Forwarded queries fail if remote is TCP-only

[julian7]

I've recently upgraded to 2.1.16, which brought codeberg.org/miekg/dns/v2. I have a few items in forwarding.txt, and one of the remotes are TCP-only. While 2.1.15 works this out by retrying in TCP, but with the new miekg/dns version, it stopped working, throwing the following error:

[2026-06-04 20:11:15] [DEBUG] Processing incoming query from 127.0.0.1:54570
[2026-06-04 20:11:15] [DEBUG] Handling query for [XXXXXXXXX]
[2026-06-04 20:11:15] [DEBUG] Forwarding [XXXXXXXXX] to [10.11.12.13:53]
[2026-06-04 20:11:15] [DEBUG] Dropping query: dns unpack: overflow name
[2026-06-04 20:11:15] [DEBUG] Plugins failed: dns unpack: overflow name
[2026-06-04 20:11:15]   127.0.0.1       XXXXXXXXX   A       DROP    2ms     10.11.12.13:53  -

A quick run with git bisect pointed me to the first bad version: 956b4ba.

I'm not certain about the robustness of the patch I came up with, but this one helped to go through the bump:

diff --git dnscrypt-proxy/plugin_forward.go dnscrypt-proxy/plugin_forward.go
index 40fd9f27..a30f1473 100644
--- dnscrypt-proxy/plugin_forward.go
+++ dnscrypt-proxy/plugin_forward.go
@@ -387,11 +387,14 @@ func (plugin *PluginForward) Eval(pluginsState *PluginsState, msg *dns.Msg) erro
                forwardMsg.Data = nil // Clear packed data so Exchange will re-pack without Extra

                respMsg, _, err = client.Exchange(ctx, forwardMsg, pluginsState.serverProto, server)
-               if err != nil {
+               if err != nil && (respMsg == nil || !respMsg.Truncated) {
                        cancel()
                        continue
                }
-               if respMsg.Truncated {
+               if respMsg != nil && respMsg.Truncated {
+                       cancel()
+                       ctx, cancel = context.WithTimeout(context.Background(), pluginsState.timeout)
                        respMsg, _, err = client.Exchange(ctx, forwardMsg, "tcp", server)
                        if err != nil {
                                cancel()

Apparently. client.Exchange is throwing an err dns unpack: overflow name (sometimes dns unpack: overflow). When I hacked my way through the error filter, it turned out that the context expires while retrying, so I canceled the previous one, and created another.

I hope it helps.

[jedisct1]

Thanks a lot for the detailed report, bisect, and patch!

Your analysis was spot on. With codeberg.org/miekg/dns/v2, Client.Exchange() can return both a partially unpacked response with the TC bit set and an unpacking error such as dns unpack: overflow name. The forwarding plugin was checking err before looking at the truncated response, so it never reached the UDP → TCP retry path.

I’ve applied a fix along the lines of your patch: if a UDP response is present and marked as truncated, we now retry over TCP even if unpacking returned an error. The TCP retry also gets a fresh timeout context instead of reusing the UDP one.

I also added a regression test covering this exact case.

Thanks again — this was very helpful.