DNSSEC with Pihole

Help
1

Hi everyone,
I’ve setup Pihole with Unbound and everything’s working great so far.
The only thing I’d like to understand better is how to see whether the DNS replies I get were processed with DNSSEC or not?
I tried searching the web for replies but all of them seem to be related to the old web interface version of Pihole.
I’m using docker compose, so I configure my pihole with the environment variables. I saw the following two variables related to DNSSEC:
showDNSSEC

Should FTL analyze and show internally generated DNSSEC queries?

Allowed values are: true or false

Default value: true
dnssec

Validate DNS replies using DNSSEC?

Allowed values are: true or false

Default value: false

The 1st variable where the default is set to TRUE doesn’t seem to give any information in the web interface whether DNSSEC is applied or not. The 2nd variable introduces a visual lock in the web interface where I can see whether DNSSEC was applied or not, but from my understanding, with the 2nd variable passed as TRUE, now Pihole also tries to handle DNSSEC on its own? As Unbound is doing the job already, so I don’t know whether that’s something that I should leave or not.
Thanks a lot in advance.

2

Enabling DNSSEC (dns.dnssec = true) would have Pi-hole send additional DNS requests to authoritative DNS servers that it needs for validating DNS replies.
dns.showDNSSEC controls whether those additional requests would appear in Pi-hole's Query Log.

A validating recursive resolver like unbound would already verify DNS replies via DNSSEC, so when using that as Pi-hole's upstream, there would be no need to also enable DNSSEC in Pi-hole.

If you'd opt to do so nevertheless, you should be aware of unbound already validating replies, so you may want to adjust unbound to provide extra information to Pi-hole about discarded DNS replies.
For additional insights, please refer to Understanding DNSSEC validation using Pi-hole's Query Log.