dnstap sourceAddress: "0.0.0.0" instead of real client IP when using TCP transport

[YangTao0]

Edit: #25181

Question

Version: CoreDNS-1.12.0 version="0.54.0"(receiving dnstap over TCP)
Not Kubernetes: CoreDNS is deployed directly on a VM (bare metal).
Network: The CoreDNS server and Vector server are on different hosts.
CoreDNS config:
.:53 { log dnstap tcp://10.218.20.156:6000 full forward . 8.8.8.8 reload }

The sourceAddress field in the dnstap message should contain the real IP address of the DNS client (e.g., the host that sent the query to CoreDNS), All dnstap messages show "sourceAddress": "0.0.0.0"，Is this a known limitation of the dnstap plugin when using TCP transport? Or am I missing a configuration option to preserve the client address information over TCP?

Vector Config

[sources.dnstap]
type = "dnstap"
address = "0.0.0.0:6000"
mode = "tcp"

[sinks.print]
type = "console"
inputs = [ "dnstap" ]
encoding.codec = "json"

Vector Logs

Vector logs:
2026-04-13T09:21:08.672648Z INFO vector::app: Log level is enabled. level="info" 2026-04-13T09:21:08.679980Z INFO vector::app: Loading configs. paths=["dnstap.toml"] 2026-04-13T09:21:08.689953Z INFO vector::topology::running: Running healthchecks. 2026-04-13T09:21:08.690109Z INFO vector::topology::builder: Healthcheck passed. 2026-04-13T09:21:08.690222Z INFO vector: Vector has started. debug="false" version="0.54.0" arch="x86_64" revision="2b8b875 2026-03-10 15:47:37.284215410" 2026-04-13T09:21:08.690249Z INFO vector::app: API is disabled, enable by setting api.enabledtotrueand use commands likevector top. 2026-04-13T09:21:08.690448Z INFO source{component_kind="source" component_id=dnstap component_type=dnstap}: vector::sources::util::framestream: Listening. addr=0.0.0.0:6000 {"dataType":"Message","dataTypeId":1,"host":"10.218.20.204:51984","messageType":"ClientQuery","messageTypeId":5,"requestData":{"fullRcode":0,"header":{"aa":false,"ad":true,"anCount":0,"arCount":1,"cd":false,"id":3539,"nsCount":0,"opcode":0,"qdCount":1,"qr":0,"ra":false,"rcode":0,"rd":true,"tc":false},"opt":{"do":false,"ednsVersion":0,"extendedRcode":0,"udpPayloadSize":4096},"question":[{"class":"IN","domainName":"www.baidu.com.","questionType":"A","questionTypeId":1}],"rcodeName":"NoError"},"serverId":"vector02-test3-ucscompute43-cloudvsp","serverVersion":"CoreDNS-1.12.0","socketFamily":"INET","socketProtocol":"UDP","sourceAddress":"0.0.0.0","sourcePort":46185,"source_type":"dnstap","time":1776072095889631680,"timePrecision":"ns","timestamp":"2026-04-13T09:21:35.889631680Z"} {"dataType":"Message","dataTypeId":1,"host":"10.218.20.204:51984","messageType":"ForwarderQuery","messageTypeId":7,"requestData":{"fullRcode":0,"header":{"aa":false,"ad":true,"anCount":0,"arCount":1,"cd":false,"id":3539,"nsCount":0,"opcode":0,"qdCount":1,"qr":0,"ra":false,"rcode":0,"rd":true,"tc":false},"opt":{"do":false,"ednsVersion":0,"extendedRcode":0,"udpPayloadSize":4096},"question":[{"class":"IN","domainName":"www.baidu.com.","questionType":"A","questionTypeId":1}],"rcodeName":"NoError"},"responseAddress":"0.0.0.0","responsePort":53,"serverId":"vector02-test3-ucscompute43-cloudvsp","serverVersion":"CoreDNS-1.12.0","socketFamily":"INET","socketProtocol":"UDP","sourceAddress":"0.0.0.0","sourcePort":46185,"source_type":"dnstap","time":1776072095889719396,"timePrecision":"ns","timestamp":"2026-04-13T09:21:35.889719396Z"} {"dataType":"Message","dataTypeId":1,"host":"10.218.20.204:51984","messageType":"ForwarderResponse","messageTypeId":8,"requestData":{"time":1776072095889719396,"timePrecision":"ns"},"responseAddress":"0.0.0.0","responseData":{"answers":[{"class":"IN","domainName":"www.baidu.com.","rData":"www.a.shifen.com.","recordType":"CNAME","recordTypeId":5,"ttl":427},{"class":"IN","domainName":"www.a.shifen.com.","rData":"183.2.172.17","recordType":"A","recordTypeId":1,"ttl":74},{"class":"IN","domainName":"www.a.shifen.com.","rData":"183.2.172.177","recordType":"A","recordTypeId":1,"ttl":74}],"fullRcode":0,"header":{"aa":false,"ad":false,"anCount":3,"arCount":1,"cd":false,"id":3539,"nsCount":0,"opcode":0,"qdCount":1,"qr":1,"ra":true,"rcode":0,"rd":true,"tc":false},"opt":{"do":false,"ednsVersion":0,"extendedRcode":0,"udpPayloadSize":512},"question":[{"class":"IN","domainName":"www.baidu.com.","questionType":"A","questionTypeId":1}],"rcodeName":"NoError"},"responsePort":53,"serverId":"vector02-test3-ucscompute43-cloudvsp","serverVersion":"CoreDNS-1.12.0","socketFamily":"INET","socketProtocol":"UDP","sourceAddress":"0.0.0.0","sourcePort":46185,"source_type":"dnstap","time":1776072096107144673,"timePrecision":"ns","timestamp":"2026-04-13T09:21:36.107144673Z"} {"dataType":"Message","dataTypeId":1,"host":"10.218.20.204:51984","messageType":"ClientResponse","messageTypeId":6,"requestData":{"time":1776072095889631680,"timePrecision":"ns"},"responseData":{"answers":[{"class":"IN","domainName":"www.baidu.com.","rData":"www.a.shifen.com.","recordType":"CNAME","recordTypeId":5,"ttl":427},{"class":"IN","domainName":"www.a.shifen.com.","rData":"183.2.172.17","recordType":"A","recordTypeId":1,"ttl":74},{"class":"IN","domainName":"www.a.shifen.com.","rData":"183.2.172.177","recordType":"A","recordTypeId":1,"ttl":74}],"fullRcode":0,"header":{"aa":false,"ad":false,"anCount":3,"arCount":1,"cd":false,"id":3539,"nsCount":0,"opcode":0,"qdCount":1,"qr":1,"ra":true,"rcode":0,"rd":true,"tc":false},"opt":{"do":false,"ednsVersion":0,"extendedRcode":0,"udpPayloadSize":4096},"question":[{"class":"IN","domainName":"www.baidu.com.","questionType":"A","questionTypeId":1}],"rcodeName":"NoError"},"serverId":"vector02-test3-ucscompute43-cloudvsp","serverVersion":"CoreDNS-1.12.0","socketFamily":"INET","socketProtocol":"UDP","sourceAddress":"0.0.0.0","sourcePort":46185,"source_type":"dnstap","time":1776072096107231642,"timePrecision":"ns","timestamp":"2026-04-13T09:21:36.107231642Z"}

CoreDNS logs:

maxprocs: Leaving GOMAXPROCS=4: CPU quota undefined
.:53
[INFO] plugin/reload: Running configuration SHA512 = 9d43073b6aed7d04aa3bac96b5704a48d8e6bbe996c42df661a0e2497737d16c7f11e490c15691e73245652251679586a0458ebfb869994a2f1f48d2bd932d59
CoreDNS-1.12.0
linux/amd64, go1.23.3, 51e11f1
[INFO] 10.221.7.182:46185 - 3539 "A IN www.baidu.com. udp 42 false 4096" NOERROR qr,rd,ra 149 0.217670503s