Hacker News Reader

I suspect you ran into complications from the DNS root key rollover. There's a bit more on that here: https://blog.cloudflare.com/root-ksk-2024-rollover/

And a tool for checking readiness: https://dnstest.dev/ksk-2024/

View on HN

The "complication" is simply that systemd-resolved on older, but still supported Ubuntu versions 24.04 LTS and 22.04 LTS does not know about the new KSK. It can be installed on those distros, but systemd-resolved by default only uses keys from its own package, not what is installed system-wide.

Easy once you know what to look for :)

https://askubuntu.com/questions/1570248/systemd-dnssec-failu...

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/21705...

The linked online tool https://dnstest.dev/ksk-2024/ shows all green nevertheless. At least with local DNSSEC verification disabled. But with DNSSEC verification the tool cannot even be opened. No idea how this is supposed to work.

Edit: After adding the new KSK manually the online tool displays:

> RFC 8509 support was not detected All three sentinel names resolved despite the DNSSEC controls passing. Your resolver path does not appear to implement the sentinel, so this test cannot determine whether it trusts KSK-2024.

Thanks a lot! That must be it. Wasn't aware that something "big" was happening.

Reply on news.ycombinator.com