Some authoritative DNS servers intentionally block or drop queries with the RecursionDesired (RD) flag set, as a mitigation against DNS cache poisoning attacks that leverage recursive queries.
Currently, when testing domain lookups against such authoritative DNS servers, queries fail because the tool always sends RD=1 by default.
Although there is an existing --rd option, it is:
To properly test authoritative DNS servers that reject recursive queries, the tool needs a way to explicitly disable the RD flag.
Add a new CLI option:
Behavior:
- Explicitly sets Recursion Desired = 0
- Overrides default behavior (
RD=1)
- Takes precedence over
--rd