Public bug reported: Greetings everyone.
I know that recently systemd-resolved switched DNSSEC to off by default. However, there is a "feature set test" function in it. I could see these in my log: 62 May 6 23:27:31 lavender systemd-resolved[1127]: Grace period over, resuming full feature set (UDP+EDNS0+DO+LARGE) for DNS server 10.2.5.7. 63 May 6 23:27:31 lavender systemd-resolved[1127]: Using degraded feature set (UDP) for DNS server 10.2.5.7. It looks like this "feature set test" would repeat after some time. And during the test, it would test DNSSEC again regardless it turned off explicitly, which is the so called "DO" test. I could still sometimes get no DNS, and I caught these log once during that. I can't be sure that this test is connected to my losing DNS, as I only caught it once. I don't know how long the "grace period" is, so can't schedule a trap to catch more. This "DO" test can not be disabled via configuration. There is an upstream patch to deal with it: https://github.com/systemd/systemd/issues/5352 While I'm not sure if it does cause some problem, I'm thinking it might be worth to cherry pick the patch. Additional info about my system: lsb_release -rd: Description: Ubuntu 17.04 Release: 17.04 It's Ubuntu GNOME. Package: systemd Version: 232-21ubuntu3 ** Affects: systemd (Ubuntu) Importance: Undecided Status: New ** Tags: dns dnssec systemd-resolved -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1688757 Title: systemd-resolved would retry DNSSEC after some time. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1688757/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
