Ask HN: What Happened in DNSSEC Yesterday? | Hacker News Reader

Ask HN: What Happened in DNSSEC Yesterday?

3 pointsusr11064 comments

I have had DNSSEC verification enabled for a couple of months in systemd-resolved. Not that I am particular paranoid or do any nuclear-sensitive stuff on my machine. Don't even own any Bitcoin. But mostly out of technical curiosity.

Until yesterday I had only noticed 2 broken sites (or sites affected by buggy systemd-resolved implementation as some voices claim). Some Jira Plugin and Swedish Railways SJ.

Yesterday basically the Internet stopped working for me. After a while I remembered good old operator wisdom "It's always DNS". And it was DNS. Systemd-resolved logged "missing-key" for basically every query I tried.

So I switched from DoT 1.1.1.1 @Cloudflare to DoT 8.8.8.8 @Google and life continued. Until today that suddenly out of nowhere showed the same symptom.

Turning off DNSSEC verification avoids the problem. An internet search brought up https://github.com/NordSecurity/nordvpn-linux/issues/1853 which also links to another one. The timing seems to match with my observation, but I don't use NordVPN. Any clues?

I suspect you ran into complications from the DNS root key rollover. There's a bit more on that here: https://blog.cloudflare.com/root-ksk-2024-rollover/

And a tool for checking readiness: https://dnstest.dev/ksk-2024/

Thanks a lot! That must be it. Wasn't aware that something "big" was happening.

The "complication" is simply that systemd-resolved on older, but still supported Ubuntu versions 24.04 LTS and 22.04 LTS does not know about the new KSK. It can be installed on those distros, but systemd-resolved by default only uses keys from its own package, not what is installed system-wide.

Easy once you know what to look for :)

https://askubuntu.com/questions/1570248/systemd-dnssec-failu...

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/21705...

The linked online tool https://dnstest.dev/ksk-2024/ shows all green nevertheless. At least with local DNSSEC verification disabled. But with DNSSEC verification the tool cannot even be opened. No idea how this is supposed to work.

Edit: After adding the new KSK manually the online tool displays:

> RFC 8509 support was not detected All three sentinel names resolved despite the DNSSEC controls passing. Your resolver path does not appear to implement the sentinel, so this test cannot determine whether it trusts KSK-2024.

It's not just you. For instance: medical clinics all over Germany(?) are connected with access devices that the KSK rollover broke:

https://www.heise.de/en/news/DNSSEC-Key-Swap-Secunet-and-RIS...

Reply on news.ycombinator.com