bind9（递归）配置 ECS 不生效

[kincaid]

最近在学习 dns 的相关知识，然后尝试用 bind 在内网搭建了一个递归 dns ，测试了一下解析什么的都正常，但是 ECS 似乎并不起作用，有大佬遇到过类似的情况嘛？ bind9.16.x 和 bind9.18.x 都试过了

测试结果

dig www.taobao.com @127.0.0.1 -p 54 +subnet=202.96.64.68

; <<>> DiG 9.18.1-1+0~20220316.73+debian11~1.gbp965910-Debian <<>> www.taobao.com @127.0.0.1 -p 54 +subnet=202.96.64.68
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33865
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 5abbcad304b5d31c01000000623aaad500ab63c28430b13f (good)
; CLIENT-SUBNET: 202.96.64.68/32/0
;; QUESTION SECTION:
;www.taobao.com.                        IN      A

;; ANSWER SECTION:
www.taobao.com.         600     IN      CNAME   www.taobao.com.danuoyi.tbcache.com.
www.taobao.com.danuoyi.tbcache.com. 60 IN A     36.147.19.230
www.taobao.com.danuoyi.tbcache.com. 60 IN A     36.147.19.231

;; Query time: 956 msec
;; SERVER: 127.0.0.1#54(127.0.0.1) (UDP)
;; WHEN: Wed Mar 23 13:06:29 CST 2022
;; MSG SIZE  rcvd: 163

传了辽宁联通的 IP ，但返回仍是宽带出口 IP 查询的结果

配置文件

named.conf

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
// structure of BIND configuration files in Debian, *BEFORE* you customize 
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

named.conf.options

options {
	directory "/var/cache/bind";

	// If there is a firewall between you and nameservers you want
	// to talk to, you may need to fix the firewall to allow multiple
	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113

	// If your ISP provided one or more IP addresses for stable 
	// nameservers, you probably want to use them as forwarders.  
	// Uncomment the following block, and insert the addresses replacing 
	// the all-0's placeholder.

	// forwarders {
	// 	0.0.0.0;
	// };

	//========================================================================
	// If BIND logs error messages about the root key being expired,
	// you will need to update your keys.  See https://www.isc.org/bind-keys
	//========================================================================
	dnssec-validation yes;
	listen-on port 54 { any; };
	listen-on-v6 port 54 { any; };
};

named.conf.default-zones

// prime the server with knowledge of the root servers
zone "." {
	type hint;
	file "/usr/share/dns/root.hints";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
	type master;
	file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
	type master;
	file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
	type master;
	file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
	type master;
	file "/etc/bind/db.255";
};
zone "in-addr.arpa" {
        type master;
        file "/etc/bind/in-addr.arpa";
};

zone "root.zone" {
        type master;
        file "/etc/bind/root.zone";
};

求各位大佬指教

[kincaid]

看起来是 CLIENT-SUBNET 后面 /0 导致的，但是不清楚为什么会带上这个，试了 Powerdns 也会带这个