DNSSEC Validation Failed

Sun, 11 Oct 2026 00:00:00 +0000

I was happily using Ubuntu 24.04 this morning to browse the web, but when I tried this evening I could not load any website while connected to a VPN.

If I disconnected from the VPN, it would work. Maybe my VPN provider was having issues? I gave it an hour, and it was still not working. Probably not the VPN service, they are on top of this kind of thing.

I started to dig (haha, funny if you knew that this was a DNS issue).

I was getting the following error in my browser DNSSEC validation failed for question IN DNSKEY: missing-key. But I could ping IP addresses. Something was wrong with DNS resolution.

I found out that ICANN scheduled a switch from an old DNS root key to a new one, TODAY. It seems that my Ubuntu 24.04 did not have the new key in place, so it was failing DNSSEC validation.

The fix is to add the new root key to the OS. To get the correct info, go to https://data.iana.org/root-anchors/root-anchors.xml.

Then add the key -

sudo mkdir -p /etc/dnssec-trust-anchors.d
sudo nano /etc/dnssec-trust-anchors.d/root.positive
# Put these two lines in the file, you can review the values at the link above to make sure they are correct.
. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16

# Restart the systemd-resolved service
sudo systemctl restart systemd-resolved

That should be it!

Let me know if this helps.

DNSSEC | no dogma blog

DNSSEC Validation Failed