Issues

• [bug] names filed in allow_catchall are never removed, permanently allowlisting them

  bug
  dnstapir/pop#199 · Filter by author johanix opened on Aug 24, 2026

• [bug] GenerateRpzAxfr republishes changed content under an unchanged serial

  bugMedium priority
  dnstapir/pop#198 · Filter by author johanix opened on Aug 24, 2026

• [bug] names removed from an upstream RPZ are never removed from pop's list

  bughigh priority
  dnstapir/pop#197 · Filter by author johanix opened on Aug 24, 2026

• Remove the dead cfgFile branch that implies configurable config paths

  bugdocumentationMedium priority
  dnstapir/pop#192 · Filter by author johanix opened on Aug 24, 2026

• [bug] APIdebug reads pd.Lists unlocked from HTTP goroutines while the engine mutates them

  bugconcurrencyMedium priority
  dnstapir/pop#189 · Filter by author johanix opened on Aug 24, 2026

• Local observation input for the test rig, and make the observation trust model explicit

  enhancementMedium priorityrobustnesssecurity
  dnstapir/pop#188 · Filter by author johanix opened on Aug 24, 2026

• Setup integration tests for POP

  dnstapir/pop#185 · Filter by author byKryptogram opened on Aug 19, 2026

• [robustness] SIGHUP reloads viper config only; Gconfig/pd.Policy/sources not re-applied (needs restart)

  Medium priorityrobustness
  dnstapir/pop#178 · Filter by author johanix opened on Jun 3, 2026 · POP hardening

• [security] downstreamTracker serials map never evicts (unbounded memory from spoofed IXFR/NOTIFY)

  concurrencyMedium prioritysecurity
  dnstapir/pop#176 · Filter by author johanix opened on Jun 3, 2026 · POP hardening

• [bug] GenerateRpzAxfr full rebuild bypasses allowlist precedence (path-dependent served zone)

  bugMedium priority
  dnstapir/pop#175 · Filter by author johanix opened on Jun 3, 2026 · POP hardening

• [perf] Size-aware AXFR/IXFR envelope packing (pack to ~64K, not fixed 500 RRs)

  enhancementMedium priority
  dnstapir/pop#173 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [bug] Axfr.Data keyed inconsistently (name vs name+ZoneName) between full build and IXFR paths

  bugMedium priority
  dnstapir/pop#172 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] Engine channels buffered at 10 — NOTIFY burst couples DNS handler to engine progress

  concurrencysecurity
  dnstapir/pop#167 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] uint32 serial wraparound unhandled

  robustness
  dnstapir/pop#166 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] MQTT payload SrcName/ListType possibly not bound to signing-key identity (unverified)

  Medium prioritysecurity
  dnstapir/pop#164 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] InsecureSkipVerify=true in bootstrap (and reportedly CLI) TLS

  Medium prioritysecurity
  dnstapir/pop#163 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] /bootstrap exports full lists under single shared key, no per-list authz

  Medium prioritysecurity
  dnstapir/pop#162 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] X-API-Key non-constant-time compare; no request body size limit

  Medium prioritysecurity
  dnstapir/pop#161 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] Serial-cache corruption silently resets serial to 1 — downstreams may freeze (RFC 1982)

  bugMedium priorityrobustness
  dnstapir/pop#160 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] WaitGroup double-Done in mainloop shutdown; meaningless wg in API goroutines

  bugMedium priorityrobustness
  dnstapir/pop#159 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] DownstreamSerials / RpzSources locked-write but unlocked-read

  bugconcurrencyMedium priority
  dnstapir/pop#157 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] Runtime-reachable log.Fatalf/POPExiter/panic on non-fatal conditions

  high priorityrobustness
  dnstapir/pop#154 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] Lists/Names read unlocked from DNS-handler policy lookups while engine mutates

  bugconcurrencyhigh priority
  dnstapir/pop#153 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] No ACL on AXFR/IXFR/NOTIFY — exfiltration, DownstreamSerials pollution, NOTIFY amplification

  high prioritysecurity
  dnstapir/pop#152 · Filter by author johanix opened on Jun 2, 2026 · POP hardening

• [review] PruneRpzIxfrChain runs fully unlocked

  bugconcurrencyhigh priority
  dnstapir/pop#151 · Filter by author johanix opened on Jun 2, 2026 · POP hardening