DNSSEC Validation Failed

 

I was getting the following error in my browser DNSSEC validation failed for question IN DNSKEY: missing-key

I found out that ICANN scheduled a switch from an old DNS root key to a new one, TODAY. It seems that my Ubuntu 24.04 did not have the new key in place, so it was failing DNSSEC validation.

The fix is to add the new root key to the OS. To get the correct info, go to https://data.iana.org/root-anchors/root-anchors.xml.

Then add the key -

sudo mkdir -p /etc/dnssec-trust-anchors.d

sudo nano /etc/dnssec-trust-anchors.d/root.positive

#  Put these two lines in the file, you can review the values at the link above to make sure they are correct.

. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D

. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16

# Restart the systemd-resolved service

sudo systemctl restart systemd-resolved

That should be it!