[Pdns-users] Problem since KSK Key rollover - needed turned off dnssec=validation

[Otto Moerbeek]

To make the check explicit: in the default config, there should be two
root TAs:

$ rec-control get-tas
Configured Trust Anchors:
.
                20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
                38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16

	-Otto

On Mon, Oct 12, 2026 at 03:29:11PM +0200, Otto Moerbeek via Pdns-users wrote:

> We have seen two reports, both were operator errors.
> 
> One was a very old recursor, one was a manually configured trust
> anchor info that did not include the new root key.
> 
> You did not paste the actual output of your tests on Friday, so it is possible
> you misinterpreted the results.
> 
> Check your config and look for out of date trust anchor info.
> 
> 	-Otto
> 
> On Mon, Oct 12, 2026 at 03:19:53PM +0200, rob777 via Pdns-users wrote:
> 
> > Hi
> > 
> > According to
> > https://www.akamai.com/blog/security/october-2026-root-ksk-rollover-dns-ready
> > there was a DNSSEC key rollover on sunday
> > 
> > Despite having checked on Friday if my powerdns had the new DNSSEC Key tags
> > (which they had.according to the recommended tests from
> > https://www.akamai.com/blog/security/october-2026-root-ksk-rollover-dns-ready
> > everything seemed fine..) - i've runned into problems today on my two
> > Powerdns Resolver (5.4.x). There were different resolution problems from
> > interal clients an servers. After turning off the dnssec validation on the
> > powerdns recursor the problems disappeared.
> > 
> > I have to analyse it further tomorrow but and i'm confused what the issue
> > was: Did anyone of you run into problems with regards to this dnssec key
> > rollover?
> > 
> > Best Regards
> 
> > _______________________________________________
> > Pdns-users mailing list
> > Pdns-users at mailman.powerdns.com
> > https://mailman.powerdns.com/mailman/listinfo/pdns-users
> 
> _______________________________________________
> Pdns-users mailing list
> Pdns-users at mailman.powerdns.com
> https://mailman.powerdns.com/mailman/listinfo/pdns-users