DNSSEC validation failed: systemd-resolved not enabled on Rocky Linux 9

Resolving DNSSEC Validation Failures

To enable DNSSEC validation on Rocky Linux 9, you must activate the systemd-resolved service and configure it to enforce validation. By default, this service is often inactive or configured to ignore DNSSEC, which causes applications requiring strict validation to fail.

Implementation Steps

Follow these steps to enable system-wide DNSSEC validation. These commands assume you are operating as root or using sudo.

1. Enable and start the resolver:

   systemctl enable --now systemd-resolved

2. Configure DNSSEC in the configuration file:

   Edit /etc/systemd/resolved.conf and set the DNSSEC parameter. Use yes for strict enforcement or allow-downgrade to allow non-signed zones to resolve while still validating signed ones.

   # In /etc/systemd/resolved.conf
   [Resolve]
   DNSSEC=yes

3. Link the resolver stub:

   For systemd-resolved to handle system queries, /etc/resolv.conf must point to the systemd stub resolver. This prevents NetworkManager from overwriting the configuration with a static file that bypasses DNSSEC.

   ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

4. Restart the service:

   systemctl restart systemd-resolved

Technical Considerations

NetworkManager Interaction: Enabling systemd-resolved does not interfere with NetworkManager's ability to receive DNS settings via DHCP. However, the symbolic link created in step 3 is critical; without it, NetworkManager may manage /etc/resolv.conf directly, causing the system to ignore systemd-resolved's DNSSEC settings.

Trade-offs:

• Security: Strict DNSSEC (yes) prevents DNS spoofing and cache poisoning but will result in a total resolution failure if the upstream DNS provider does not support DNSSEC or if the domain's signatures are expired/invalid.
• Performance: There is a minor increase in latency and CPU overhead due to the cryptographic verification of DNS records.

Verification

Confirm the configuration is active using the following commands:

• Check service status: systemctl status systemd-resolved
• Verify active DNSSEC settings: resolvectl status
• Test a signed domain: dig +dnssec google.com (look for the ad flag in the header, indicating Authenticated Data).

Diagnostic Detail Needed: Are you using a corporate internal DNS or a public provider (e.g., Google, Cloudflare)? If using internal DNS that is not signed, DNSSEC=yes will block all internal resolution.