DNSSEC validation doesn't seem to work.

[erisk-id]

AlmaLinux 9.5
PowerDNS Recursor 5.2.0

I configured "dnssec.validation: validate" on my pdns-recursor server, but DNSSEC validation doesn't seem to work.

# dig @192.168.182.21 dnssec-failed.org  +dnssec

; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> @192.168.182.21 dnssec-failed.org +dnssec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56900
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;dnssec-failed.org.             IN      A

;; ANSWER SECTION:
dnssec-failed.org.      300     IN      A       96.99.227.255
dnssec-failed.org.      300     IN      RRSIG   A 5 2 300 20250314145121 20250225144621 44973 dnssec-failed.org. 5rFBB4naA3X2q1EXKuX+7U5TINhA3toviJkgpiZA2nnQmOhPpWrZ+9i7 3B4vPxAZ3mnvCAD4Ftpy6v83rOr5g5uALLdkQ4shgMuO88M2Vw2abzzb Ef5ZLgWXHwfUe7xC3PPI3hbbO0HAsVhirbJhueOaaPxGZagZ+/BaGd+d Q/I=

;; Query time: 159 msec
;; SERVER: 192.168.182.21#53(192.168.182.21) (UDP)
;; WHEN: Tue Mar 04 13:48:43 JST 2025
;; MSG SIZE  rcvd: 239

The another DNS Resolver applicatons, Knot-Resolver and Unbound return SERVFAIL normally.

# dig @192.168.182.24 dnssec-failed.org  +dnssec

; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> @192.168.182.24 dnssec-failed.org +dnssec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 8433
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; EDE: 9 (DNSKEY Missing): (V5T7: forwarded EDE code)
;; QUESTION SECTION:
;dnssec-failed.org.             IN      A

;; Query time: 340 msec
;; SERVER: 192.168.182.24#53(192.168.182.24) (UDP)
;; WHEN: Tue Mar 04 14:09:57 JST 2025
;; MSG SIZE  rcvd: 76

# dig @192.168.182.22 dnssec-failed.org  +dnssec

; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> @192.168.182.22 dnssec-failed.org +dnssec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 8734
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;dnssec-failed.org.             IN      A

;; Query time: 199 msec
;; SERVER: 192.168.182.22#53(192.168.182.22) (UDP)
;; WHEN: Tue Mar 04 14:10:00 JST 2025
;; MSG SIZE  rcvd: 46

My /etc/pdns-recursor/recursor.yml is bellow.

dnssec:
    validation: validate 

incoming:
    allow_from:
    - '127.0.0.0/8'
    - '192.168.0.0/16'
    listen:
    - '127.0.0.1'
    - '192.168.182.21'

outgoing:
    source_address:
    - '192.168.182.21'

recursor:
    forward_zones_recurse: 
    - zone: .
      forwarders:
      - 8.8.8.8

Trust Anchor is configured.

# rec_control get-tas
Configured Trust Anchors:
.
                20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
                38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16

Can anyone solve this problem?
I don't have any ideas.

Thank you.

[omoerbeek]

I cannot not reproduce. Can you check your startup log? I suspect you have a syntax error in your config.

[erisk-id]

Logs when pdns-recursor restated is bellow.
It don't seem to exist sintax errors.

Mar  4 16:53:53 prec systemd[1]: Stopping PowerDNS Recursor...
Mar  4 16:53:53 prec systemd[1]: pdns-recursor.service: Deactivated successfully.
Mar  4 16:53:53 prec systemd[1]: Stopped PowerDNS Recursor.
Mar  4 16:53:53 prec systemd[1]: Starting PowerDNS Recursor...
Mar  4 16:53:53 prec pdns-recursor[2711]: Mar 04 16:53:53 PowerDNS Recursor 5.2.0 (C) PowerDNS.COM BV
Mar  4 16:53:53 prec [2711]: PowerDNS Recursor 5.2.0 (C) PowerDNS.COM BV
Mar  4 16:53:53 prec pdns-recursor[2711]: Mar 04 16:53:53 Using 64-bits mode. Built using gcc 11.5.0 20240719 (Red Hat 11.5.0-2.0.1) on Jan 13 2025 09:44:29 by root@localhost.
Mar  4 16:53:53 prec [2711]: Using 64-bits mode. Built using gcc 11.5.0 20240719 (Red Hat 11.5.0-2.0.1) on Jan 13 2025 09:44:29 by root@localhost.
Mar  4 16:53:53 prec pdns-recursor[2711]: Mar 04 16:53:53 PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2.
Mar  4 16:53:53 prec [2711]: PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2.
Mar  4 16:53:53 prec pdns-recursor[2711]: Mar 04 16:53:53 msg="Processing main YAML settings" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.692" path="/etc/pdns-recursor/recursor.yml"
Mar  4 16:53:53 prec [2711]: msg="Processing main YAML settings" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.692" path="/etc/pdns-recursor/recursor.yml"
Mar  4 16:53:53 prec pdns-recursor[2711]: Mar 04 16:53:53 msg="YAML config found and processed" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.693" configname="/etc/pdns-recursor/recursor.yml"
Mar  4 16:53:53 prec [2711]: msg="YAML config found and processed" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.693" configname="/etc/pdns-recursor/recursor.yml"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Enabling IPv4 transport for outgoing queries" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.696"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="NOT using IPv6 for outgoing queries - add an IPv6 address (like '::') to query-local-address to enable" subsystem="config" level="0" prio="Warning" tid="0" ts="1741074833.696"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Disabled DNSSEC algorithms" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.699" algorithms="5 7" automatically="1"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Setting access control" subsystem="config" level="0" prio="Info" tid="0" ts="1741074833.699" acl="allow-from" addresses="127.0.0.0/8 192.168.0.0/16"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Will not send queries to" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.706" addresses="127.0.0.0/8 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 192.168.0.0/16 172.16.0.0/12 ::1/128 fc00::/7 fe80::/10 0.0.0.0/8 192.0.0.0/24 192.0.2.0/24 198.51.100.0/24 203.0.113.0/24 240.0.0.0/4 ::/96 ::ffff:0:0/96 100::/64 2001:db8::/32 0.0.0.0 ::"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Redirecting queries" subsystem="config" level="0" prio="Info" tid="0" ts="1741074833.706" addresses="8.8.8.8:53" recursion="1" zone="."
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Inserting rfc 1918 private space zones" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.706"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Inserting rfc 6303 private space zones" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.706"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Listening for queries" subsystem="config" level="0" prio="Info" tid="0" ts="1741074833.706" addresses="127.0.0.1:53 192.168.182.21:53" proto="UDP" reuseport="1" socketInstances="2"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Enabled TCP data-ready filter for (slight) DoS protection" subsystem="config" level="0" prio="Info" tid="0" ts="1741074833.707"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Listening for queries" subsystem="config" level="0" prio="Info" tid="0" ts="1741074833.707" addresses="127.0.0.1:53 192.168.182.21:53" protocol="TCP" reuseport="1" socketInstances="1"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Launching worker threads" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.708" count="2"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Launching tcpworker threads" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.708" count="1"
Mar  4 16:53:53 prec pdns-recursor[2711]: msg="Enabled multiplexer" subsystem="runtime" level="0" prio="Info" tid="0" ts="1741074833.709" name="epoll"
Mar  4 16:53:53 prec systemd[1]: Started PowerDNS Recursor.
Mar  4 16:53:56 prec pdns-recursor[2711]: msg="Polled security status of version, no known issues reported" subsystem="housekeeping" level="0" prio="Notice" tid="0" ts="1741074836.423" query="recursor-5.2.0.security-status.secpoll.powerdns.com" securitymessage="OK" status="1" version="5.2.0"

[rgacogne]

msg="Disabled DNSSEC algorithms" subsystem="config" level="0" prio="Notice" tid="0" ts="1741074833.699" algorithms="5 7" automatically="1"

This likely explains why dnssec-failed.org is not validated.

[erisk-id]

Thank you.
After adding bellow, pdns-recursor returns SERVFAIL.

dnssec: 
    validation: validate
    disabled_algorithms:
    - '1'  # deprecated MD5

If a zone is signed with an invalid algorithm, is it correct behavior to return NOERROR even if the zone is BOGUS?
As you may know, “dnssec-failed.org” is a domain that is intentionally BOGUS.

[Habbie]

NOERROR is correct behaviour for algorithms that your system does not support. In your case, RedHat (as Alma's upstream) has decided to disable these algorithms. They might have articles about how to re-enable them.

[omoerbeek]

For a hint about changing the security policy on RHEL 9 derived systems, see the Workaround in #12890

[erisk-id]

After thinking about the meaning of “Insecure” and the DNSSEC specification, I found this to be normal.
Thank you very much for your answers.