Arch Linux

E3LDDfrK

Member

Registered: 2019-10-24

Posts: 73

[SOLVED] DNSSEC problem when accessing netflix.com and live.com

On chromium, I suddenly started to get a "DNS_PROBE_FINISHED_NXDOMAIN" error. It worked fine yesterday 
I also can't download things from One Drive and access live.com. live.com gives the same error as netflix.com.

I use systemd-resolved:

$ cat /etc/systemd/resolved.conf
[Resolve]
DNS= 1.1.1.1#one.one.one.one
FallbackDNS=1.0.0.1 9.9.9.10 8.8.8.8 2606:4700:4700::1111 2620:fe::10 2001:4860:4860::8888
Domains=~.
DNSSEC=true
DNSOverTLS=yes

The logs say DNSSEC problem: 

Nov 17 08:51:35 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.netflix.com IN A: failed-auxiliary
Nov 17 08:51:36 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.netflix.com IN A: failed-auxiliary
Nov 17 08:53:39 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question a-0001.a-afdentry.net.trafficmanager.net IN AAAA: failed-auxiliary
Nov 17 08:55:58 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.tm.lg.prod.aadmsa.trafficmanager.net IN A: failed-auxiliary
Nov 17 08:55:59 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.tm.lg.prod.aadmsa.trafficmanager.net IN A: failed-auxiliary
Nov 17 08:56:07 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.tm.lg.prod.aadmsa.trafficmanager.net IN AAAA: failed-auxiliary
Nov 17 08:56:07 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.tm.lg.prod.aadmsa.trafficmanager.net IN A: failed-auxiliary
Nov 17 08:56:12 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.tm.lg.prod.aadmsa.trafficmanager.net IN A: failed-auxiliary
Nov 17 08:56:12 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question www.tm.lg.prod.aadmsa.trafficmanager.net IN AAAA: failed-auxiliary
Nov 17 08:56:36 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question play.google.com IN A: failed-auxiliary
Nov 17 08:56:36 hostname systemd-resolved[2488]: [?] DNSSEC validation failed for question play.google.com IN AAAA: failed-auxiliary

Disabling DNSSEC is a "solution", but perhaps someone here can point me to a real solution that doesn't involve disabling DNSSEC.

edit: It got worse. And google doesn't work without disabling DNSSEC. I guess it was working for a while because of the caching.

edit2: I tried both DNS=1.1.1.1#cloudflare-dns.com and DNS=8.8.8.8#dns.google. Didn't work, the only way I can access these sites is by disabling DNSSEC in the config.

edit3: Possibly related: https://github.com/systemd/systemd/issues/9867 But the discussion is too technical for me.

edit4: It fixed itself. Probably temporary problem with my ISP.

Last edited by E3LDDfrK (2020-11-25 13:54:25)