Public bug reported:
Please note, this bug was traced with the help of ChatGPT and the bug report
has been created by Chat GPT. Most of the technical details are well above my
abilities. With ChatGPT's help, my system is now working correctly.
Best Regards Scott
SUMMARY
=======
Following the October 2026 DNS root key rollover, systemd-resolved
on Ubuntu 24.04 LTS failed to validate DNSSEC responses.
Investigation showed that the resolver's built-in root trust anchors
contained only KSK-2017 (key tag 20326), while the current DNS root
DNSKEY RRset was signed using KSK-2024 (key tag 38696).
Adding the new IANA trust anchor immediately resolved the problem.
This appears to be a packaging issue affecting Ubuntu 24.04 and
potentially other supported Ubuntu releases.
SYSTEM INFORMATION
==================
Distribution: Ubuntu 24.04 LTS (Noble Numbat)
Package: systemd-resolved
Installed version: 255.4-1ubuntu8.17
Candidate version: 255.4-1ubuntu8.17
VPN: NordVPN using NordLynx
DNS servers: 103.86.99.100 and 103.86.96.100
DNSSEC setting: allow-downgrade
PROBLEM DESCRIPTION
===================
DNS resolution failed for numerous websites when DNSSEC validation
was enabled.
The systemd-resolved journal repeatedly reported:
DNSSEC validation failed: missing-key
Failures included DNSSEC validation of the root DNSKEY records,
with subsequent failures affecting ordinary domain lookups.
Disabling DNSSEC temporarily restored normal operation:
sudo resolvectl dnssec nordlynx no
sudo resolvectl flush-caches
However, NordVPN restored DNSSEC=allow-downgrade when reconnecting,
causing the problem to recur.
INVESTIGATION
=============
The systemd-resolved journal showed that only the old root trust
anchor was loaded:
Positive Trust Anchors:
. IN DS 20326 8 2
e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
DNS queries for the root DNSKEY RRset returned signatures using
key tag 38696.
The official IANA root trust-anchor document confirms that both
KSK-2017 (20326) and KSK-2024 (38696) are valid.
Reference:
https://data.iana.org/root-anchors/root-anchors.xml
The systemd-resolved package installed on this machine was already
the latest available version from the configured Ubuntu repositories.
WORKAROUND
==========
Created the following file:
/etc/dnssec-trust-anchors.d/root-2026.positive
Containing:
. IN DS 20326 8 2
E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
. IN DS 38696 8 2
683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
Restarted the resolver:
sudo systemctl restart systemd-resolved
The journal subsequently confirmed that both trust anchors
were successfully loaded.
RESULT AFTER APPLYING WORKAROUND
================================
DNSSEC was re-enabled:
sudo resolvectl dnssec nordlynx allow-downgrade
sudo resolvectl flush-caches
Queries for cloudflare.com and example.org succeeded.
Example output:
cloudflare.com: 104.16.133.229
104.16.132.229
-- Information acquired via protocol DNS in 107.8ms.
-- Data is authenticated: yes
-- Data from: network
The VPN was then disconnected and reconnected.
The NordLynx interface was recreated (Link 4 became Link 5),
and DNSSEC validation continued working.
Final status:
Link 5 (nordlynx)
DNSSEC=allow-downgrade/supported
Current DNS Server: 103.86.99.100
DNS Servers: 103.86.99.100 103.86.96.100
DNS Domain: ~.
A further query for cloudflare.com returned:
-- Data is authenticated: yes
-- Data from: network
EXPECTED BEHAVIOUR
==================
Ubuntu 24.04 should include the current IANA DNS root trust
anchors so that systemd-resolved can validate DNSSEC responses
following the root KSK rollover without manual intervention.
ACTUAL BEHAVIOUR
================
DNSSEC validation failed with "missing-key" errors because the
new root KSK-2024 trust anchor was absent.
This prevented normal DNS resolution when DNSSEC was enabled.
SUGGESTED FIX
=============
Update the built-in DNS root trust anchors in the Ubuntu 24.04
systemd-resolved package to include KSK-2024 (key tag 38696).
Consider issuing a stable-release update for affected supported
Ubuntu versions.
The problem is not specific to NordVPN. NordVPN exposed the issue
by enabling DNSSEC validation, but the missing trust anchor was
in systemd-resolved.
ADDITIONAL REFERENCES
=====================
Official IANA root trust anchors:
https://data.iana.org/root-anchors/root-anchors.xml
A similar issue has been discussed for Ubuntu 22.04:
https://askubuntu.com/questions/1570248/systemd-dnssec-failure-with-keytag-38696
** Affects: systemd (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170646
Title:
Ubuntu 24.04: systemd-resolved missing DNS root KSK-2024 (38696),
causing DNSSEC failures after October 2026 rollover
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170646/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
