[Pdns-users] Problem since KSK Key rollover - needed turned off dnssec=validation

[Otto Moerbeek]

We have seen two reports, both were operator errors.

One was a very old recursor, one was a manually configured trust
anchor info that did not include the new root key.

You did not paste the actual output of your tests on Friday, so it is possible
you misinterpreted the results.

Check your config and look for out of date trust anchor info.

	-Otto

On Mon, Oct 12, 2026 at 03:19:53PM +0200, rob777 via Pdns-users wrote:

> Hi
> 
> According to
> https://www.akamai.com/blog/security/october-2026-root-ksk-rollover-dns-ready
> there was a DNSSEC key rollover on sunday
> 
> Despite having checked on Friday if my powerdns had the new DNSSEC Key tags
> (which they had.according to the recommended tests from
> https://www.akamai.com/blog/security/october-2026-root-ksk-rollover-dns-ready
> everything seemed fine..) - i've runned into problems today on my two
> Powerdns Resolver (5.4.x). There were different resolution problems from
> interal clients an servers. After turning off the dnssec validation on the
> powerdns recursor the problems disappeared.
> 
> I have to analyse it further tomorrow but and i'm confused what the issue
> was: Did anyone of you run into problems with regards to this dnssec key
> rollover?
> 
> Best Regards

> _______________________________________________
> Pdns-users mailing list
> Pdns-users at mailman.powerdns.com
> https://mailman.powerdns.com/mailman/listinfo/pdns-users