What causes "received response without question" in XX-net/XX-Net?

Inspect the upstream DNS server with 'dig @server domain' to confirm it returns well-formed responses

received response without question

Error message

received response without question

What it means

The UDP DNS receive worker parsed a DNS response whose question section is empty. RFC-compliant responses echo the original question; an empty question section indicates a broken/misbehaving upstream server, a spoofed packet, or a truncated response. The packet is discarded and the loop continues.

Source

Thrown at code/default/smart_router/local/dns_query.py:234

            try:
                try:
                    response, server = sock.recvfrom(8192)
                    server, port = server
                except Exception as e:
                    # xlog.exception("sock.recvfrom except:%r", e)
                    continue

                if not response:
                    continue

                try:
                    p = DNSRecord.parse(response)
                except Exception as e:
                    xlog.exception("dns client parse response fail:%r", e)
                    continue

                if len(p.questions) == 0:
                    xlog.warn("received response without question")
                    continue

                id = p.header.id

                if id not in self.waiters:
                    continue

                que = self.waiters[id]
                org_domain = que.domain
                domain = str(p.questions[0].qname)
                xlog.debug("DNS local query received %s from:%s domain:%s org:%s", len(p.rr), server, domain, org_domain)
                ips = []
                for r in p.rr:
                    ip = utils.to_bytes(str(r.rdata))
                    ips.append(ip)

                if ips:
                    que.put(ips)

View on GitHub (pinned to cfa5bc17b6)

Solutions

Inspect the upstream DNS server with 'dig @server domain' to confirm it returns well-formed responses
Switch to a different upstream DNS server (public resolvers like 8.8.8.8)
Use DNS-over-TLS/DNS-over-HTTPS (DnsOverTlsQuery/DnsOverHttpsQuery in this module) to bypass UDP mangling
If behind a captive portal, complete portal authentication first

Defensive patterns

Strategy: fallback

Try / catch

# worker already continues; at the caller level treat query timeout as signal to switch transports:
ips = udp_client.query(domain, timeout=3)
if not ips:
    ips = tcp_client.query(domain)  # or DoT/DoH

Prevention

Prefer encrypted DNS (DoT/DoH) on networks known to mangle UDP DNS
Monitor this warning rate — a spike indicates captive portal or DNS interception
Complete captive-portal auth before relying on DNS

When it happens

Trigger: A captive portal or middlebox replying with malformed DNS packets; a DNS server returning a response with QDCOUNT=0; packet corruption or interception on hostile networks; a non-DNS service replying on port 53.

Common situations: Hotel/airport captive portals, ISP DNS hijacking, firewall/security appliances that mangle DNS, misconfigured local dnsmasq instances.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/57f2a2e8bf27992a. Report an issue: GitHub.