Last Modified: Sep 16, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 21.1.0, 21.1.0.1, 21.1.0.2
Opened: Jul 02, 2026 Severity: 3-Major
Because Unbound includes new default zones, it returns default answers for resolver.arpa and service.arpa instead of forwarding to upstream servers, even when answer-default-zones is disabled.
The resolver returns default answers to client queries for names in the resolver.arpa and service.arpa zones instead of authoritative answers. This behavior may prevent clients from using RFC9462 mechanisms to discover higher-security DNS transports.
Configure the resolver or a transparent cache in the DNS profile.
Setting local data with type transparent for names that receive default answers overrides the default zone and lets configured authoritative servers answer client queries. For example, add a type transparent local-data record '_dns.resolver.arpa 3600 IN TXT "workaround"'; clients can then query the same name for type SVCB, and the resolver forwards those queries to the configured pool (transparent cache).
None