Executed test plan on Jammy. Step 1 now shows "SECURE" instead of "TRUNCATED"
root@dnsmasq-jammy:~# apt install -t jammy-updates dnsmasq dnsmasq-base Reading package lists... Done Building dependency tree... Done Reading state information... Done The following additional packages will be installed: dns-root-data Suggested packages: resolvconf The following NEW packages will be installed: dns-root-data dnsmasq dnsmasq-base 0 upgraded, 3 newly installed, 0 to remove and 12 not upgraded. Need to get 401 kB of archives. After this operation, 1027 kB of additional disk space will be used. Do you want to continue? [Y/n] Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 dns-root-data all 2024071801~ubuntu0.22.04.1 [6132 B] Get:2 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 dnsmasq-base amd64 2.90-0ubuntu0.22.04.4 [375 kB] Get:3 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 dnsmasq all 2.90-0ubuntu0.22.04.4 [20.1 kB] Fetched 401 kB in 0s (4288 kB/s) Selecting previously unselected package dns-root-data. (Reading database ... 34186 files and directories currently installed.) Preparing to unpack .../dns-root-data_2024071801~ubuntu0.22.04.1_all.deb ... Unpacking dns-root-data (2024071801~ubuntu0.22.04.1) ... Selecting previously unselected package dnsmasq-base. Preparing to unpack .../dnsmasq-base_2.90-0ubuntu0.22.04.4_amd64.deb ... Unpacking dnsmasq-base (2.90-0ubuntu0.22.04.4) ... Selecting previously unselected package dnsmasq. Preparing to unpack .../dnsmasq_2.90-0ubuntu0.22.04.4_all.deb ... Unpacking dnsmasq (2.90-0ubuntu0.22.04.4) ... Setting up dnsmasq-base (2.90-0ubuntu0.22.04.4) ... Setting up dns-root-data (2024071801~ubuntu0.22.04.1) ... Setting up dnsmasq (2.90-0ubuntu0.22.04.4) ... Created symlink /etc/systemd/system/multi-user.target.wants/dnsmasq.service → /lib/systemd/system/dnsmasq.service. Job for dnsmasq.service failed because the control process exited with error code. See "systemctl status dnsmasq.service" and "journalctl -xeu dnsmasq.service" for details. invoke-rc.d: initscript dnsmasq, action "start" failed. × dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Tue 2026-08-18 20:37:25 UTC; 3ms ago Process: 8454 ExecStartPre=/etc/init.d/dnsmasq checkconfig (code=exited, status=0/SUCCESS) Process: 8462 ExecStart=/etc/init.d/dnsmasq systemd-exec (code=exited, status=2) CPU: 19ms Aug 18 20:37:25 dnsmasq-jammy systemd[1]: Starting dnsmasq - A lightweight DHCP and caching DNS server... Aug 18 20:37:25 dnsmasq-jammy dnsmasq[8462]: dnsmasq: failed to create listening socket for port 53: Address already in use Aug 18 20:37:25 dnsmasq-jammy dnsmasq[8462]: failed to create listening socket for port 53: Address already in use Aug 18 20:37:25 dnsmasq-jammy dnsmasq[8462]: FAILED to start up Aug 18 20:37:25 dnsmasq-jammy systemd[1]: dnsmasq.service: Control process exited, code=exited, status=2/INVALIDARGUMENT Aug 18 20:37:25 dnsmasq-jammy systemd[1]: dnsmasq.service: Failed with result 'exit-code'. Aug 18 20:37:25 dnsmasq-jammy systemd[1]: Failed to start dnsmasq - A lightweight DHCP and caching DNS server. Processing triggers for man-db (2.10.2-1) ... Processing triggers for dbus (1.12.20-2ubuntu4.1) ... Scanning processes... No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. root@dnsmasq-jammy:~# bash test.sh Aug 18 20:37:28 dnsmasq[8566]: started, version 2.90 cachesize 150 Aug 18 20:37:28 dnsmasq[8566]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dumpfile Aug 18 20:37:28 dnsmasq[8566]: DNSSEC validation enabled Aug 18 20:37:28 dnsmasq[8566]: configured with trust anchor for <root> keytag 20326 Aug 18 20:37:28 dnsmasq[8566]: using nameserver 8.8.8.8#53 Aug 18 20:37:28 dnsmasq[8566]: read /etc/hosts - 8 names 1. Without TCP retry (+ignore): DNSSEC validation FAILS Aug 18 20:37:30 dnsmasq[8566]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:37:30 dnsmasq[8566]: forwarded cloudflare.com to 8.8.8.8 Aug 18 20:37:30 dnsmasq[8566]: dnssec-query[DS] com to 8.8.8.8 Aug 18 20:37:30 dnsmasq[8566]: dnssec-query[DNSKEY] . to 8.8.8.8 Aug 18 20:37:30 dnsmasq[8566]: reply . is truncated[DNSKEY] Aug 18 20:37:30 dnsmasq[8566]: validation result is TRUNCATED Aug 18 20:37:30 dnsmasq[8566]: reply is truncated ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 385 Aug 18 20:37:30 dnsmasq[8566]: validation result is TRUNCATED 2. With TCP retry: validation succeeds Aug 18 20:37:30 dnsmasq[8566]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:37:30 dnsmasq[8566]: forwarded cloudflare.com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DS] com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DNSKEY] . to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: reply . is truncated[DNSKEY] Aug 18 20:37:31 dnsmasq[8566]: validation result is TRUNCATED Aug 18 20:37:31 dnsmasq[8566]: reply is truncated Aug 18 20:37:31 dnsmasq[8566]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:37:31 dnsmasq[8566]: forwarded cloudflare.com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DS] com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DNSKEY] . to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: reply . is DNSKEY keytag 57780, algo 8 Aug 18 20:37:31 dnsmasq[8566]: reply . is DNSKEY keytag 20326, algo 8 Aug 18 20:37:31 dnsmasq[8566]: reply . is DNSKEY keytag 38696, algo 8 Aug 18 20:37:31 dnsmasq[8566]: reply com is DS for keytag 19718, algo 13, digest 2 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DS] cloudflare.com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DNSKEY] com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: reply com is DNSKEY keytag 19718, algo 13 Aug 18 20:37:31 dnsmasq[8566]: reply com is DNSKEY keytag 41446, algo 13 Aug 18 20:37:31 dnsmasq[8566]: reply cloudflare.com is DS for keytag 2371, algo 13, digest 2 Aug 18 20:37:31 dnsmasq[8566]: dnssec-query[DNSKEY] cloudflare.com to 8.8.8.8 Aug 18 20:37:31 dnsmasq[8566]: reply cloudflare.com is DNSKEY keytag 34505, algo 13 Aug 18 20:37:31 dnsmasq[8566]: reply cloudflare.com is DNSKEY keytag 2371, algo 13 Aug 18 20:37:31 dnsmasq[8566]: validation result is SECURE Aug 18 20:37:31 dnsmasq[8566]: reply cloudflare.com is 104.16.133.229 Aug 18 20:37:31 dnsmasq[8566]: reply cloudflare.com is 104.16.132.229 ;; Truncated, retrying in TCP mode. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29945 Aug 18 20:37:31 dnsmasq[8566]: validation result is SECURE 3. From cache: returns instantly (0ms), background refresh has no TCP retry Aug 18 20:37:34 dnsmasq[8566]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:37:34 dnsmasq[8566]: cached-stale cloudflare.com is 104.16.133.229 Aug 18 20:37:34 dnsmasq[8566]: cached-stale cloudflare.com is 104.16.132.229 Aug 18 20:37:34 dnsmasq[8566]: forwarded cloudflare.com to 8.8.8.8 ; EDE: 3 (Stale Answer) ;; Query time: 0 msec Aug 18 20:37:34 dnsmasq[8566]: cached-stale cloudflare.com is 104.16.132.229 Aug 18 20:37:34 dnsmasq[8566]: forwarded cloudflare.com to 8.8.8.8 full dnsmasq log in /tmp/tmp.PGfR6Ure7M Aug 18 20:37:34 dnsmasq[8566]: exiting on receipt of SIGTERM root@dnsmasq-jammy:~# apt install -t jammy-proposed dnsmasq dnsmasq-base Reading package lists... Done Building dependency tree... Done Reading state information... Done Suggested packages: resolvconf The following packages will be upgraded: dnsmasq dnsmasq-base 2 upgraded, 0 newly installed, 0 to remove and 21 not upgraded. Need to get 399 kB of archives. After this operation, 12.3 kB of additional disk space will be used. Get:1 http://archive.ubuntu.com/ubuntu jammy-proposed/universe amd64 dnsmasq all 2.91-0ubuntu0.22.04.1 [20.6 kB] Get:2 http://security.ubuntu.com/ubuntu jammy-proposed/main amd64 dnsmasq-base amd64 2.91-0ubuntu0.22.04.1 [379 kB] Fetched 399 kB in 0s (4346 kB/s) (Reading database ... 34233 files and directories currently installed.) Preparing to unpack .../dnsmasq-base_2.91-0ubuntu0.22.04.1_amd64.deb ... Unpacking dnsmasq-base (2.91-0ubuntu0.22.04.1) over (2.90-0ubuntu0.22.04.4) ... Preparing to unpack .../dnsmasq_2.91-0ubuntu0.22.04.1_all.deb ... Unpacking dnsmasq (2.91-0ubuntu0.22.04.1) over (2.90-0ubuntu0.22.04.4) ... Setting up dnsmasq-base (2.91-0ubuntu0.22.04.1) ... Setting up dnsmasq (2.91-0ubuntu0.22.04.1) ... Job for dnsmasq.service failed because the control process exited with error code. See "systemctl status dnsmasq.service" and "journalctl -xeu dnsmasq.service" for details. invoke-rc.d: initscript dnsmasq, action "start" failed. × dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Tue 2026-08-18 20:37:54 UTC; 4ms ago Process: 8745 ExecStartPre=/etc/init.d/dnsmasq checkconfig (code=exited, status=0/SUCCESS) Process: 8753 ExecStart=/etc/init.d/dnsmasq systemd-exec (code=exited, status=2) CPU: 18ms Aug 18 20:37:54 dnsmasq-jammy systemd[1]: Starting dnsmasq - A lightweight DHCP and caching DNS server... Aug 18 20:37:54 dnsmasq-jammy dnsmasq[8753]: dnsmasq: failed to create listening socket for port 53: Address already in use Aug 18 20:37:54 dnsmasq-jammy systemd[1]: dnsmasq.service: Control process exited, code=exited, status=2/INVALIDARGUMENT Aug 18 20:37:54 dnsmasq-jammy dnsmasq[8753]: failed to create listening socket for port 53: Address already in use Aug 18 20:37:54 dnsmasq-jammy systemd[1]: dnsmasq.service: Failed with result 'exit-code'. Aug 18 20:37:54 dnsmasq-jammy dnsmasq[8753]: FAILED to start up Aug 18 20:37:54 dnsmasq-jammy systemd[1]: Failed to start dnsmasq - A lightweight DHCP and caching DNS server. Processing triggers for man-db (2.10.2-1) ... Processing triggers for dbus (1.12.20-2ubuntu4.1) ... Scanning processes... No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. root@dnsmasq-jammy:~# bash test.sh Aug 18 20:37:58 dnsmasq[8855]: started, version 2.91 cachesize 150 Aug 18 20:37:58 dnsmasq[8855]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset no-nftset auth DNSSEC loop-detect inotify dumpfile Aug 18 20:37:58 dnsmasq[8855]: DNSSEC validation enabled Aug 18 20:37:58 dnsmasq[8855]: configured with trust anchor for <root> keytag 20326 Aug 18 20:37:58 dnsmasq[8855]: using nameserver 8.8.8.8#53 Aug 18 20:37:58 dnsmasq[8855]: read /etc/hosts - 8 names 1. Without TCP retry (+ignore): DNSSEC validation FAILS Aug 18 20:38:00 dnsmasq[8855]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:38:00 dnsmasq[8855]: forwarded cloudflare.com to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: dnssec-query[DS] com to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: dnssec-query[DNSKEY] . to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: reply . is truncated Aug 18 20:38:00 dnsmasq[8855]: dnssec-query[DNSKEY] . to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: reply . is DNSKEY keytag 38696, algo 8 Aug 18 20:38:00 dnsmasq[8855]: reply . is DNSKEY keytag 20326, algo 8 Aug 18 20:38:00 dnsmasq[8855]: reply . is DNSKEY keytag 57780, algo 8 Aug 18 20:38:00 dnsmasq[8855]: reply com is DS for keytag 19718, algo 13, digest 2 Aug 18 20:38:00 dnsmasq[8855]: dnssec-query[DS] cloudflare.com to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: dnssec-query[DNSKEY] com to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: reply com is DNSKEY keytag 41446, algo 13 Aug 18 20:38:00 dnsmasq[8855]: reply com is DNSKEY keytag 19718, algo 13 Aug 18 20:38:00 dnsmasq[8855]: reply cloudflare.com is DS for keytag 2371, algo 13, digest 2 Aug 18 20:38:00 dnsmasq[8855]: dnssec-query[DNSKEY] cloudflare.com to 8.8.8.8 Aug 18 20:38:00 dnsmasq[8855]: reply cloudflare.com is DNSKEY keytag 34505, algo 13 Aug 18 20:38:00 dnsmasq[8855]: reply cloudflare.com is DNSKEY keytag 2371, algo 13 Aug 18 20:38:00 dnsmasq[8855]: validation result is SECURE Aug 18 20:38:00 dnsmasq[8855]: reply cloudflare.com is 104.16.133.229 Aug 18 20:38:00 dnsmasq[8855]: reply cloudflare.com is 104.16.132.229 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49831 Aug 18 20:38:00 dnsmasq[8855]: validation result is SECURE 2. With TCP retry: validation succeeds Aug 18 20:38:00 dnsmasq[8855]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:38:00 dnsmasq[8855]: cached cloudflare.com is 104.16.133.229 Aug 18 20:38:00 dnsmasq[8855]: cached cloudflare.com is 104.16.132.229 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13905 Aug 18 20:38:00 dnsmasq[8855]: validation result is SECURE 3. From cache: returns instantly (0ms), background refresh has no TCP retry Aug 18 20:38:03 dnsmasq[8855]: query[A] cloudflare.com from 127.0.0.1 Aug 18 20:38:03 dnsmasq[8855]: cached-stale cloudflare.com is 104.16.132.229 Aug 18 20:38:03 dnsmasq[8855]: cached-stale cloudflare.com is 104.16.133.229 Aug 18 20:38:03 dnsmasq[8855]: forwarded cloudflare.com to 8.8.8.8 ; EDE: 3 (Stale Answer) ;; Query time: 0 msec Aug 18 20:38:03 dnsmasq[8855]: cached-stale cloudflare.com is 104.16.133.229 Aug 18 20:38:03 dnsmasq[8855]: forwarded cloudflare.com to 8.8.8.8 full dnsmasq log in /tmp/tmp.12QtaIiun4 Aug 18 20:38:03 dnsmasq[8855]: exiting on receipt of SIGTERM ** Tags removed: verification-needed-jammy ** Tags added: verification-done-jammy -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2138412 Title: DNSSEC validation with stale cache enabled does not properly retry truncated response To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/2138412/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
