dnsdist: DNSSEC not working

[SkySai1]

Hello, do dnsdist provide dnssec queries?

Simple configuration:

-- disable security status polling via DNS
setSecurityPollSuffix("")


-- Listen:
addLocal("127.0.0.1:53", { reusePort=true })

-- Access List:
setACL({'0.0.0.0/0'})


--Authoritative layer
newServer({address="127.0.0.1:5302", order=1, pool="auth", checkName="example.com.", checkType="SOA"})

addAction({'example.com'}, PoolAction("auth"))

and there is results:
When i send query to dnsdist:

$ dig example.com +dnssec

; <<>> DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu <<>> example.com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10683
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;eexample.com.                     IN      A

;; ANSWER SECTION:
example.com.              86400   IN      A       127.0.0.1

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Thu May 23 17:55:16 MSK 2024
;; MSG SIZE  rcvd: 54

And when i send query to my backend (powerDNS):

$ dig example.com @127.0.0.1 -p 5302 +dnssec

; <<>> DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu <<>> example.com @127.0.0.1 -p 5302 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4250
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;example.com.                     IN      A

;; ANSWER SECTION:
example.com              86400   IN      RRSIG   A 13 2 86400 20240606000000 20240516000000 14597 example.com.  hiVG13JLsDy9dJR4oQGh5nECBhzYl8imO0+EJ8cXjUSKA1kd5x4UxJEp b36ltpY/lsPOqP24f05OFSRZOfYYcw==
example.com.              86400   IN      A       127.0.0.1

;; Query time: 0 msec
;; SERVER: 127.0.0.1#5302(127.0.0.1) (UDP)
;; WHEN: Thu May 23 17:57:22 MSK 2024
;; MSG SIZE  rcvd: 159

Also, DNSKEY query will cause SERVFAIL on dnsdist.
dnsdist:

$ dig example.com DNSKEY

; <<>> DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu <<>> example.com DNSKEY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20696
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;example.com                    IN      DNSKEY

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Thu May 23 17:59:54 MSK 2024
;; MSG SIZE  rcvd: 38

and backend (powerDNS):

$ dig example.com DNSKEY @127.0.0.1 -p 5302

; <<>> DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu <<>> example.com DNSKEY @127.0.0.1 -p 5302
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1472
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com                     IN      DNSKEY

;; ANSWER SECTION:
example.com              86400   IN      DNSKEY  257 3 13 CzQNZE1RnPSFpWPx/7ReyZVTyNii0F54TqY3Pr8sCXZbqaX/oKy7ZDxy B3v7xoO9srLryl+xBVNYrI2+Np76Tw==

;; Query time: 0 msec
;; SERVER: 127.0.0.1#5302(127.0.0.1) (UDP)
;; WHEN: Thu May 23 18:00:45 MSK 2024
;; MSG SIZE  rcvd: 118

[rgacogne]

dnsdist will pass the query to the backend and the response back to the client, DNSSEC or not.
In your case, I'm not sure dig is actually sending your queries to dnsdist, based on this line:

SERVER: 127.0.0.53#53(127.0.0.53) (UDP)

127.0.0.53 is usually systemd-resolved.

[SkySai1]

oh, i dump, yea this is not dnsdist's socket, ty