[Solved] Latest version breaks no-dnssec validation on local network

Help Community Help
1

The issue I am facing:

I have my pihole configured to selectivly forward queries to my local domain to my upstream dns server / router which until current version skipped dnssec validation for this domain.

The setting in my include file is:

server=/domain.my/192.168.40.1

According to the change log these entries got a rework in dnsmask 2.9.2 and dnssec validation is now done for the domains.

Reading the doc it states I should add an empty trust-anchor for the domain so that it is then again treated as not signed. I tried this with adding

trust-anchor=domain.my

to my config, but it didn't work. So I got back to version 2026.06.0.

The doc is a bit unclear on how this trust-anchor shall be set or looks like in the config.

The query log entry states DNSSEC status: ABANDONED, Reply: NONE

Any help appreciated.

2

Looks like you've done the right thing:

--trust-anchor=<domain>,[<class>,][<key-tag>,<algorithm>,<digest-type>,<digest>]
    Provide DS records to act a trust anchors for DNSSEC validation.
    The class defaults to IN.
    Typically these will be the DS record(s) for Key Signing key(s) (KSK) of the root zone, but trust anchors for limited domains are also possible.
    A negative trust anchor (ie. proof that a DS record doesn't exist) may be configured be specifying only the name or only the name and class.
    This can be useful for forcing dnsmasq to treat zones delegated using --server=/<domain>/<ip-address> as unsigned.
    The current root-zone trust anchors may be downloaded from https://data.iana.org/root-anchors/root-anchors.xml

Above options between square brackets are optional.

But how have you entered those two dnsmasq directives into Pi-hole exactly?
Am asking bc there are two ways of doing so, but one needs a Pi-hole setting to be enabled thats called misc.etc_dnsmasq_d.

$ sudo pihole-FTL --config misc.etc_dnsmasq_d
false
3

Thank you very much
I have managed to get it working properly. :slight_smile:

I have now the following settings in my local.conf in the dnsmasq folder:

# forward non-fqdn queries
server=//192.168.40.1
# forward domain.my and skip DNSSEC validation
trust-anchor=domain.my.
server=/domain.my/192.168.40.1

It all works as expected. My pihole is up and running again. The misc.etc_dnsmasq_d was the hint needed. I added it to the podman env and everything is good.