Bug ID 750488: Certain BIG-IP DNS configurations improperly respond to DNS queries that contain EDNS OPT Records

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP DNS(all modules)

Known Affected Versions:
11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.6.0, 11.6.1, 11.6.2, 11.6.3,,,, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3,,,,,,,

Fixed In:
12.1.4,, 11.5.8

Opened: Nov 20, 2018

Severity: 3-Major


DNS Cache does not always include an EDNS OPT Record in responses to queries that contain an EDNS OPT Record.


Some compliance tools and upstream DNS servers may consider the BIG-IP non-compliant, and report it as such. This is occurring now because of the changes coming that remove certain workarounds on February 1st, 2019. This is known as DNS Flag Day. All network configurations on the internet will be affected by this change, but only some DNS servers will be negatively impacted. Fixes for this issue handle the conditions that were once handled by those workarounds.


Responses to queries with EDNS0 record to DNS Cache do not contain the RFC-required EDNS0 record.



Fix Information

Corrected EDNS OPT record handling in DNS Cache. Note: Any NOSOA and NOAA results from the EDNS Compliance Tester used for DNS Flag Day are false positives and are expected when testing against DNS Cache. The EDNS Compliance Tester assumes an authoritative server, and makes non-recursive queries. For example, you might see a Resolver response similar to the following: example1.com. @ (ns.example1.com.): dns=nosoa,noaa edns=nosoa,noaa edns1=ok edns@512=noaa ednsopt=nosoa,noaa edns1opt=ok do=nosoa,noaa ednsflags=nosoa,noaa optlist=nosoa,noaa,subnet signed=nosoa,noaa,yes ednstcp=noaa These types of responses are expected when running the validation tool against DNS Cache.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips