Learning DNS - DNSSEC: Validation (Recursor)

#Introduction

In episode 13, your zones were signed. Now it's the receiver's turn: the Recursor must verify that those signatures are valid. This is the difference between merely "hoping the answer is right" and "cryptographically proving the answer is right".

Episode 14 covers DNSSEC validation in the Recursor: enabling it, understanding trust anchors from IANA, testing with dig +dnssec, reading the AD flag, and handling difficult situations like unsigned zones or broken signatures.

#Enabling Validation

#dnssec: process Configuration

The Recursor validates when DNSSEC mode is enabled:

dnssec:
  process: true

After restart, the Recursor verifies every answer that passes through it. Setting dnssec.process: true is the single step that turns a regular recursor into a validator.

#Bootstrapping Trust Anchors

To verify, the Recursor needs a trust anchor — a starting point of trust. It fetches them from IANA (https://data.iana.org/root-anchors/) on first install:

rec_control get dnssec
rec_control get root-key-sentinel
journalctl -u pdns-recursor -n 20 --no-pager | grep -i anchor

The logs show the bootstrap process: the Recursor fetches the signed XML from IANA, verifies it, and loads the root KSK. After that, the chain of trust is built from the root down to every zone.

#Testing Validation

#dig +dnssec and the AD Flag

The fastest way to see validation working is the AD (Authenticated Data) flag:

dig @127.0.0.1 example.com A +dnssec +noall +comments
dig @127.0.0.1 cloudflare.com A +dnssec +noall +comments

Watch the flags in the output: if validation succeeds, the ad flag appears. For signed zones, dig +dnssec also shows RRSIG records. When you see ad, that answer's signature chain has been verified from the trust anchor down to the record.

#Checking Failed Validation

Answers that fail validation are marked with status: SERVFAIL, not with fake answers:

dig @127.0.0.1 broken-dnssec.example A +noall +comments

The Recursor refuses to hand out data it can't verify. That's the correct behavior: better a SERVFAIL than spreading answers whose authenticity is in doubt.

#Trust Anchor Management

#Root KSK Rollovers

The root KSK changes rarely, but when it does, every validator in the world must follow. PowerDNS uses RFC 7958 to manage root KSK rollovers: trust anchors are refreshed from IANA periodically, so key transitions happen without manual intervention.

rec_control get root-ksk-update
journalctl -u pdns-recursor -n 30 --no-pager | grep -iE "root|anchor"

#Adding Custom Trust Anchors

For internal infrastructure that signs its own zones, add a custom trust anchor via configuration:

trustanchors:
  - name: internal.example.com
    ds: "example.com. 0 IN DS 12345 13 2 0123456789abcdef..."

With trustanchors, the Recursor can validate internal zones without relying on public publication.

#Handling Problematic Zones

#Unsigned Zones

Most of the internet still isn't signed. For unsigned zones, validation can't be done — the Recursor treats them as insecure: answers are still returned, but without the ad flag. That's normal, and different from a validation failure that produces SERVFAIL.

dig @127.0.0.1 signed-zone.com A +noall +comments
dig @127.0.0.1 unsigned-zone.com A +noall +comments

#Broken Signatures

A zone that should be signed but has broken signatures will produce SERVFAIL. Debug with drill -S or the Recursor logs:

drill -S example.com
journalctl -u pdns-recursor -n 30 --no-pager | grep -iE "validation|dnssec"

drill -S reports where the validation chain breaks. The Recursor logs add detail like mismatched keys or expired signature TTLs.

#Conclusion

Episode 14 closes the DNSSEC loop: your Recursor now validates every answer, bootstraps trust anchors from IANA, marks verified answers with the ad flag, and handles unsigned zones and broken signatures with the correct behavior.

Key takeaways:

• dnssec.process: true enables validation in the Recursor.
• Trust anchors are bootstrapped from IANA and managed automatically per RFC 7958.
• The ad flag marks verified answers; SERVFAIL marks validation failures.
• Unsigned zones are treated as insecure, not errors — only validation failures produce SERVFAIL.
• drill -S and the Recursor logs are your tools for diagnosing broken signatures.
• Custom trust anchors enable validation of self-signed internal zones.

In episode 15, we'll cover encrypted DNS: DoT, DoH, and DoQ — DoT on port 853, DoH on port 443 over HTTP/2, and DoQ over QUIC, their implementation in dnsdist, plus configuring the Recursor for outgoing connections that are encrypted and validate certificates.