DNSSEC Validation Broken?

[Icona]

I’m not sure what’s happening here or how to troubleshoot, but no network changes have been made other than a recent update to my Pihole install.

Note: I was forced to put parenthesis around (@) because the site thinks I’m tagging a user and refuses to let me post, but when issuing the commands the at symbol is not enclosed in parenthesis.

Expected Behaviour:
When testing DNSSEC Validation w/ dig sigfail.verteiltesysteme.net @127.10.10.1 -p 5353 I should be receiving a “SERVFAIL” response with no IP

Actual Behaviour:
When testing DNSSEC Validation with: dig sigfail.verteiltesysteme.net @127.10.10.1 -p 5353 I’m getting a “NOERROR” response and IP instead of “SERVFAIL”

[rdwebdesign]

@Icona

Note: I was forced to put parenthesis around (@) because the site thinks I’m tagging a user and refuses to let me post, but when issuing the commands the at symbol is not enclosed in parenthesis.

Hint:

If you surround the code using backticks (like this: ` code `), you can post as many @ as you like.

dig sigfail.verteiltesysteme.net @127.10.10.1 -p 5353

[rdwebdesign]

This post explains what is happening:

Very strange or very stupid? unbound problem. #not resolvconf_resolvers

That domain does not seem to be available anymore. Use the DNSSEC test servers as updated in our guide: dig fail01.dnssec.works @127.0.0.1 -p 5335 dig dnssec.works @127.0.0.1 -p 5335 Note that DNSSEC requires accurate time information. The times from your dig results and logs do not seem to match - one instance I've checked they differ for about 10 minutes. This may just be a result of extracting logs for a different time frame, but still: You want to verify that your unbound host machine…

[Icona]

Thanks for chiming in. Rebooted the pi after the time adjustment and it seems to have fixed the issue with the new test domains you provided. Good catch!! Thanks again!!