[Pdns-users] Problem since KSK Key rollover - needed turned off dnssec=validation

[rob777]

Hi Otto

Thanks for your input.

Further analysis uncovered that the problem is not triggered by a Powerdns
Recursor Problem but an Ubuntu Bug in systemd-resolve. There is a confirmed
bug about this (all Ubuntus from 20.04 - 24.04 affected)
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170556 - hence only
resolving via Ubuntu Systems was affected

So all good on Powerdns side of the equation..

Best Regards


Am Mo., 12. Okt. 2026 um 15:39 Uhr schrieb Otto Moerbeek via Pdns-users <
pdns-users at mailman.powerdns.com>:

> To make the check explicit: in the default config, there should be two
> root TAs:
>
> $ rec-control get-tas
> Configured Trust Anchors:
> .
>                 20326 8 2
> e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
>                 38696 8 2
> 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
>
>         -Otto
>
> On Mon, Oct 12, 2026 at 03:29:11PM +0200, Otto Moerbeek via Pdns-users
> wrote:
>
> > We have seen two reports, both were operator errors.
> >
> > One was a very old recursor, one was a manually configured trust
> > anchor info that did not include the new root key.
> >
> > You did not paste the actual output of your tests on Friday, so it is
> possible
> > you misinterpreted the results.
> >
> > Check your config and look for out of date trust anchor info.
> >
> >       -Otto
> >
> > On Mon, Oct 12, 2026 at 03:19:53PM +0200, rob777 via Pdns-users wrote:
> >
> > > Hi
> > >
> > > According to
> > >
> https://www.akamai.com/blog/security/october-2026-root-ksk-rollover-dns-ready
> > > there was a DNSSEC key rollover on sunday
> > >
> > > Despite having checked on Friday if my powerdns had the new DNSSEC Key
> tags
> > > (which they had.according to the recommended tests from
> > >
> https://www.akamai.com/blog/security/october-2026-root-ksk-rollover-dns-ready
> > > everything seemed fine..) - i've runned into problems today on my two
> > > Powerdns Resolver (5.4.x). There were different resolution problems
> from
> > > interal clients an servers. After turning off the dnssec validation on
> the
> > > powerdns recursor the problems disappeared.
> > >
> > > I have to analyse it further tomorrow but and i'm confused what the
> issue
> > > was: Did anyone of you run into problems with regards to this dnssec
> key
> > > rollover?
> > >
> > > Best Regards
> >
> > > _______________________________________________
> > > Pdns-users mailing list
> > > Pdns-users at mailman.powerdns.com
> > > https://mailman.powerdns.com/mailman/listinfo/pdns-users
> >
> > _______________________________________________
> > Pdns-users mailing list
> > Pdns-users at mailman.powerdns.com
> > https://mailman.powerdns.com/mailman/listinfo/pdns-users
> _______________________________________________
> Pdns-users mailing list
> Pdns-users at mailman.powerdns.com
> https://mailman.powerdns.com/mailman/listinfo/pdns-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20261013/55d7947f/attachment.htm>