zesty switch from dnsmasq caused lookup errors, DNSSEC validation failed: no-signature

[Chad Miller]

$ systemd-resolve ubuntu.com
ubuntu.com: resolve call failed: DNSSEC validation failed: no-signature

/etc/systemd/resolved.conf
[Resolve]
#DNS=
#FallbackDNS=8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
#Domains=
#LLMNR=yes
#DNSSEC=allow-downgrade
#Cache=yes
#DNSStubListener=udp
---
ApportVersion: 2.20.4-0ubuntu2
Architecture: amd64
CurrentDesktop: GNOME
DistroRelease: Ubuntu 17.04
EcryptfsInUse: Yes
MachineType: System76, Inc Darter UltraThin
Package: systemd 232-18ubuntu1 [origin: unknown]
PackageArchitecture: amd64
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.10.0-9-generic root=UUID=5aa160f9-0a01-4291-8d9d-704469e9a970 ro noapic acpi_backlight=vendor i915.disable_power_well=0
ProcVersionSignature: Ubuntu 4.10.0-9.11-generic 4.10.0
Tags: third-party-packages zesty
Uname: Linux 4.10.0-9-generic x86_64
UnreportableReason: This is not an official Ubuntu package. Please remove any third party package and try again.
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm autopilot cdrom dialout dip lpadmin lxd plugdev sambashare sudo wireshark
_MarkForUpload: True
dmi.bios.date: 10/28/2013
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 4.6.5
dmi.board.asset.tag: Tag 12345
dmi.board.name: Darter UltraThin
dmi.board.vendor: System76, Inc
dmi.board.version: daru4
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 9
dmi.chassis.vendor: System76, Inc
dmi.chassis.version: N/A
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr4.6.5:bd10/28/2013:svnSystem76,Inc:pnDarterUltraThin:pvrdaru4:rvnSystem76,Inc:rnDarterUltraThin:rvrdaru4:cvnSystem76,Inc:ct9:cvrN/A:
dmi.product.name: Darter UltraThin
dmi.product.version: daru4
dmi.sys.vendor: System76, Inc

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Chad Miller (cmiller)]

apport information

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Asa Zernik (asaz989)]

A note on severity - I'm seeing this error or the one in bug #1650877 for every single non-gov domain in the .il root, including google.co.il, all major universities under .ac.il, and every newspaper I can think of under .co.il. Might also indicate some common thread in the DNS roots affected.

[Dan Streetman (ddstreet)]

please reopen if this is still an issue