DNSSEC validation failing after root key rollover

Bugs
1

As a glutton for punishment, I have my home VyOS configured to validate DNSSEC.

service dns forwarding dnssec 'validate'

Today most or all queries started to SERVFAIL. I updated to 2026.10.07-0712-rolling, but the behavior is still the same unless I turn off DNSSEC validation.

I see what appears to be the new key (keytag 38696) in /usr/share/dns/root.key

andrewimeson@imehome-router-1:/run/pdns-recursor$ cat /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ; keytag 20326
. IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ; keytag 38696

I haven’t dug into it much, but wanted to post what I have so far.

2

I’ve dug into it some more and the issues appears to me with my upstream resolver not having the new key. I don’t think this is a VyOS issue.

Comparing these results shows that they don’t have the keytag 38696

dig . DNSKEY +dnssec @$MyResolver
3

You can verify the trust anchors with the information available at:

https://www.iana.org/dnssec/file

Out of the blue the ones included in at least 2026.03 seems to be up2date.

A workaround could be to install technitium/dns-server as a container or whatever you prefer.

Another workaround is to stop using forwarding and instead use the local DNS-server as a recursive resolver - this way you wont be dependent on “upstream” fuckery like if some upstream resolver didnt fix their DNSSEC rollover ahead of time (the new trust anchors have exists “only” since 2024-11-05).

4

Probably related: