DNSSEC doesn't work with local-unbound

frankit60 · Friday at 5:25 PM

Why doesn't DNSSEC work with local-unbound?
How do I fix it? Does anyone have an idea?
Thanks in advance
Franco

Code:

#
# cat /var/unbound/forward.conf
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
forward-zone:
    name: .
    forward-addr: 8.8.8.8
    forward-addr: 192.168.1.211
    forward-addr: 1.1.1.1
#
#
# drill -S FreeBSD.org @192.168.1.211
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 55789 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
        |---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
            |---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
            |---org. (DS keytag: 26974 digest type: 2)
                |---. (DNSKEY keytag: 57780 alg: 8 flags: 256)
                    |---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful
#
#
# drill -S FreeBSD.org @192.168.1.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 55789 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
        |---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
            |---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
            |---org. (DS keytag: 26974 digest type: 2)
                |---. (DNSKEY keytag: 57780 alg: 8 flags: 256)
                    |---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful
#
#
# drill -S FreeBSD.org @127.0.0.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 55789 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
;; Chase failed.
#
#

NapoleonWils0n · Friday at 6:22 PM

I made a tutorial on setting up Unbound with dnscrypt proxy and quad 9

dont know if that helps

Thread 'unbound dns server with dnscrypt-proxy and quad9 on Freebsd'

May 24, 2026

Setting up the unbound dns server with dnscrypt-proxty and quad9 dns resolver on Freebsd

Quad9 is a free service that replaces your default ISP or enterprise Domain Name Server (DNS) configuration.

Quad9 blocks lookups of malicious host names from an up-to-the-minute list of threats. The Quad9 DNS serviceis operated by the Swiss-based Quad9 Foundation, whose mission is to provide a safer and more robust Internet for everyone.

I also cover setting up a split openvpn route using fibs that allows you to send command line or gui application over the vpn or your regular...

blackbird9 · Saturday at 9:56 PM

I get the same result with local-ubound, using cloudflare.

# cat /var/unbound/forward.conf
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
forward-zone:
name: .
forward-tls-upstream: yes
forward-addr: 1.1.1.1@853#cloudflare-dns.com
forward-addr: 1.0.0.1@853#cloudflare-dns.com

Now, Cloudflare's browser security check here https://www.cloudflare.com/ssl/encrypted-sni/ passes:-

Which gives me an initial impression that DNSSEC is working. DoH is off in the firefox settings.

However, using two similar drill commands gives me the same result as the OP.

# drill -S FreeBSD.org @1.1.1.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
|---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
|---freebsd.org. (DS keytag: 33175 digest type: 2)
|---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
|---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
|---org. (DS keytag: 26974 digest type: 2)
|---. (DNSKEY keytag: 8763 alg: 8 flags: 256)
|---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful

So, server 1.1.1.1 passes the dnssec chase.

# drill -S FreeBSD.org @127.0.0.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
|---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
|---freebsd.org. (DS keytag: 33175 digest type: 2)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
;; Chase failed.

But the chase fails using local-unbound, listening on loopback.

I don't know enough about the significance of this finding to comment further, but I get the same result.

blackbird9 · Saturday at 10:06 PM

Another thing I noticed. From this page https://developers.cloudflare.com/dns/dnssec/troubleshooting/

# dig www.cloudflare.com +dnssec

; <<>> DiG 9.20.29 <<>> www.cloudflare.com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5125
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.cloudflare.com. IN A

;; ANSWER SECTION:
www.cloudflare.com. 149 IN A 104.16.123.96
www.cloudflare.com. 149 IN A 104.16.124.96
www.cloudflare.com. 149 IN RRSIG A 13 3 300 20261004215848 20261002195848 34505 www.cloudflare.com. ADQmNmogzjHKtNr3a+rxV699pnlyFvCiYs/1u+j9SfFcHVxEZozfNE+X P03fVHn1R9PgFJArd1xKCSa7JwdWag==

;; Query time: 97 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sat Oct 03 22:01:20 BST 2026
;; MSG SIZE rcvd: 193

I get an RRSIG section in the response, and the 'ad' flag is set - meaning 'authenticated data'.

However, if I use any other name (than 'www.cloudflare.com') I do NOT get the RRSIG section and the 'ad' flag is not set.
For example, yahoo.com gives me

# dig www.yahoo.com +dnssec

; <<>> DiG 9.20.29 <<>> www.yahoo.com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1867
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.yahoo.com. IN A

;; ANSWER SECTION:
www.yahoo.com. 58 IN CNAME me-ycpi-cf-www.g06.yahoodns.net.
me-ycpi-cf-www.g06.yahoodns.net. 37 IN A 87.248.114.12
me-ycpi-cf-www.g06.yahoodns.net. 37 IN A 87.248.114.11

;; Query time: 132 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sat Oct 03 22:03:24 BST 2026
;; MSG SIZE rcvd: 119
So the answer section contains no RRSIG section, and the 'ad' flag is not set, ie this is not 'authenticated data'.

In this case, that is a name other than 'www.cloudflare.com', I observe the same behaviour with both 1.1.1.1 and loopback specified as the dns server.

Is this significant? Does this mean that only the IP address returned for the name 'cloudflare.com' is authenticated and the rest are not? Which doesn't seem to make any sense.

frankit60 · Sunday at 6:48 AM

I wasn't familiar with Quad9 (thanks, NapoleonWilsOn). I found these instructions—https://docs.quad9.net/Setup_Guides/Linux_and_BSD/FreeBSD_(Encrypted)/—and followed them. Their test returns "OK"( dot. ), but drill -S FreeBSD.org @127.0.0.1 consistently returns ;; Chase failed. Perhaps it’s a non-issue?

blackbird9 · Sunday at 8:36 AM

Possibly. My understanding of secure DNS is somewhat limited. It's a bit discocerting that the responses I get back from the cloudflare server only set the 'authenticated data' flag for the name www.cloudflare.com and not for anything else though, that does not seem right to me. I'm going to try the same tests on linux that I also have secure DNS set up on, using systemd, as a sanity check, and see if there is any difference. On the face of it the cloudflare test website seems to be saying that everything is working correctly on freebsd using local-unbound. We need someone who understands secure DNS better than me to say what is going on!

frankit60 · Sunday at 9:03 AM

It works now!!!

Code:

# drill -aDSV4 FreeBSD.org A IN @127.0.0.1
;; Number of trusted keys: 2
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 19115
;; flags: qr rd cd ra ad ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; FreeBSD.org.    IN    A

;; ANSWER SECTION:
FreeBSD.org.    3600    IN    A    96.47.72.84
FreeBSD.org.    3600    IN    RRSIG    A 8 2 3600 20261017122343 20261003012909 849 freebsd.org. T1cywu2bxE3vOCxu6BqGXiAnS9Xcfq9JNeJHOZa4jDn0DCMRry1tGg51GmM7ZWU1qldwDjJpcgKDhRjshuHIQTgjQCrnNkUGCYcueTWBYCHWwmp1pOom88lE6lI2/R2vPkplXMqOk2vVGBxs0nUvHh4tNqAxlFgHn+h9hRfnpOEwFZh+iEuwH5BoAOzE+KzqarHfXNkFRwtu3JK+7/MpC4s6CPCWvgemQ8GjvmjyJH3m2pEbZ3nWVX5yH4TQU0+VJPuCSuYnUqzPlLEHW/IGv18XGVqG1nDnpIsuVJ6KilN6sDaP3JThodDXMgP0KgeOmgjMg75HgGLyil/b16NqdQ==

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 44 msec
;; EDNS: version 0; flags: do ; udp: 1232
;; SERVER: 127.0.0.1
;; WHEN: Sun Oct  4 09:54:28 2026
;; MSG SIZE  rcvd: 355
;; Chasing: freebsd.org. A

DNSSEC Data Chain:
;; rcode: NOERROR
;; qtype: DNSKEY
rrset:
.    16388    IN    DNSKEY    257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b}
.    16388    IN    DNSKEY    256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdzf4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3XcyYQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tENa3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxPCNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ;{id = 57780 (zsk), size = 2048b}
.    16388    IN    DNSKEY    257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
.    16388    IN    DNSKEY    256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOnywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXfnJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek= ;{id = 8763 (zsk), size = 2048b}
sigs:
.    16388    IN    RRSIG    DNSKEY 8 0 172800 20261022000000 20261001000000 20326 . ARGOmBDyLkr5oQdR5OaIeoeBti1KWEX/LY/jZlRRXwF0f0eRZaljFpyVKFuZMzpafSYVs7eLOYjVyWJ3iENn4AEhvX9iaKmWu3XpSSV0D6bhv5D6bk4GVPJ7NGTnA2lr4fC9lq9UD1kK1Q3jYJsxZSoQgjExDBfzwQUw1eYLLPPi7TQf+zA1wakHy2mkWnX1+bKDyrQ/p5ra4fgo/Pu7F47FXqRZEJ+K9o/TwA+nJn3RMS6dPaS46ERBSWHIeJAzQvNQELI4pAbdVp3d3N33R2C5MxX6kUzNku8CtyXGYukSi9LK9GT3nrH9O97tDADq01z78aPnjl+6hLTgMkiupw==
---
;; rcode: NOERROR
;; qtype: DS
rrset:
org.    21637    IN    DS    26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32
sigs:
org.    21637    IN    RRSIG    DS 8 1 86400 20261016170000 20261003160000 8763 . r77xoF3vFqyhD846BK4RPq5cNcgPzgQcBlKucwZ1DAjVCMWlb2nOFBOymIf6cAZts1leOJ+36+FaDQSoCWKHOLbT1xsyg2d+/wvgnM1F6JnaOxQO7hIcfjqygSZw3kMqGpMVT2sMiNXqhPFIp8g0rPqGV7wDQJ/wYWAiqi7qqQoIaBBvLcJIwJmi5zy3MODmwVl6nIHQc98/OB9wEBdaygAVicO4wJYYJVLHhTaPoV8gjin5oCfDL7SOkl1Su8qV+elkXMipOVDROZFFxOcRBp/0KwyNkCD9S2nQZgAdeJVpmonJdbX7EyI40ivKq78JUNRTF+git7MMOyp0qlEqTA==
---
;; rcode: NOERROR
;; qtype: DNSKEY
rrset:
org.    1987    IN    DNSKEY    257 3 8 AwEAAZz9f/tpl0utB33T6vZ6ReZ13c5OLWJIna/GqJFKYvw0JSCDLqf9zGXOOstWdzuEgpiubfPh3gMi2xMRIv8qMnk6Xio57uxLRcM6mNV4QWqH4eczCd/TGj+IsucFs4+FEPQ0LwcNR/X4xzkZZjwcfFPeZafHFbKB4Nc7aYHeTs8mbTXuYUcJIDNS2JlqlrDM1qAfVUxR0/GyE/is68igxwR0MswrBF1d2YMYGElmK5EktwPYzwCmptQBa/A+HMcp9FM4Xug/NoLZbffbGTLGnMw0PHZX//8h0Cho2p8GvGVzXARBOmzTkmdgxz2yRIQOOuL6MyQZKUv8/h+AZ5Xudbs= ;{id = 725 (ksk), size = 2048b}
org.    1987    IN    DNSKEY    256 3 8 AwEAAb9DfM5jwCx0XxAfjywbkNuRiTXfIjQzDEPnwhheRXxKOg/VVDB924kl7VL14VPlzPap2jb4Cc0G6k4VxUnUKIfLb3GtmREe/Y3Pbi6v+EkQHyznlNQ7EBCEEhlC5PMeMJmian3JsZ8+hMNwbyinHUXTrwPMdp+npv1FI2a8k815 ;{id = 11859 (zsk), size = 1024b}
org.    1987    IN    DNSKEY    257 3 8 AwEAAexZJ/1wfyNCxNPrTZizaG7UlibGhP+AyogR6bqjptKweEgE4gD8GxRQJkt+Fn5pCoNqzmm1ZnEoKqvm93uOYtbKkYQDGH+W69J66MSKpgIyS+mT/4iaXn+lpb5o99l/sf7lHMa975O/fqN6aPUll4hUbN2T1LHv6HzQuQCtNRJA8jHGwX5q0NMmh2Z+yaG6B9cISerje9l5L+ID2ydJ6zXquYteoIUvX2xzqnXCdHPSvD+oL6R/weW+tztdFS1hok/1z3tn5NzmcaOLll9nXniCozEpLFEGPswyvtphWgCYhI8bBTqhUsIwfIwLSBQTEg2oCX7sS5CbXg44OqwhIW8= ;{id = 26974 (ksk), size = 2048b}
org.    1987    IN    DNSKEY    256 3 8 AwEAAbGCRlMxb1wffcDpATrGNnTTj+HttrvOWlaSZJlX+PGUtlg1vB9NqeMPBh6ysAEtz2bng8MbWjfmEnKtAQ3u2961s2ZzPeBRfC5b8dAeqaOinX3xqxHd6Bg9LODThq8vcSpXngr9Nvyw3ZAezS/9CSKAMdjXRegf4iYini51Vjxf ;{id = 25488 (zsk), size = 1024b}
org.    1987    IN    DNSKEY    256 3 8 AwEAAee4S2PCWpylWfP/Nc9VvG5qZMrXfuA8rAl0gOjuxv6jqmZk+mO0RDw/ONmMOIGDWQHp6dESj/3MoZXZt4V2eyLRgbSX5BAlDAShuhp6lGStcWRPes9egk9s84/ONCLwMp8CL3D5nyZcNn6g+ZQBrENsqyWEzw+kfwjE9lpGesEL ;{id = 24060 (zsk), size = 1024b}
sigs:
org.    1987    IN    RRSIG    DNSKEY 8 1 3600 20261022153600 20261001143600 26974 org. bLhZZU8w8/nXq8GhIXrsHLVZBlyqh4p4xp6oVzKA0z4pgI27m6ZugL2RSVQ/QcMs8nzIoW8M7votSPcwPHbybLDAmkaqj+nZIuEG11C2/KmWljwCznHRRGBzQ+5earaV1zBGp0MTOdl9cUvWIpDKZunyXG/OZGw6rj6ghWp/Ykt2PEWEMzHZkTNbY59J1LQn2/sSiddAd2Bz9zIM0+utEzImz498WD5qwpdVKVfgZzpAYD3MJFqkuBqze9ZHzWki4BrsEa63qPWdlYzW739kI6Suv7OfNb95sXvy7gjkokzHCcDI4rlFQjZg34PWK/fO8blsKHu2AMTwfblheZWsaA==
---
;; rcode: NOERROR
;; qtype: DS
rrset:
freebsd.org.    981    IN    DS    33175 8 2 bcfe5919c2e253efd990c2e3bc88a45bea9f4474821d193b2d7272a6951b01af
sigs:
freebsd.org.    981    IN    RRSIG    DS 8 2 3600 20261022153600 20261001143600 25488 org. E5zK+2JJDWPU2lUDpSsTipzjjt5BfqU/vavo6uYevWWvLFueAIwkm7S2qg5PElJuc1TP0UUXzTHzGjSgyoBQ2z4d30ld+3Ij9GMHrVvTnZNT6fUu/T1qm01L6hK80nqU0nLra/zCPpwNiRM6Ci4k4vPw9y0r5lZRvnBo9j+A4G4=
---
;; rcode: NOERROR
;; qtype: DNSKEY
rrset:
freebsd.org.    139    IN    DNSKEY    256 3 8 AwEAAbNaWhs/e7ZoRNHOEi6Nur+mkIJ1KRntVKGuCAcZhzqItOlTKhHDJgcitKQmpsUVF7x4te0tq2xPYEPGyj/AiJw4zjViXZIpn+Win7ZfQky3dNHfZj1bQE/VfBX/2lrvF8PGQ9k5C8y4KBuoRFNDOnQJOFGHqoiaUSWWkHgc7OK4poURcJeagGuK8l+1ul0Bi0vdUmvyXHuzYOOOKsoEvWGitsQXSsAT2QgQUm/86BhTpoCABRWdkbeeH9GUC6G82hDv1Tn2i/hSqlUxXO7q4QgeotBqjCyjw684jJ4iKNQP921EmvYHBh5TPVS2bwLYEi+1Q+oySzBkMjT6Q4dN20M= ;{id = 849 (zsk), size = 2048b}
freebsd.org.    139    IN    DNSKEY    257 3 8 AwEAAfedw9nowG/FsRSN08lfvhwQm7zwAx8FYLQrrmPn+tvP6AL/bU0ljy8FnatilBTyXcKj1gx++VxLIZ3/XfY+TdzLGT1tAL3YI0L5FbtzK/e1aDDgiMR+dDjGcMrsAfNfPubQvquvBXs5ObNaRCQR8K1gpSA8T30fWfk16H+gDwDj/0vHGb3YiTwhC7oio4oehs6WPaKiz/604C2U71dQ3zEsW/ZemACXCEbPij1F0kXVGMk25Hl9bQ7ISTANFEZq0EXNdr4cXxeZTPl9AVXTvIoDKpkOAcvVgWXleYsQv/hq+5T4/VAG5GXQeE5QdhiEG+eyzfUv3ZqReot0r22II6c= ;{id = 33175 (ksk), size = 2048b}
freebsd.org.    139    IN    DNSKEY    256 3 8 AwEAAZW7JsGtDvqLNL3gip80L9qRbMgsljFJZZcW2jxoDkpT0xuVpEZiB0fZERgJ+i/HycjZRbHI9t1UMVrUVWIhCBf28Uk3JQUmXhco4f6CtG2cP4PRbAcHcTUL5UWcOlfZGs4fluyHflJQiSWqZwnjQynk0StulPyvuqqGmPnW6yeM6zdS4P9OQH4vXpMW3hBWU5IJQHTLd19uY7AqjVUDTUZQ76jrANFSIDM3wB/UYQlRf09WNNXfW5Ic+5UIWZEFFN5N2nP9o9lH2+Ht7X2t/ZT5ABRvtWSRx78MkqQtlVzboTA9RdEn4zi7yiO5i2qvGz361RCvgxeT+lVul78dWR8= ;{id = 55789 (zsk), size = 2048b}
sigs:
freebsd.org.    139    IN    RRSIG    DNSKEY 8 2 3600 20261016091146 20261001202500 33175 freebsd.org. StryvOjPWEOwdsDmnW9lgGVxrSLBjKywlbef5bMWmHQu0y+OwL83jj89XXWoG/UCdbvAefI9/DP9kN2boCPhS163fxLr7bde1uNxPjy+nMGzwCYLBjD+D7TWEnpYzkkhlj7vqpAw1Q8Csrxw3kbY0SiFoPky2NPZKbNEaFqUvZco/ktsuLqgEKH4M6Nbz0spiDo2mmS6UHxFr4t7pHPkFZ3K/1xGj/tFcxNxv7HIjHu+66LSCfywwmP3prfRwYQEHDzzeabtakPKjliyXBgtCMlR8sy7JCLR7RCgxn0JDRBn/35bqGM8CDEpm1fldCnyqx/pEAxPVZZCdgiTPo9dLQ==
---
;; rcode: NOERROR
rrset:
FreeBSD.org.    3600    IN    A    96.47.72.84
sigs:
FreeBSD.org.    3600    IN    RRSIG    A 8 2 3600 20261017122343 20261003012909 849 freebsd.org. T1cywu2bxE3vOCxu6BqGXiAnS9Xcfq9JNeJHOZa4jDn0DCMRry1tGg51GmM7ZWU1qldwDjJpcgKDhRjshuHIQTgjQCrnNkUGCYcueTWBYCHWwmp1pOom88lE6lI2/R2vPkplXMqOk2vVGBxs0nUvHh4tNqAxlFgHn+h9hRfnpOEwFZh+iEuwH5BoAOzE+KzqarHfXNkFRwtu3JK+7/MpC4s6CPCWvgemQ8GjvmjyJH3m2pEbZ3nWVX5yH4TQU0+VJPuCSuYnUqzPlLEHW/IGv18XGVqG1nDnpIsuVJ6KilN6sDaP3JThodDXMgP0KgeOmgjMg75HgGLyil/b16NqdQ==
---

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
        |---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
            |---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
            |---org. (DS keytag: 26974 digest type: 2)
                |---. (DNSKEY keytag: 8763 alg: 8 flags: 256)
                    |---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful

# cat /var/unbound/forward.conf
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
forward-zone:
    name: .
        forward-addr: 1.1.1.1
        forward-addr: 9.9.9.9
        forward-addr: 8.8.8.8
#

frankit60 · Sunday at 9:08 AM

frankit60 said:

It works now!!!

Code:

# drill -aDSV4 FreeBSD.org A IN @127.0.0.1
;; Number of trusted keys: 2
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 19115
;; flags: qr rd cd ra ad ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; FreeBSD.org.    IN    A

;; ANSWER SECTION:
FreeBSD.org.    3600    IN    A    96.47.72.84
FreeBSD.org.    3600    IN    RRSIG    A 8 2 3600 20261017122343 20261003012909 849 freebsd.org. T1cywu2bxE3vOCxu6BqGXiAnS9Xcfq9JNeJHOZa4jDn0DCMRry1tGg51GmM7ZWU1qldwDjJpcgKDhRjshuHIQTgjQCrnNkUGCYcueTWBYCHWwmp1pOom88lE6lI2/R2vPkplXMqOk2vVGBxs0nUvHh4tNqAxlFgHn+h9hRfnpOEwFZh+iEuwH5BoAOzE+KzqarHfXNkFRwtu3JK+7/MpC4s6CPCWvgemQ8GjvmjyJH3m2pEbZ3nWVX5yH4TQU0+VJPuCSuYnUqzPlLEHW/IGv18XGVqG1nDnpIsuVJ6KilN6sDaP3JThodDXMgP0KgeOmgjMg75HgGLyil/b16NqdQ==

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 44 msec
;; EDNS: version 0; flags: do ; udp: 1232
;; SERVER: 127.0.0.1
;; WHEN: Sun Oct  4 09:54:28 2026
;; MSG SIZE  rcvd: 355
;; Chasing: freebsd.org. A

DNSSEC Data Chain:
;; rcode: NOERROR
;; qtype: DNSKEY
rrset:
.    16388    IN    DNSKEY    257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b}
.    16388    IN    DNSKEY    256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdzf4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3XcyYQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tENa3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxPCNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ;{id = 57780 (zsk), size = 2048b}
.    16388    IN    DNSKEY    257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
.    16388    IN    DNSKEY    256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOnywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXfnJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek= ;{id = 8763 (zsk), size = 2048b}
sigs:
.    16388    IN    RRSIG    DNSKEY 8 0 172800 20261022000000 20261001000000 20326 . ARGOmBDyLkr5oQdR5OaIeoeBti1KWEX/LY/jZlRRXwF0f0eRZaljFpyVKFuZMzpafSYVs7eLOYjVyWJ3iENn4AEhvX9iaKmWu3XpSSV0D6bhv5D6bk4GVPJ7NGTnA2lr4fC9lq9UD1kK1Q3jYJsxZSoQgjExDBfzwQUw1eYLLPPi7TQf+zA1wakHy2mkWnX1+bKDyrQ/p5ra4fgo/Pu7F47FXqRZEJ+K9o/TwA+nJn3RMS6dPaS46ERBSWHIeJAzQvNQELI4pAbdVp3d3N33R2C5MxX6kUzNku8CtyXGYukSi9LK9GT3nrH9O97tDADq01z78aPnjl+6hLTgMkiupw==
---
;; rcode: NOERROR
;; qtype: DS
rrset:
org.    21637    IN    DS    26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32
sigs:
org.    21637    IN    RRSIG    DS 8 1 86400 20261016170000 20261003160000 8763 . r77xoF3vFqyhD846BK4RPq5cNcgPzgQcBlKucwZ1DAjVCMWlb2nOFBOymIf6cAZts1leOJ+36+FaDQSoCWKHOLbT1xsyg2d+/wvgnM1F6JnaOxQO7hIcfjqygSZw3kMqGpMVT2sMiNXqhPFIp8g0rPqGV7wDQJ/wYWAiqi7qqQoIaBBvLcJIwJmi5zy3MODmwVl6nIHQc98/OB9wEBdaygAVicO4wJYYJVLHhTaPoV8gjin5oCfDL7SOkl1Su8qV+elkXMipOVDROZFFxOcRBp/0KwyNkCD9S2nQZgAdeJVpmonJdbX7EyI40ivKq78JUNRTF+git7MMOyp0qlEqTA==
---
;; rcode: NOERROR
;; qtype: DNSKEY
rrset:
org.    1987    IN    DNSKEY    257 3 8 AwEAAZz9f/tpl0utB33T6vZ6ReZ13c5OLWJIna/GqJFKYvw0JSCDLqf9zGXOOstWdzuEgpiubfPh3gMi2xMRIv8qMnk6Xio57uxLRcM6mNV4QWqH4eczCd/TGj+IsucFs4+FEPQ0LwcNR/X4xzkZZjwcfFPeZafHFbKB4Nc7aYHeTs8mbTXuYUcJIDNS2JlqlrDM1qAfVUxR0/GyE/is68igxwR0MswrBF1d2YMYGElmK5EktwPYzwCmptQBa/A+HMcp9FM4Xug/NoLZbffbGTLGnMw0PHZX//8h0Cho2p8GvGVzXARBOmzTkmdgxz2yRIQOOuL6MyQZKUv8/h+AZ5Xudbs= ;{id = 725 (ksk), size = 2048b}
org.    1987    IN    DNSKEY    256 3 8 AwEAAb9DfM5jwCx0XxAfjywbkNuRiTXfIjQzDEPnwhheRXxKOg/VVDB924kl7VL14VPlzPap2jb4Cc0G6k4VxUnUKIfLb3GtmREe/Y3Pbi6v+EkQHyznlNQ7EBCEEhlC5PMeMJmian3JsZ8+hMNwbyinHUXTrwPMdp+npv1FI2a8k815 ;{id = 11859 (zsk), size = 1024b}
org.    1987    IN    DNSKEY    257 3 8 AwEAAexZJ/1wfyNCxNPrTZizaG7UlibGhP+AyogR6bqjptKweEgE4gD8GxRQJkt+Fn5pCoNqzmm1ZnEoKqvm93uOYtbKkYQDGH+W69J66MSKpgIyS+mT/4iaXn+lpb5o99l/sf7lHMa975O/fqN6aPUll4hUbN2T1LHv6HzQuQCtNRJA8jHGwX5q0NMmh2Z+yaG6B9cISerje9l5L+ID2ydJ6zXquYteoIUvX2xzqnXCdHPSvD+oL6R/weW+tztdFS1hok/1z3tn5NzmcaOLll9nXniCozEpLFEGPswyvtphWgCYhI8bBTqhUsIwfIwLSBQTEg2oCX7sS5CbXg44OqwhIW8= ;{id = 26974 (ksk), size = 2048b}
org.    1987    IN    DNSKEY    256 3 8 AwEAAbGCRlMxb1wffcDpATrGNnTTj+HttrvOWlaSZJlX+PGUtlg1vB9NqeMPBh6ysAEtz2bng8MbWjfmEnKtAQ3u2961s2ZzPeBRfC5b8dAeqaOinX3xqxHd6Bg9LODThq8vcSpXngr9Nvyw3ZAezS/9CSKAMdjXRegf4iYini51Vjxf ;{id = 25488 (zsk), size = 1024b}
org.    1987    IN    DNSKEY    256 3 8 AwEAAee4S2PCWpylWfP/Nc9VvG5qZMrXfuA8rAl0gOjuxv6jqmZk+mO0RDw/ONmMOIGDWQHp6dESj/3MoZXZt4V2eyLRgbSX5BAlDAShuhp6lGStcWRPes9egk9s84/ONCLwMp8CL3D5nyZcNn6g+ZQBrENsqyWEzw+kfwjE9lpGesEL ;{id = 24060 (zsk), size = 1024b}
sigs:
org.    1987    IN    RRSIG    DNSKEY 8 1 3600 20261022153600 20261001143600 26974 org. bLhZZU8w8/nXq8GhIXrsHLVZBlyqh4p4xp6oVzKA0z4pgI27m6ZugL2RSVQ/QcMs8nzIoW8M7votSPcwPHbybLDAmkaqj+nZIuEG11C2/KmWljwCznHRRGBzQ+5earaV1zBGp0MTOdl9cUvWIpDKZunyXG/OZGw6rj6ghWp/Ykt2PEWEMzHZkTNbY59J1LQn2/sSiddAd2Bz9zIM0+utEzImz498WD5qwpdVKVfgZzpAYD3MJFqkuBqze9ZHzWki4BrsEa63qPWdlYzW739kI6Suv7OfNb95sXvy7gjkokzHCcDI4rlFQjZg34PWK/fO8blsKHu2AMTwfblheZWsaA==
---
;; rcode: NOERROR
;; qtype: DS
rrset:
freebsd.org.    981    IN    DS    33175 8 2 bcfe5919c2e253efd990c2e3bc88a45bea9f4474821d193b2d7272a6951b01af
sigs:
freebsd.org.    981    IN    RRSIG    DS 8 2 3600 20261022153600 20261001143600 25488 org. E5zK+2JJDWPU2lUDpSsTipzjjt5BfqU/vavo6uYevWWvLFueAIwkm7S2qg5PElJuc1TP0UUXzTHzGjSgyoBQ2z4d30ld+3Ij9GMHrVvTnZNT6fUu/T1qm01L6hK80nqU0nLra/zCPpwNiRM6Ci4k4vPw9y0r5lZRvnBo9j+A4G4=
---
;; rcode: NOERROR
;; qtype: DNSKEY
rrset:
freebsd.org.    139    IN    DNSKEY    256 3 8 AwEAAbNaWhs/e7ZoRNHOEi6Nur+mkIJ1KRntVKGuCAcZhzqItOlTKhHDJgcitKQmpsUVF7x4te0tq2xPYEPGyj/AiJw4zjViXZIpn+Win7ZfQky3dNHfZj1bQE/VfBX/2lrvF8PGQ9k5C8y4KBuoRFNDOnQJOFGHqoiaUSWWkHgc7OK4poURcJeagGuK8l+1ul0Bi0vdUmvyXHuzYOOOKsoEvWGitsQXSsAT2QgQUm/86BhTpoCABRWdkbeeH9GUC6G82hDv1Tn2i/hSqlUxXO7q4QgeotBqjCyjw684jJ4iKNQP921EmvYHBh5TPVS2bwLYEi+1Q+oySzBkMjT6Q4dN20M= ;{id = 849 (zsk), size = 2048b}
freebsd.org.    139    IN    DNSKEY    257 3 8 AwEAAfedw9nowG/FsRSN08lfvhwQm7zwAx8FYLQrrmPn+tvP6AL/bU0ljy8FnatilBTyXcKj1gx++VxLIZ3/XfY+TdzLGT1tAL3YI0L5FbtzK/e1aDDgiMR+dDjGcMrsAfNfPubQvquvBXs5ObNaRCQR8K1gpSA8T30fWfk16H+gDwDj/0vHGb3YiTwhC7oio4oehs6WPaKiz/604C2U71dQ3zEsW/ZemACXCEbPij1F0kXVGMk25Hl9bQ7ISTANFEZq0EXNdr4cXxeZTPl9AVXTvIoDKpkOAcvVgWXleYsQv/hq+5T4/VAG5GXQeE5QdhiEG+eyzfUv3ZqReot0r22II6c= ;{id = 33175 (ksk), size = 2048b}
freebsd.org.    139    IN    DNSKEY    256 3 8 AwEAAZW7JsGtDvqLNL3gip80L9qRbMgsljFJZZcW2jxoDkpT0xuVpEZiB0fZERgJ+i/HycjZRbHI9t1UMVrUVWIhCBf28Uk3JQUmXhco4f6CtG2cP4PRbAcHcTUL5UWcOlfZGs4fluyHflJQiSWqZwnjQynk0StulPyvuqqGmPnW6yeM6zdS4P9OQH4vXpMW3hBWU5IJQHTLd19uY7AqjVUDTUZQ76jrANFSIDM3wB/UYQlRf09WNNXfW5Ic+5UIWZEFFN5N2nP9o9lH2+Ht7X2t/ZT5ABRvtWSRx78MkqQtlVzboTA9RdEn4zi7yiO5i2qvGz361RCvgxeT+lVul78dWR8= ;{id = 55789 (zsk), size = 2048b}
sigs:
freebsd.org.    139    IN    RRSIG    DNSKEY 8 2 3600 20261016091146 20261001202500 33175 freebsd.org. StryvOjPWEOwdsDmnW9lgGVxrSLBjKywlbef5bMWmHQu0y+OwL83jj89XXWoG/UCdbvAefI9/DP9kN2boCPhS163fxLr7bde1uNxPjy+nMGzwCYLBjD+D7TWEnpYzkkhlj7vqpAw1Q8Csrxw3kbY0SiFoPky2NPZKbNEaFqUvZco/ktsuLqgEKH4M6Nbz0spiDo2mmS6UHxFr4t7pHPkFZ3K/1xGj/tFcxNxv7HIjHu+66LSCfywwmP3prfRwYQEHDzzeabtakPKjliyXBgtCMlR8sy7JCLR7RCgxn0JDRBn/35bqGM8CDEpm1fldCnyqx/pEAxPVZZCdgiTPo9dLQ==
---
;; rcode: NOERROR
rrset:
FreeBSD.org.    3600    IN    A    96.47.72.84
sigs:
FreeBSD.org.    3600    IN    RRSIG    A 8 2 3600 20261017122343 20261003012909 849 freebsd.org. T1cywu2bxE3vOCxu6BqGXiAnS9Xcfq9JNeJHOZa4jDn0DCMRry1tGg51GmM7ZWU1qldwDjJpcgKDhRjshuHIQTgjQCrnNkUGCYcueTWBYCHWwmp1pOom88lE6lI2/R2vPkplXMqOk2vVGBxs0nUvHh4tNqAxlFgHn+h9hRfnpOEwFZh+iEuwH5BoAOzE+KzqarHfXNkFRwtu3JK+7/MpC4s6CPCWvgemQ8GjvmjyJH3m2pEbZ3nWVX5yH4TQU0+VJPuCSuYnUqzPlLEHW/IGv18XGVqG1nDnpIsuVJ6KilN6sDaP3JThodDXMgP0KgeOmgjMg75HgGLyil/b16NqdQ==
---

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
        |---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
            |---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
            |---org. (DS keytag: 26974 digest type: 2)
                |---. (DNSKEY keytag: 8763 alg: 8 flags: 256)
                    |---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful

# cat /var/unbound/forward.conf
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
forward-zone:
    name: .
        forward-addr: 1.1.1.1
        forward-addr: 9.9.9.9
        forward-addr: 8.8.8.8
#

but

Code:

# drill -S FreeBSD.org A IN @127.0.0.1

;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
;; Chase failed.
#

At this point, I think the problem lies in how the query is set up. But I'm a beginner in this area.

frankit60 · Sunday at 9:14 AM

from man drill

Code:

-a     Use the resolver structure's fallback mechanism if the answer is
             truncated (TC=1). If a truncated packet is received and this
            option is set, drill will first send a new query with EDNS0 buffer
            size 4096.

            If the EDNS0 buffer size was already set to 512+ bytes, or the
            above retry also results in a truncated answer, the resolver
            structure will fall back to TCP.

I think this is the reason.

blackbird9 · Sunday at 9:45 AM

I performed the same dig tests on a linux box running systemd-resolvd, as a sanity check with completely different resolver software, there is no unbound running on this system. I have it configured to use cloudflare again. The cloudflare website passes all four tests.

I get a slightly different response. On the linux box, the 'ad' flag is never set, even for the name 'www.cloudflare.com'. So I NEVER see the 'ad' flag set in the responses on linux.

Some reading, from https://networkingtoolbox.net/diagnostics/dns/dnssec-adflag

"The AD (Authenticated Data) Flag
The AD bit in DNS responses indicates that the resolver has successfully validated the response using DNSSEC. When set, you can trust the response hasn't been tampered with."

Which sounds like the response can only be trusted when the AD flag is set.

Interpreting Results

AD Set: Response is cryptographically verified
AD Not Set: Domain unsigned, validation failed, or resolver doesn't validate
CD Set: Validation was disabled for this query
SERVFAIL: May indicate DNSSEC validation failure

I don't see AD or CD set on linux.

On freebsd with local-unbound, I only saw AD set when the name queried was 'www.cloudflare.com', and not otherwise, which sounds like a bug to me.

On both systems I see the 'qr', 'rd' and 'ra' flags are set in the responses.

blackbird9 · Sunday at 9:47 AM

I get the same result from
$ drill -aDSV4 FreeBSD.org A IN @127.0.0.1
- chase successful

blackbird9 · Sunday at 9:50 AM

The rules around the use of the AD flag appear to be rather complex.

RFC 3655: Redefinition of DNS Authenticated Data (AD) bit

This document alters the specification defined in RFC 2535. Based on implementation experience, the Authenticated Data (AD) bit in the DNS header is not useful. This document redefines the AD bit such that it is only set if all answers or records proving that no answers exist in the response has...

datatracker.ietf.org

What is the AD flag for?

The Authentic Data (AD) flag is used by (caching) DNS servers to indicate that they have validated the DNSSEC records. The idea is that the client doesn't then have to repeat the check. In its DNS query, the (stub) resolver asks for validation (and the RRSIG records) by setting the DO flag (DNSSEC OK) – with the dig network tool, you can do that by using the '+dnssec' option. When responding with the DNS records, the DNS server can then send the AD flag as well. The DNS server is then effectively taking responsibility for both the caching and the validation."

So of course, both local-unbound and systemd-resolvd are caching servers. However to look into it properly will require doing some detailed investigation, which I don't have time to do at present. It's not clear to me that everything is working correctly though, on either operating system. Although perhaps we can take some reassurance from cloudflare's test website.

frankit60 · Sunday at 9:54 AM

blackbird9 said:
The rules around the use of the AD flag appear to be rather complex.

RFC 3655: Redefinition of DNS Authenticated Data (AD) bit

This document alters the specification defined in RFC 2535. Based on implementation experience, the Authenticated Data (AD) bit in the DNS header is not useful. This document redefines the AD bit such that it is only set if all answers or records proving that no answers exist in the response has...

datatracker.ietf.org

blackbird9 said:

I performed the same dig tests on a linux box running systemd-resolvd, as a sanity check with completely different resolver software, there is no unbound running on this system. I have it configured to use cloudflare again. The cloudflare website passes all four tests.

I get a slightly different response. On the linux box, the 'ad' flag is never set, even for the name 'www.cloudflare.com'. So I NEVER see the 'ad' flag set in the responses on linux.

Some reading, from https://networkingtoolbox.net/diagnostics/dns/dnssec-adflag

"The AD (Authenticated Data) Flag
The AD bit in DNS responses indicates that the resolver has successfully validated the response using DNSSEC. When set, you can trust the response hasn't been tampered with."

Which sounds like the response can only be trusted when the AD flag is set.

Interpreting Results

AD Set: Response is cryptographically verified

AD Not Set: Domain unsigned, validation failed, or resolver doesn't validate

CD Set: Validation was disabled for this query

SERVFAIL: May indicate DNSSEC validation failure

I don't see AD or CD set on linux.

On freebsd with local-unbound, I only saw AD set when the name queried was 'www.cloudflare.com', and not otherwise, which sounds like a bug to me.

On both systems I see the 'qr', 'rd' and 'ra' flags are set in the responses.

Click to expand...

try this with linux drill -aDSV4 dnssec-failed.org A IN

frankit60 · Sunday at 10:04 AM

try this with linux and FreeBSD drill -aDSV4 dnssec-failed.org A IN @127.0.0.1

blackbird9 · Sunday at 10:14 AM

If I ask the cloudflare server directly and bypass local-unbound, I also do not get the AD flag set in the response.

$ dig www.yahoo.com +dnssec @1.1.1.1

; <<>> DiG 9.20.29 <<>> www.yahoo.com +dnssec @1.1.1.1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14546
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.yahoo.com. IN A

;; ANSWER SECTION:
www.yahoo.com. 47 IN CNAME me-ycpi-cf-www.g06.yahoodns.net.
me-ycpi-cf-www.g06.yahoodns.net. 47 IN A 87.248.114.12
me-ycpi-cf-www.g06.yahoodns.net. 47 IN A 87.248.114.11

;; Query time: 16 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Sun Oct 04 10:10:37 BST 2026
;; MSG SIZE rcvd: 119

And again, if I change the network name to 'www.cloudflare.com', once again I do get the AD flag set.

$ dig www.cloudflare.com +dnssec @1.1.1.1

; <<>> DiG 9.20.29 <<>> www.cloudflare.com +dnssec @1.1.1.1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52417
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.cloudflare.com. IN A

;; ANSWER SECTION:
www.cloudflare.com. 300 IN A 104.16.123.96
www.cloudflare.com. 300 IN A 104.16.124.96
www.cloudflare.com. 300 IN RRSIG A 13 3 300 20261005101340 20261003081340 34505 www.cloudflare.com. GY1bTXi3KKieXuh/5dSfx1qbyZURtjkWgIOEuIVu1bdwp3i5OYVldcRl EBuF4o+bObQ4Vgp6ArxayyE7jlTntA==

;; Query time: 17 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Sun Oct 04 10:13:40 BST 2026
;; MSG SIZE rcvd: 193

So the remote server gives the same responses as local-unbound.
On linux, I NEVER see the AD flag set in the response, regardless of the name sent in the request.

Perhaps the AD flag is only used as part of the protocol between the local caching server and it's upstream server. But I'm guessing now. My first reading of the description of the AD flag said it has to be set in all responses for them to be valid.

blackbird9 · Sunday at 10:19 AM

On Freebsd, that command gives me

$ drill -aDSV4 dnssec-failed.org A IN @127.0.0.127
...
DNSSEC Trust tree:
dnssec-failed.org. (A)
|---dnssec-failed.org. (DNSKEY keytag: 32784 alg: 13 flags: 256)
|---DNSSEC signature has expired:
dnssec-failed.org. 3401 IN RRSIG DNSKEY 13 2 3600 20260702225706 20260304225706 50719 dnssec-failed.org. lKlwCpp4weU8+JmndESAckuF6etEHyK1erKqotzCeAFBBYw0iV4SGiR5WOdkqvHa9QGDCNkAqd2uQ2CNLTBORw==
For RRset:
dnssec-failed.org. 101 IN DNSKEY 257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg== ;{id = 50719 (ksk), size = 256b}
dnssec-failed.org. 101 IN DNSKEY 256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg== ;{id = 32784 (zsk), size = 256b}
With key:
dnssec-failed.org. 101 IN DNSKEY 257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg== ;{id = 50719 (ksk), size = 256b}
|---dnssec-failed.org. (DNSKEY keytag: 50719 alg: 13 flags: 257)
You have not provided any trusted keys.
;; Chase successful

blackbird9 · Sunday at 10:23 AM

On linux (debian), I get
drill -aDSV4 dnssec-failed.org A IN @127.0.0.53 # systemd-resolved listens on 127.0.0.53
...

DNSSEC Trust tree:
dnssec-failed.org. (A)
|---dnssec-failed.org. (DNSKEY keytag: 32784 alg: 13 flags: 256)
|---DNSSEC signature has expired:
dnssec-failed.org. 3527 IN RRSIG DNSKEY 13 2 3600 20260702225706 20260304225706 50719 dnssec-failed.org. lKlwCpp4weU8+JmndESAckuF6etEHyK1erKqotzCeAFBBYw0iV4SGiR5WOdkqvHa9QGDCNkAqd2uQ2CNLTBORw==
For RRset:
dnssec-failed.org. 227 IN DNSKEY 256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg== ;{id = 32784 (zsk), size = 256b}
dnssec-failed.org. 227 IN DNSKEY 257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg== ;{id = 50719 (ksk), size = 256b}
With key:
dnssec-failed.org. 227 IN DNSKEY 257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg== ;{id = 50719 (ksk), size = 256b}
|---dnssec-failed.org. (DNSKEY keytag: 50719 alg: 13 flags: 257)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
;; Chase failed.

So a different response to freebsd.

frankit60 · Sunday at 10:32 AM

blackbird9 said:
On Freebsd, that command gives me

$ drill -aDSV4 dnssec-failed.org A IN @127.0.0.127
...
DNSSEC Trust tree:
dnssec-failed.org. (A)
|---dnssec-failed.org. (DNSKEY keytag: 32784 alg: 13 flags: 256)
|---DNSSEC signature has expired:
dnssec-failed.org. 3401 IN RRSIG DNSKEY 13 2 3600 20260702225706 20260304225706 50719 dnssec-failed.org. lKlwCpp4weU8+JmndESAckuF6etEHyK1erKqotzCeAFBBYw0iV4SGiR5WOdkqvHa9QGDCNkAqd2uQ2CNLTBORw==
For RRset:
dnssec-failed.org. 101 IN DNSKEY 257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg== ;{id = 50719 (ksk), size = 256b}
dnssec-failed.org. 101 IN DNSKEY 256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg== ;{id = 32784 (zsk), size = 256b}
With key:
dnssec-failed.org. 101 IN DNSKEY 257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg== ;{id = 50719 (ksk), size = 256b}
|---dnssec-failed.org. (DNSKEY keytag: 50719 alg: 13 flags: 257)
You have not provided any trusted keys.
;; Chase successful

I have ;; Chase failed

blackbird9 · Sunday at 10:34 AM

I just repeated it, got chase successful on freebsd. That's with 1.1.1.1 and 1.0.0.1 as the upstream nameservers that local-unbound is configured to use.

blackbird9 · Sunday at 10:41 AM

I've repeated the test a number of times, on freebsd. Sometimes I get 'chase successful', then it flips to 'chase failed' a number of times, then back, and sometimes I get a socket creation error. It also seems to make a difference whether I specify loopback as the server or omit the '@127.0.0.1' argument, which should go to loopback anyway since that is what is configured in /etc/resolv.conf.

Maybe the drill client is buggy. Or the rest of it. It doesn't seem to be very consistent, anyway.

DNSSEC doesn't work with local-unbound

Interpreting Results​

​

What is the AD flag for?​

Interpreting Results​

​

Interpreting Results

What is the AD flag for?

Interpreting Results