:252c

Actual result

see above, AAAA is not synthesized.

AdGuard upstream server is Cloudflare DNS 2606:4700:4700::1111 or tls://one.one.one.one

Additional information and/or screenshots

Another sample to test ipv4.google.com or ipv4.myip.wtf

[GoetzGoerisch]

ping @ainar-g

[ainar-g]

Apologies for the delay. @EugeneOne1, please investigate.