First DNSSEC failure passed on even with allow-downgrade #10579
Description
systemd version the issue has been seen with
293.300 (systemd/systemd-stable@25d1ba1)
Used distribution
Arch Linux
Expected behaviour you didn't see
In allow-downgrade mode and using a DNS server without DNSSEC support, the query that triggers the downgrade is still ultimately successful.
Unexpected behaviour you saw
$ sudo systemctl restart systemd-resolved
$ resolvectl query encryptedsni.com
encryptedsni.com: resolve call failed: DNSSEC validation failed: failed-auxiliary
$ resolvectl query encryptedsni.com
encryptedsni.com: 104.20.84.157
104.20.0.157
-- Information acquired via protocol DNS in 39.2ms.
-- Data is authenticated: no
Logs:
systemd[1]: Starting Network Name Resolution...
systemd-resolved[30973]: Positive Trust Anchors:
systemd-resolved[30973]: . IN DS 19036 8 2 49aac11d7b6f6446702e54a1607371607a1a41855200fd2ce1cdde32f24e8fb5
systemd-resolved[30973]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
systemd-resolved[30973]: Negative trust anchors: 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.i>
systemd-resolved[30973]: Using system hostname 'papyrus'.
systemd[1]: Started Network Name Resolution.
systemd-resolved[30973]: Using degraded feature set (UDP+EDNS0) for DNS server 192.168.50.14.
systemd-resolved[30973]: DNSSEC validation failed for question com IN SOA: failed-auxiliary
systemd-resolved[30973]: DNSSEC validation failed for question encryptedsni.com IN DS: failed-auxiliary
systemd-resolved[30973]: DNSSEC validation failed for question encryptedsni.com IN AAAA: failed-auxiliary
systemd-resolved[30973]: DNSSEC validation failed for question encryptedsni.com IN SOA: failed-auxiliary
systemd-resolved[30973]: DNSSEC validation failed for question encryptedsni.com IN A: failed-auxiliary
systemd-resolved[30973]: Server 192.168.50.14 does not support DNSSEC, downgrading to non-DNSSEC mode.
systemd-resolved[30973]: Using degraded feature set (UDP) for DNS server 192.168.50.14.
I've also seen:
encryptedsni.com: resolve call failed: 'encryptedsni.com' does not have any RR of the requested type