systemd-resolved DNSSEC implementation does not protect against cache poisoning

[Petr Menšík]

Steps required are at upstream issue https://github.com/systemd/systemd/issues/25676

Unfortunately it has been reported publicly for 3 years in https://github.com/systemd/systemd/issues/15158, so no embargo makes sense

[Petr Menšík (pihhan)]

Because systemd-resolved is preinstalled not only on desktop, but also server variant, I expect some people may decide to protect their dns cache. Unfortunately it does not tell them it won't work.

[Seth Arnold (seth-arnold)]

Thanks for the report; it's my understanding that "real" DNSSEC deployments at sites that care will do all the DNSSEC enforcement with a local recursor because the application APIs are immature / underspecified / etc.

Such centralization also makes it far easier for the DNS operations team to work around misconfigured DNSSEC systems in the wild by setting Negative Trust Anchors on portions of the DNS tree (as described at https://doc.powerdns.com/recursor/dnssec.html#negative-trust-anchors ) when necessary.

Thanks