Public bug reported:
As of several days ago a new DNSSEC root key, with tag 38696, was
rotated in. While being packaged with dns-root-data since 2024-07 and
systemd-resolved reading a whole systemd-style sets of directories for
trust roots and exclusions, systemd-resolved was only packaged with a
built-in root of trust that didn't have a tag 38696 key, only an old key
with tag 20326. That meant that since 11'th of October systemd-resolved
installations with DNSSEC validation enabled (doesn't matter if mode was
allow-downgrade or all) stopped resolving DNSSEC-signed zones with
missing-key error.
Workaround is, in hindsight, very easy:
```
sudo install -d /etc/dnssec-trust-anchors.d
sudo ln -s /usr/share/dns/root.ds
/etc/dnssec-trust-anchors.d/90-LOCAL-FIX-REUSE-DNS-ROOT-DATA.positive
sudo systemctl restart systemd-resolved
```
I think systemd-resolved should be repacked with a dependency on dns-
root-data and a symlink `/usr/lib/dnssec-trust-anchors.d/root.positive
-> /usr/share/dns/root.ds`.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: systemd-resolved 255.4-1ubuntu8.17
ProcVersionSignature: Ubuntu 7.0.0-38.38~24.04.4-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Wed Oct 14 14:53:08 2026
SourcePackage: systemd
UpgradeStatus: Upgraded to noble on 2024-09-13 (761 days ago)
** Affects: systemd (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
** Summary changed:
- resolved is only shipped with built-in DNSSEC root while dns-root-data
package exists
+ resolved is only shipped with an outdated built-in DNSSEC root while
dns-root-data package exists
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170823
Title:
resolved is only shipped with an outdated built-in DNSSEC root while
dns-root-data package exists
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170823/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
