Package: debian-policy Version: 4.7.4.1 Severity: normal DNSSEC-enabled DNS resolvers must depend on the dns-root-data package instead of shipping built-in trust anchors. The dns-root-data is a trivial, arch:all package whose only purpose is to provide a current DNS root zone and DNSSEC trust anchors, even for end of support Debian releases.
Short summary for people who are not familiar with DNSSEC: domains resolution will stop working if the trust anchors are not up to date. There is a mechanism (RFC 5011) to update them automatically in band, but it requires that the resolver was working *before* the rollover. Due to complex reasons (pandemic, end of life HSMs...) only three root zone KSKs have been deployed so far[1] since 2010, the most recent one last Sunday, but the current IANA plan[1] is to rotate the root KSK every 3 years. This means that this failure will be much more frequent in the future. Most important DNS resolvers already depend on dns-root-data: bind9, pdns-recursor, knot-resolver6. Some important DNS resolvers only recommend dns-root-data: unbound, dnsmasq-base. Only one important DNS resolver does not use dns-root-data (but AFAICT could with just a symlink): systemd-resolved. Embarrassing failures: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150730 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170538 [1] https://www.iana.org/dnssec/files [2] https://www.icann.org/en/system/files/files/proposal-future-rz-ksk-rollovers-01nov19-en.pdf -- ciao, Marco
signature.asc
Description: PGP signature
