Some IPv6 addresses in AAAA printed using IPv4 syntax

Example on live Internet:

echo ns1.exporterapp.com  | zdns NS -trace -iterative

Broken fragment of output:

        {
            "cached": false,
            "class": 1,
            "depth": 3,
            "layer": "exporterapp.com",
            "name": "ns1.exporterapp.com",
            "name_server": "5.9.101.204:53",
            "results": {
                "additionals": [
                    {
                        "answer": "5.9.101.204",
                        "class": "IN",
                        "name": "ns1.exporterapp.com",
                        "ttl": 14400,
                        "type": "A"
                    },
                    {
                        "answer": "5.9.101.204",
                        "class": "IN",
                        "name": "ns1.exporterapp.com",
                        "ttl": 14400,
                        "type": "AAAA"
                    },

As far as I can see in Wireshark the server is answering correctly, it looks like problem in output formating.

Traditional dig prints this:

$ dig  ns1.exporterapp.com AAAA

; <<>> DiG 9.14.4 <<>> ns1.exporterapp.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56865
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ns1.exporterapp.com.		IN	AAAA

;; ANSWER SECTION:
ns1.exporterapp.com.	13855	IN	AAAA	::ffff:5.9.101.204

;; AUTHORITY SECTION:
ns1.exporterapp.com.	85855	IN	NS	ns1.exporterapp.com.
ns1.exporterapp.com.	85855	IN	NS	ns2.exporterapp.com.
ns1.exporterapp.com.	85855	IN	NS	ns4.exporterapp.com.
ns1.exporterapp.com.	85855	IN	NS	ns3.exporterapp.com.

;; ADDITIONAL SECTION:
ns2.exporterapp.com.	172255	IN	A	5.9.101.204
ns2.exporterapp.com.	13855	IN	AAAA	::ffff:5.9.101.204
ns1.exporterapp.com.	172255	IN	A	5.9.101.204

;; Query time: 3 msec
;; SERVER: 4.2.2.1#53(4.2.2.1)
;; WHEN: Čt čec 25 11:31:55 EDT 2019
;; MSG SIZE  rcvd: 204

In fact the ::ffff:<IPv4> syntax defines an IPv4 addres encoded in v6 syntax¹.

Until this line ZDNS has the actual net.IP object available which contains the full 16 bytes (held in aaaa.AAAA).

zdns/modules/miekg/miekg.go

Line 157 in 65842ef

    
           retv = Answer{Ttl: aaaa.Hdr.Ttl, Type: dns.Type(aaaa.Hdr.Rrtype).String(), rrType: aaaa.Hdr.Rrtype, Class: dns.Class(aaaa.Hdr.Class).String(), rrClass: aaaa.Hdr.Class, Name: aaaa.Hdr.Name, Answer: aaaa.AAAA.String()}

If the result of aaaa.AAAA.To4() is not nil, the given address is an actual v4, so the prefix could be added at this point.

[1] RFC 5156, sec 2.2