Ask HN: What Happened in DNSSEC Yesterday?

Re:Ask HN: What Happened in DNSSEC Yesterday? by standardhuman on Monday October 12, 2026 @08:24AM (#50055380)

I suspect you ran into complications from the DNS root key rollover. There's a bit more on that here: https://blog.cloudflare.com/root-ksk-2024-rollover/

And a tool for checking readiness: https://dnstest.dev/ksk-2024/

[ Parent | on HN ]

Re:Ask HN: What Happened in DNSSEC Yesterday? by usr1106 on Monday October 12, 2026 @09:26AM (#50056152)

Thanks a lot! That must be it. Wasn't aware that something "big" was happening.

[ Parent | on HN ]

Re:Ask HN: What Happened in DNSSEC Yesterday? by usr1106 on Tuesday October 13, 2026 @04:03PM (#50077820)

The "complication" is simply that systemd-resolved on older, but still supported Ubuntu versions 24.04 LTS and 22.04 LTS does not know about the new KSK. It can be installed on those distros, but systemd-resolved by default only uses keys from its own package, not what is installed system-wide.

https://askubuntu.com/questions/1570248/systemd-dnssec-failu...

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/21705...

The linked online tool https://dnstest.dev/ksk-2024/ shows all green nevertheless. At least with local DNSSEC verification disabled. But with DNSSEC verification the tool cannot even be opened. No idea how this is supposed to work.

Edit: After adding the new KSK manually the online tool displays:

> RFC 8509 support was not detected All three sentinel names resolved despite the DNSSEC controls passing. Your resolver path does not appear to implement the sentinel, so this test cannot determine whether it trusts KSK-2024.

[ Parent | on HN ]