DNS Resolver Operator Discovers Missing DNSSEC Validation After Six Months via External Test
A solo developer operating VantageDNS, a recursive DNS resolver with content filtering, discovered that DNSSEC validation had been completely disabled for six months. The issue came to light only after running the public DNS-OARC test suite, not through any internal monitoring alerts.
External Test Reveals Critical Gap
The DNS-OARC cmdns test sends dozens of queries with randomized names and checks port randomization, DNS ID entropy, TCP support, IPv6, QNAME minimization, and DNSSEC behavior. Five checks passed with green results, but one line appeared in red: "Lookup succeeded while signature was invalid." Manual verification with dig against dnssec-failed.org confirmed the resolver returned NOERROR and a valid answer instead of the required SERVFAIL status.
Why Passive Monitoring Failed
Existing health checks, latency metrics, and cache-hit-rate alerts could not detect the missing validation. When DNSSEC checking is disabled, the resolver answers faster, returns more successful responses, and appears completely healthy. The only reliable detection method is an active probe that deliberately supplies an invalid signature and verifies rejection.
Configuration History and Technical Debt
The cause was a comment left in the Unbound configuration during the MVP stage:
- DNSSEC validation — disabled in MVP, add in Sprint 5
- Requires auto-trust-anchor-file + root.key, which is absent by default
Subsequent sprints passed without addressing the item. A separate Go-based DNSSEC validator existed but was bypassed because production recursion was handled by an Unbound sidecar that forwarded traffic without validation.
Enabling Validation and Crash-Loop
Initial attempts to enable validation using auto-trust-anchor-file caused a permission-denied error inside the chroot environment because Unbound (running as _unbound) needed write access to the directory to perform RFC 5011 key-rollover updates. The container entered a crash-loop until the configuration was switched to a static trust-anchor-file pointing to a pre-generated root.key.
Verification Steps and Performance Impact
After the change, the operator established a repeatable verification checklist:
- dnssec-failed.org and sigfail.verteiltesysteme.net must consistently return SERVFAIL
- Signed domains must return the ad (authenticated data) flag
- Popular domains must resolve identically to results from 1.1.1.1 and 8.8.8.8
Latency measurements showed no measurable penalty: cold-cache queries to signed zones averaged 24 ms versus 28 ms for unsigned zones. Memory usage remained around 25 MB.
The operator now runs periodic active checks against dnssec-failed.org and recommends that anyone operating a resolver perform the same DNS-OARC test immediately.
Related articles
Reviving Huawei SANEX9510: Expired Certificates, Zero-Byte Keystore and Lost '@' Symbol Fixed Without Database Restart
A three-day postmortem revealed seven independent failures across four TLS contours in a legacy Huawei SANEX9510 telecom OSS platform that had been offline for ten months. The issues included expired certificates, an empty 0-byte PKCS#12 keystore, a missing '@' character in an encrypted TrustStore password, incompatible PKCS#8 private key encryption formats, and connection leaks to Sybase IQ. All components were restored without rebooting servers, restarting the database, or resetting passwords. The engineer mapped every keystore reference across multiple property files to avoid breaking working segments while fixing others. A final table creation for missing DAS_DIRSIZE metadata resolved a month-old import failure unrelated to the certificate problems.
Courtroom Sketches in the US and UK: Artistic Traditions, Charles Manson Trial and Lawyer Irvin Kanarek
The article explores the history and techniques of courtroom sketching in the United States and Britain, highlighting key artists and their distinctive styles. It details how Bill Robles captured the dramatic moment when Charles Manson lunged at Judge Older during his trial. The piece also reveals the unusual background of Manson's third attorney, Irvin Kanarek, a former rocket engineer turned lawyer known for deliberately prolonging cases. British artist Priscilla Coleman is noted for her method of sketching from memory after taking detailed notes in court. Additional artists such as Jane Rosenberg, Arnold Mesches, and Joseph Papin are profiled for their contributions to the genre. The text emphasizes that courtroom art conveys emotion and atmosphere that photographs cannot capture.
No News Content Available
The provided news item contains no text or details in the original Chinese source. Without any substantive information, it is impossible to determine relevance to cybersecurity topics. The entry is therefore classified outside all security-related categories.
Russian Federal Tax Service Tests Scoring Model to Uncover Concealed Self-Employed Income
The Russian Federal Tax Service is piloting a new scoring system designed to detect self-employed individuals who attempt to hide revenue by improperly canceling receipts in the Moy Nalog application. The model analyzes patterns such as systematic cancellations over specific periods and instances where checks are annulled by partner platforms or banks. Vladimir Maltsev, head of the operational control department at the Federal Tax Service, confirmed that the system is already being tested in several regions. Over the first nine months of 2026, authorities imposed penalties on approximately 3,000 self-employed taxpayers for unlawful receipt cancellations, resulting in fines totaling around 300 million rubles. The approach mirrors risk-assessment techniques long used by banks and focuses not only on incoming funds but also on how users manage recorded transactions. Full details of the scoring parameters and their weighting remain undisclosed to prevent circumvention.