WhatBrokeToday
Today's Trends
highInvestigatingLinux

systemd-resolved DNSSEC Verification Broken

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

systemd-resolved, the DNS resolver in systemd, has broken DNSSEC verification. The issue caused internet connectivity issues for users who had DNSSEC enabled, including the OP of this Hacker News thread. No official fix URL provided.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Technical root cause

Under active investigation. No report has identified a root cause yet.

Evidence

1 report · 1 HNShow
  1. [1]
    HN First report
    Ask HN: What Happened in DNSSEC Yesterday?(opens Hacker News thread in a new tab)

    I have had DNSSEC verification enabled for a couple of months in systemd-resolved. Not that I am particular paranoid or do any nuclear-sensitive stuff on my machine. Don't even own any Bitcoin. But mostly out of technical curiosity. Until yesterday I had only noticed 2 broken sites (or sites affected by buggy systemd-resolved implementation as some voices claim). Some Jira Plugin and Swedish Railways SJ. Yesterday basically the Internet stopped working for me. After a while I remembered good…

    by usr1106 3upvotes 4comments

Timeline

  1. First report on Hacker News thread

    Ask HN: What Happened in DNSSEC Yesterday?

    Source