From d37f7f775460727b90a7eb73383068ec782a3165 Mon Sep 17 00:00:00 2001
From: Ville Vesilehto <ville@vesilehto.fi>
Date: Tue, 23 Dec 2025 19:50:16 +0200
Subject: [PATCH] fix(sign): report parser err before missing SOA (#7775)

---
 plugin/sign/file.go      |  7 +++----
 plugin/sign/file_test.go | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/plugin/sign/file.go b/plugin/sign/file.go
index dc4e73ebd..105c534e6 100644
--- a/plugin/sign/file.go
+++ b/plugin/sign/file.go
@@ -80,13 +80,12 @@ func Parse(f io.Reader, origin, fileName string) (*file.Zone, error) {
 			}
 		}
 	}
+	if err := zp.Err(); err != nil {
+		return nil, err
+	}
 	if !seenSOA {
 		return nil, fmt.Errorf("file %q has no SOA record", fileName)
 	}
 
-	if err := zp.Err(); err != nil {
-		return nil, err
-	}
-
 	return z, nil
 }
diff --git a/plugin/sign/file_test.go b/plugin/sign/file_test.go
index 72d2b02ac..8538a107d 100644
--- a/plugin/sign/file_test.go
+++ b/plugin/sign/file_test.go
@@ -2,6 +2,7 @@ package sign
 
 import (
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/miekg/dns"
@@ -41,3 +42,41 @@ func TestFileParse(t *testing.T) {
 		t.Errorf("Expected no DNSKEYs, but got %d", len(key))
 	}
 }
+
+func TestParseSyntaxErrorBeforeSOA(t *testing.T) {
+	const dbSyntaxErrorBeforeSOA = `
+$TTL         1M
+$ORIGIN      example.org.
+
+@            IN  SOA    ns1.example.com. admin.example.com.  (
+                               foobarbaz  ; Invalid serial
+                               1200       ; Refresh
+                               144        ; Retry
+                               1814400    ; Expire
+                               2h )       ; Minimum
+`
+	_, err := Parse(strings.NewReader(dbSyntaxErrorBeforeSOA), "example.org.", "stdin")
+	if err == nil {
+		t.Fatalf("Zone %q should have failed to load", "example.org.")
+	}
+
+	if !strings.Contains(err.Error(), "bad SOA zone parameter") {
+		t.Fatalf("Expected parser error, but got: %v", err)
+	}
+}
+
+func TestParseNoSOA(t *testing.T) {
+	const dbNoSOA = `
+$TTL         1M
+$ORIGIN      example.org.
+
+www          IN  A      192.168.0.14
+`
+	_, err := Parse(strings.NewReader(dbNoSOA), "example.org.", "stdin")
+	if err == nil {
+		t.Fatalf("Zone %q should have failed to load", "example.org.")
+	}
+	if !strings.Contains(err.Error(), "has no SOA record") {
+		t.Fatalf("Expected 'no SOA record' error, but got: %v", err)
+	}
+}