# DNSSEC discussion - support for proxy-dnssec

**URL:** <https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217>\
**Category:** General\
**Tags:** unbound\
**Created:** [April 2, 2023, 8:21am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217 "2023-04-02T08:21:59Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 2, 2023, 8:21am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/1 "2023-04-02T08:21:59Z")

</div>

> [@Pi-hole won't cache results if answer doesn't fit known reply types and will always display "N/A (0.0ms)" as Reply in Query Log](https://discourse.pi-hole.net/t/pi-hole-wont-cache-results-if-answer-doesnt-fit-known-reply-types-and-will-always-display-n-a-0-0ms-as-reply-in-query-log/49171/20):
>
> it is already in the bleeding-edge branch `update/dnsmasq`

pihole checkout ftl update/dnsmasq

```auto
  Pi-hole version is v5.16.2 (Latest: v5.16.2)
  AdminLTE version is v5.19 (Latest: v5.19)
  FTL version is update/dnsmasq vDev-879708d (Latest: v5.22)

```

1. pihole -vv doesn't show a difference (for dnsmasq) between master & update/dnsmasq, only the FTL info section shows a difference, dnsmasq not updated?

```auto
******************************FTL**********************************
Version: vDev-879708d
Branch: update/dnsmasq
Commit: 879708d6 (2023-04-01 14:13:22 +0200)
Architecture: armv7hf (compiled on CI)
Compiler: arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0

******************************dnsmasq******************************
Version: pi-hole-v2.89-9461807
Features: IPv6 GNU-getopt no-DBus no-UBus no-i18n IDN DHCP DHCPv6 Lua TFTP no-conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dumpfile

******************************SQLite3******************************
Version: 3.41.1
Features: ATOMIC_INTRINSICS=1 COMPILER=gcc-8.3.0 DEFAULT_AUTOVACUUM DEFAULT_CACHE_SIZE=-16384 DEFAULT_FILE_FORMAT=4 DEFAULT_FOREIGN_KEYS DEFAULT_JOURNAL_SIZE_LIMIT=-1 DEFAULT_MEMSTATUS=0 DEFAULT_MMAP_SIZE=0 DEFAULT_PAGE_SIZE=4096 DEFAULT_PCACHE_INITSZ=20 DEFAULT_RECURSIVE_TRIGGERS DEFAULT_SECTOR_SIZE=4096 DEFAULT_SYNCHRONOUS=2 DEFAULT_WAL_AUTOCHECKPOINT=1000 DEFAULT_WAL_SYNCHRONOUS=2 DEFAULT_WORKER_THREADS=0 DQS=0 ENABLE_DBPAGE_VTAB MALLOC_SOFT_LIMIT=1024 MAX_ATTACHED=10 MAX_COLUMN=2000 MAX_COMPOUND_SELECT=500 MAX_DEFAULT_PAGE_SIZE=8192 MAX_EXPR_DEPTH=1000 MAX_FUNCTION_ARG=127 MAX_LENGTH=1000000000 MAX_LIKE_PATTERN_LENGTH=50000 MAX_MMAP_SIZE=0x7fff0000 MAX_PAGE_COUNT=1073741823 MAX_PAGE_SIZE=65536 MAX_SQL_LENGTH=1000000000 MAX_TRIGGER_DEPTH=1000 MAX_VARIABLE_NUMBER=32766 MAX_VDBE_OP=250000000 MAX_WORKER_THREADS=8 MUTEX_PTHREADS OMIT_DEPRECATED OMIT_DESERIALIZE OMIT_LOAD_EXTENSION OMIT_PROGRESS_CALLBACK SYSTEM_MALLOC TEMP_STORE=1 THREADSAFE=1

********************************LUA********************************
Version: 5.4
Libraries: inspect.lua (8.46 KB)

*****************************LIBNETTLE*****************************
Version: 3.8
GMP: Full

```

1. sudo service pihole-FTL status shows a line:

```auto
SHOW_DNSSEC: Enabled, showing automatically generated DNSSEC queries

```

How do I disable this? I don't use DNSSEC with dnsmasq, Unbound is handling DNSSEC (would be nice if proxy-dnssec - dnsmasq setting - generated something meaningful, using the info from unbound, now it's SERVFAIL - possible?)

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [April 2, 2023, 11:09am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/2 "2023-04-02T11:09:14Z")

</div>

> [@jpgpi250](#):
>
> How do I disable this? I don't use DNSSEC with dnsmasq

Isnt that the "Use DNSSEC" option under the DNS tab?

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 2, 2023, 11:16am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/3 "2023-04-02T11:16:24Z")

</div>

![image](https://discourse.pi-hole.net/uploads/default/original/3X/f/9/f9bc15074a82de74628bae70f4e624912a94d947.png)

disabled, message appears anyway

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 2, 2023, 11:17am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/4 "2023-04-02T11:17:52Z")

</div>

> [@jpgpi250](#):
>
> pihole -vv doesn't show a difference (for dnsmasq)

This is always the case for `update/dnsmasq`, the `dnsmasq` version string does only update on `dnsmasq` tags - which hasn't happened so far.

> [@jpgpi250](#):
>
> > `SHOW_DNSSEC: Enabled, showing automatically generated DNSSEC queries`
> 
> How do I disable this?

Well, as always: simply set [`SHOW_DNSSEC=false`](https://docs.pi-hole.net/ftldns/configfile/#show_dnssec) in `/etc/pihole/pihole-FTL.conf`

> [@jpgpi250](#):
>
> would be nice if proxy-dnssec - dnsmasq setting - generated something meaningful, using the info from unbound, now it's SERVFAIL - possible?

Not possible. The `SERVFAIL` from `unbound` does not include any reason, it is simply a `SERVFAIL`. `proxy-dnssec` is "broken by design" and [should be considered deprecated](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2019q4/013645.html).

> In most cases, enabling DNSSEC validation within dnsmasq is a better option.

I have it in both FTL and `unbound` and have not encountered a single false-positive in the last two years.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 2, 2023, 11:27am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/5 "2023-04-02T11:27:01Z")

</div>

> [@DL6ER](#):
>
> have not encountered a single false-positive in the last two years.

I occasionally read topics (various forums), claiming unbound returns false positives, experienced them occasionally myself, found [this](https://lists.nlnetlabs.nl/pipermail/unbound-users/2023-March/008051.html) work around in the unbound mailing list.

- second message: permanent work around (unbound config change)
- third message: temporary work around (unbound- control command)

edit

> [@DL6ER](#):
>
> Well, as always: simply set [`SHOW_DNSSEC=false`](https://docs.pi-hole.net/ftldns/configfile/#show_dnssec) in `/etc/pihole/pihole-FTL.conf`

wouldn't it be great if you provided a pihole-FTL.conf with **all configuration options** listed, like a lot of other programs do, e.g.

```auto
# Should FTL analyze and include automatically generated DNSSEC queries in the Query Log?
# SHOW_DNSSEC=true

```

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 2, 2023, 11:59am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/6 "2023-04-02T11:59:00Z")

</div>

> [@jpgpi250](#):
>
> claiming unbound returns false positives

So it seems useful to have Pi-hole doing this, too.

> [@jpgpi250](#):
>
> wouldn't it be great if you provided a pihole-FTL.conf with **all configuration options** listed,

This is exactly what v6.0 is doing, see here for an example:

[https://github.com/pi-hole/FTL/blob/new/http/test/pihole.toml](https://github.com/pi-hole/FTL/blob/new/http/test/pihole.toml)

The file is automatically generated, automatically reloaded on changes and FTL will even annotate what the default was when you change it and clearly mark the value as changed. It is furthermore possible in v6.0 to change _everything_ from the web interface.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 6, 2023, 6:47am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/7 "2023-04-06T06:47:31Z")

</div>

> [@DL6ER](#):
>
> > [@jpgpi250](#):
> >
> > would be nice if proxy-dnssec - dnsmasq setting - generated something meaningful, using the info from unbound, now it's SERVFAIL - possible?
> 
> Not possible. The `SERVFAIL` from `unbound` does not include any reason, it is simply a `SERVFAIL`. `proxy-dnssec` is "broken by design" and [should be considered deprecated](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2019q4/013645.html).

see the reply on the unbound mailing list, [here](https://lists.nlnetlabs.nl/pipermail/unbound-users/2023-April/008070.html).

> Unbound with DNSSEC validation configured will reply with the AD bit for  
> secure answers and SERVFAIL for bogus answers. Insecure answer will get  
> the answer without the AD bit set.

> Newer versions (\>= 1.16.0) will also attach EDE codes for DNSSEC  
> validation failures to the SERVFAIL answers.

> [@DL6ER](#):
>
> In most cases, enabling DNSSEC validation within dnsmasq is a better option.

This is a quote from the dnsmasq man. Does make me think of [this](https://nl.wikipedia.org/wiki/Wij_van_Wc-eend_adviseren_Wc-eend), translates to something like "we from wceend (the company) recommend wceend ( the product)...

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 7, 2023, 10:28am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/8 "2023-04-07T10:28:51Z")

</div>

`dnsmasq` with option `proxy-dnssec` doesn't do any DNSSEC related analysis at all so this will not be in the logs, either. FTL could, however, look at the queries, check the `AD` bit of successful queries and trust this as `SECURE` or `INSECURE`. For `SERVFAIL`, we could indeed check the EDE and derive `BOGUS` when this is the case.

> see the reply on the unbound mailing list

Our development server is running Ubuntu 22.04 which ships `unbound 1.13.1`. I set up a separate `unbound` next to it but am not seeing any EDNS details in the `SERVFAIL`:

```auto
dig +short TXT CH version.bind -p 5335
"unbound 1.17.1"

```

After searching quite deeply through the `unbound` documentation, I found:

> The EDE errors can be turned on by `ede: yes`, it is default disabled. Validation errors and other errors are then reported.

And, indeed, setting this to `yes` gives us some EDE response code (Wireshark screenshot):

 ![Screenshot from 2023-04-07 12-04-51](https://discourse.pi-hole.net/uploads/default/original/3X/4/7/4779f1854260b4d912a6e4af0f24b97fe31fdaa9.png)

Neither `dnsmasq` not FTL post-process the ENDS data from failed replies so far. I will look into changing this. Feel free to remind me at some point if I forget about it. However, do not read this a promise that it will be added. If this turns out to need a major rewrite at some point, I'm not very in favor of it given that (a) enabling DNSSEC validation in `dnsmasq`/`pihole-FTL` is a good (and the typically used) option and that (b) EDNS is even disabled by `unbound` by default. This feature is not likely to reach more than two users in the end.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 7, 2023, 2:22pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/9 "2023-04-07T14:22:51Z")

</div>

I asked clarification [here](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q2/016983.html), hopefully Simon will read this and react upon the additional information, provided by unbound...

> [@DL6ER](#):
>
> This feature is not likely to reach more than two users in the end.

[Search results for 'proxy-dnssec' - Pi-hole Userspace](https://discourse.pi-hole.net/search?q=proxy-dnssec)

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 7, 2023, 6:52pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/10 "2023-04-07T18:52:55Z")

</div>

Please try FTL branch `new/ede-dnssec`. When you enable the debug flags `DEBUG_QUERIES`, `DEBUG_EDNS0` and `DEBUG_DNSSEC`, you should see related lines in `FTL.log`. But even without these debug flags, you should see the status being reflected on the web interface when `proxy-dnssec` is used.

Note that this will make FTL trust whatever upstream in not being able to have been modified in transit. This is typically a valid assumption on your local network (moreover on the same device), but not across the Internet. SERVFAIL will be considered `BOGUS` if the upstream contains related EDE information. However, this can also lead to incorrect `SECURE` marks when your upstream sets the AD bit for whatever reason. This is also the reason why it is recommended to have `dnsmasq`/`pihole-FTL` do DNSSEC instead of using `proxy-dnssec`.

**edit** Related PR:

[https://github.com/pi-hole/FTL/pull/1551](https://github.com/pi-hole/FTL/pull/1551)

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 8, 2023, 7:23am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/11 "2023-04-08T07:23:09Z")

</div>

> [@DL6ER](#):
>
> Note that this will make FTL trust whatever upstream in not being able to have been modified in transit.

pihole-FTL and unbound are running on the same raspberry pi 3B.

Pi-hole version is v5.16.2 (Latest: v5.16.2)  
AdminLTE version is v5.19 (Latest: v5.19)  
FTL version is new/ede-dnssec vDev-8a4488c (Latest: v5.22)

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/9/c/9c7e3f9a449e3bd89377d6b1af2405590e883cdb.png)

in unbound.conf:

```auto
# required for proxy-dnssec (dnsmasq)
ede: yes
ede-serve-expired: yes

```

in dnsmasq.d/dnssec.conf

```auto
# requires use of "ede: yes" and "ede-serve-expired: yes" in unbound.conf
proxy-dnssec

```

I assume the value in pihole-FTL.db / query\_storage / dnssec DON'T match the values, described in [this](https://blog.nlnetlabs.nl/extended-dns-error-support-for-unbound/) document. Is there a mapping available between unbound EDE code and the dnssec value in the database?

will now try to see if the dnsmasq options "dnssec-no-timecheck" and "dnssec-check-unsigned=no" do what is expected...

I hope this will remain part of FTL.

Thanks for your time, effort and another great addition to pi-hole!

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 8, 2023, 10:07am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/12 "2023-04-08T10:07:23Z")

</div>

> [@DL6ER](#):
>
> Please try FTL branch `new/ede-dnssec`.

something appears to be wrong.

if FTL is running and responding:

- dig [http://www.dnssec-failed.org/](http://www.dnssec-failed.org/) returns NXDOMAIN, system remains operational

than, when **using a browser** to visit:

- [dnssec-analyzer.verisignlabs.com](https://dnssec-analyzer.verisignlabs.com/)
- [http://www.dnssec-failed.org/](http://www.dnssec-failed.org/)  
resolving stops, no more dns, no more dashboard, ftl restart required to solve the problem

the system (linux terminal) remains responsive, load average: 0.02, 0.05, 0.06  
opening the web interface in an alternate browser has the same result, can login, but no result.

edit  
enabled recommended debug flags - see above  
visited two "normal" sites, than [www.dnssec-failed.org](http://www.dnssec-failed.org/)

crash -\>  
[FTL.zip](https://discourse.pi-hole.net/uploads/short-url/kmpIgwRyelPMdyqtZXEv8W01StB.zip) (7.9 KB)

/edit

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 8, 2023, 10:57am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/13 "2023-04-08T10:57:21Z")

</div>

Sorry. I have seen the cause - `SERVFAIL` with invalid EDE data from upstream was causing this. I just pushed the fix for it, forgot to hit "Git Push" yesterday...

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 8, 2023, 11:14am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/14 "2023-04-08T11:14:58Z")

</div>

no apologies, ensures the 'tester' really does some tests, ensures a better end result.

I now see:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/4/0/40bfab84705cb652528fdd21ba163c7a4e0ac759.png)

INSECURE (refused by upstream), however the dnssec field value = 2, reply type = 7  
~~Does this imply I will never see BOGUS / ABANDONED in the query log (need to consult the unbound log for detail?). This is NOT a problem, much better than simple SERVFAIL.~~

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/f/2/f211fbf63a8d8a1333c54a63716512ac14afb58a.png)

BOGUS (refused upstream) dnssec field value = 3, reply type = 7

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 8, 2023, 11:54am UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/15 "2023-04-08T11:54:37Z")

</div>

> [@jpgpi250](#):
>
> INSECURE (refused by upstream), however the dnssec field value = 2, reply type = 7  
> Does this imply I will never see BOGUS / ABANDONED in the query log (need to consult the unbound log for detail?).

No, `INSECURE` is wrong here. This seems to suggest that there is no EDE from upstream or it isn't interpreted correctly.

Please enable

```auto
DEBUG_QUERIES=true
DEBUG_DNSSEC=true
DEBUG_EDNS0=true

```

On my Pi-hole, I see the following for this domain (my logging output is somewhat different):

```auto
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: **** new UDP IPv4 query[A] query "www.dnssec-failed.org" from lo/127.0.0.1#40017 (ID 25, FTL 28142, src/dnsmasq/forward.c:1758)
2023-04-08 13:52:41.522 [2159442M] DEBUG_DNSSEC: Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:763
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: www.dnssec-failed.org is not known
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: Checking if "www.dnssec-failed.org" is in gravity: no
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: Checking if "||org^" is in gravity: no
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: Checking if "||dnssec-failed.org^" is in gravity: no
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: Checking if "||www.dnssec-failed.org^" is in gravity: no
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: DNS cache: 127.0.0.1/www.dnssec-failed.org is not blocked
2023-04-08 13:52:41.522 [2159442M] DEBUG_QUERIES: **** forwarded www.dnssec-failed.org to 127.0.0.1#5335 (ID 25, src/dnsmasq/forward.c:553)
2023-04-08 13:52:41.523 [2159442M] DEBUG_EDNS0: EDNS(0) pheader: 00 00 29 04 D0 00 00 00 00 00 06 00 0F 00 02 00 06 (17 bytes)
2023-04-08 13:52:41.523 [2159442M] DEBUG_EDNS0: EDNS(0) requestor's UDP payload size: 1232 bytes
2023-04-08 13:52:41.523 [2159442M] DEBUG_EDNS0: EDNS(0) code 15, optlen 2 (bytes 4 - 6 of 6)
2023-04-08 13:52:41.523 [2159442M] DEBUG_EDNS0: EDNS(0) EDE: DNSSEC bogus (code 6)
2023-04-08 13:52:41.523 [2159442M] DEBUG_QUERIES: **** got error reply from 127.0.0.1#5335: www.dnssec-failed.org is SERVFAIL (ID 25, src/dnsmasq/forward.c:786)
2023-04-08 13:52:41.523 [2159442M] DEBUG_QUERIES: EDE: DNSSEC bogus (6)
2023-04-08 13:52:41.523 [2159442M] DEBUG_DNSSEC: Setting DNSSEC status to BOGUS in src/dnsmasq_interface.c:2516
2023-04-08 13:52:41.523 [2159442M] DEBUG_QUERIES: Set reply to SERVFAIL (7) in src/dnsmasq_interface.c:2519

```

Can you confirm this or do you see something different (as said, logging output is expected to not be precisely 1:1)?

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 8, 2023, 12:20pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/16 "2023-04-08T12:20:12Z")

</div>

No, `INSECURE` is wrong here. This seems to suggest that there is no EDE for upstream or it isn't read properly.

for some reason, there is a difference between:

- dig  

- browser (microsoft edge)  

- browser (firefox)  

cleared the FTL log, performed the requests as listed above, with debug flags enabled.

[FTL.zip](https://discourse.pi-hole.net/uploads/short-url/lywEKWSrP96KWazltCqlf9ssGvF.zip) (9.6 KB)

I don't have any DNSSEC extensions in the browser.

edit  
the messages start changing

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/b/0/b04843e72a4d341a68bad436731ee99783f46ddd.png)  
BOGUS (DNSSEC bogus)  
/edit

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 8, 2023, 12:32pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/17 "2023-04-08T12:32:57Z")

</div>

Okay, this is interesting... The first one behaves as expected (BOGUS) and is of type `A`. The two others are not. However, this isn't the important difference here. Your upstream apparently really didn't include the EDE codes in the two INSECURE cases.

To verify this, we need to pump the reply received from `unbound`. It can be enabled by adding the following to a file like `/etc/dnsmasq.d/99-record.conf`:

```auto
dumpfile=/etc/pihole/dump.pcap
dumpmask=0x00ff

```

This file should show us if my speculation is right and it is missing from upstream. Please also upgrade your FTL before as I added a bit more debug logging to the ENDS0 code (no functional change) - the compilation is still running and should be done in 1-2 minutes ( **done and uploaded** ).

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 8, 2023, 12:50pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/18 "2023-04-08T12:50:12Z")

</div>

> [@DL6ER](#):
>
> this is interesting

means you're having fun?

- added the 99-record.conf file

- installed new ftl  
Pi-hole version is v5.16.2 (Latest: v5.16.2)  
AdminLTE version is v5.19 (Latest: v5.19)  
FTL version is new/ede-dnssec vDev-538c6a0 (Latest: v5.22)

- cleared ftl log

- ran the tests in the given order (dig A , followed by dig AAAA, edge, firefox

[FTL.zip](https://discourse.pi-hole.net/uploads/short-url/yMKVpmn9Nh3QlJTBFQEaxaZvQEG.zip) (35.5 KB)

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 8, 2023, 12:52pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/19 "2023-04-08T12:52:07Z")

</div>

Thanks, is there still something unexpected in the Query Log (dashboard) as in your screenshot earlier?

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 8, 2023, 12:55pm UTC](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217/20 "2023-04-08T12:55:58Z")

</div>

start of test:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/1/d/1d87a3859259319ce97619647851512c62804e67.png)

already forwarded:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/d/1/d15b893ce04ab4a87ba95677478de5d9efad3912.png)

[Next page](https://discourse.pi-hole.net/t/dnssec-discussion-support-for-proxy-dnssec/62217.md?page=2)