Hi Nick, As you mentioned in the issue description, "Unable to fetch DNSKEY set '.': failure" is not a fatal error as named is still fully functional.
This is because named comes with the current root zone KSK (key id 20326) compiled in. The error is because it tries to refresh it using RFC5011 mechanism (https://www.rfc-editor.org/rfc/rfc5011.html) but that will be retried so failing to do it on startup isn't a big deal IMHO. Even less worrying since the root zone KSK changes very infrequently. To double check this, I created a Jammy container and provided it with only an IPv6. There, I can see the error message due to named starting before the IPv6 address is configured. However, named has no problem providing resolution once the IPv6 becomes available: root@jammy-bind:~# journalctl -n 8 -u named Mar 23 13:40:36 jammy-bind systemd[1]: Started BIND Domain Name Server. Mar 23 13:40:36 jammy-bind named[120]: network unreachable resolving './NS/IN': 192.112.36.4#53 Mar 23 13:40:36 jammy-bind named[120]: network unreachable resolving './DNSKEY/IN': 192.33.4.12#53 Mar 23 13:40:36 jammy-bind named[120]: managed-keys-zone: Unable to fetch DNSKEY set '.': failure Mar 23 13:40:36 jammy-bind named[120]: network unreachable resolving './NS/IN': 192.33.4.12#53 Mar 23 13:40:36 jammy-bind named[120]: resolver priming query complete Mar 23 13:40:38 jammy-bind named[120]: listening on IPv6 interface eth0, fd42:2192:4f89:5adc:216:3eff:fe19:df84#53 Mar 23 13:40:49 jammy-bind named[120]: resolver priming query complete root@jammy-bind:~# dig +rrcomments +dnssec -t dnskey . @::1 ; <<>> DiG 9.18.0-2ubuntu3-Ubuntu <<>> +rrcomments +dnssec -t dnskey . @::1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63243 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 1232 ; COOKIE: ae8a685e179cfece01000000623b23e881248f1ef945af75 (good) ;; QUESTION SECTION: ;. IN DNSKEY ;; ANSWER SECTION: . 172665 IN DNSKEY 256 3 8 AwEAAak/ZU9wDNQD7XTAGTDkn32UR8I6auRDekbGky+yyWKdUHmwAJv9 0YHCUTib8aVBgNgbxkeeZGRx3W4+XhMZbfUr5fMwmD3u9P2yzJpbRtjG NM/XZvzGs9HHNymz3Bp851anHZfNy6pJud265/XMKzFlAY8sMJjum0hv x/DuCDELLyhsvdfOD9rHM93UXO0bcAjvI8tjZsGI+Pfp9KdxF9vS/sAz pFXKsldix+e6xv8rRS6WPg2LAooxF+eO5DgFSilYmnyCK4VPJ7ntjD/8 m0bs128ZT1eY3oXCbojDv59lLAgrdGSbcVxQF2KHoUHDmkOC5BzG/1xR tW4v/3y4/H8= ; ZSK; alg = RSASHA256 ; key id = 47671 . 172665 IN DNSKEY 256 3 8 AwEAAZym4HCWiTAAl2Mv1izgTyn9sKwgi5eBxpG29bVlefq/r+TGCtmU ElvFyBWHRjvf9mBglIlTBRse22dvzNOI+cYrkjD6LOHuxMoc/d4WtXWK dviNmrtWF2GpjmDOI98gLd4BZ0U/lY847mJP9LypFABZcEn3zM3vce4E e1A3upSlFQ2TFyJSD9HvMnP4XneFexBxV96RpLcy2O+u2W6ChIiDCjlr owPCcU3zXfXxyWy/VKM6TOa8gNf+aKaVkcv/eIh5er8rrsqAi9KT8O5h mhzYLkUOQEXVSRORV0RMt9l3JSwWxT1MebEDvtfBag3uo+mZwWSFlpc9 kuzyWBd72Ec= ; ZSK; alg = RSASHA256 ; key id = 9799 . 172665 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN R1AkUTV74bU= ; KSK; alg = RSASHA256 ; key id = 20326 . 172665 IN RRSIG DNSKEY 8 0 172800 20220412000000 20220322000000 20326 . g2Rjm8rCMXEN7BJezHm7o67VTPmp9ETDJqiTQG9HNK31nAyp8iXGEcux uviojbobzmjuvjI9KSOLQX6QD1C/4lWovapyZQrEl8L5Ja0tP9H720mw y5TYgcsE5wmojjugOLAW+avQ1L62J+dh3wqmuOqS3K7wIzJ6eciOi3cB rlEXJYK5w1b7jM+qf+sOt5xTUQ3YhpmYJK94gPYMBrkLEaWKcU2DP6LT HqeFQviBhUb8hN60kitd92zHt3qfaCIFrbTm3fGdttu7LYlN3OwSlN21 m0/3iuoA9Q4LNimgqhxKEFzKQ/96477E1V9wyjiaxMcp7IL30Ocb8nmQ Ub2FKg== ;; Query time: 0 msec ;; SERVER: ::1#53(::1) (UDP) ;; WHEN: Wed Mar 23 13:43:04 UTC 2022 ;; MSG SIZE rcvd: 1169 Because named works fine despite the annoying failure message, I'd be reluctant to make things more complicated by trying to delay named's startup. Please note that I only tested with Jammy/Ubuntu 22.04 so your mileage may vary on Focal/Ubuntu 20.04. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1965521 Title: named.service starts too early: Unable to fetch DNSKEY set '.': failure To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1965521/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
