Setting in manpage of resolved.conf does not apply

[Daniel von Obernitz]

Hi,

it looks like there is an error in the manpage of resolved.conf.

Ubuntu 20.04.1 LTS

systemd 245.4-4ubuntu3.2

The manpage of resolved.conf says:

DNSSEC=
   ...
   Defaults to "allow-downgrade"

So when I leave the resolved.conf un-edited, the value is

[Resolve]
...
#DNSSEC=no
...

so the default "allow-downgrade" should apply.

But instead DNSSEC is not used at all.

dig sshfp dnsprivacy.org +dnssec

; <<>> DiG 9.16.1-Ubuntu <<>> sshfp dnsprivacy.org +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24171
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

When I set the value hard-coded to "allow-downgrade"

[Resolve]
...
DNSSEC=allow-downgrade
...

the ad flag is shown.

dig sshfp dnsprivacy.org +dnssec

; <<>> DiG 9.16.1-Ubuntu <<>> sshfp dnsprivacy.org +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41701
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

Best regards
Daniel

[Dan Streetman (ddstreet)]

opened Debian MR
https://salsa.debian.org/systemd-team/systemd/-/merge_requests/122

[Daniel von Obernitz (itzonban)]

@Dan

thanks a lot for opening an MR. Until today the manpage has not changed in Ubuntu 20.04 and I guess it won't ever for that LTS version.

But in Ubuntu 22.04 the manpage is correct and corresponds with the default settings.

So for me this issue is solved and could be closed...

Best regards
Daniel