Rewrite plugin understanding

[Neurobion]

Hi Team,

In the documentation you state that:

It may be necessary to rewrite the ANSWER SECTION of the requests, because some DNS resolvers treat mismatches between the QUESTION SECTION and ANSWER SECTION as a man-in-the-middle attack (MITM).

You also state that dig does not display the answer when the name mismatch is detected. But if I do a rewrite, it happens, doesn't it?

I am currently solving a specific problem. For example, on Ubuntu 22.04.3 LTS, curl returns me a response, but Alpine or Debian does not. Is that what you are describing? Is there a document or maybe an RFC that specifies this?

In the documentation and your examples you work with the variant that you have each section that you replace with regular expressions. But what about the request when I want to overwrite the answer from a static record to the original one, which contains a variable part in (.*)?

The example probably describes it best: I am only modifying the example you gave for better illustration.

    rewrite stop {
        name regex (.*)\.coredns\.rocks xyz.service.consul
        answer name xyz.service.consul (.*)\.coredns\.rocks
    }

For the second line in the TO section I need the substring obtained from the first line of the FROM section.

In short, simply so that the answer again contains what I am asking. Perhaps this can be achieved in other ways. But unfortunately I don't know how.

I would be very grateful for an explanation or advice.

[chrisohaver]

You cant back reference the original name match in the answer rewrite.

Try answer auto to see if that works.

for example:

    rewrite stop {
        name regex (.*)\.coredns\.rocks xyz.service.consul
        answer auto
    }