Root cause The root zone DNSSEC key (KSK) rolled over to KSK-2024 (key tag 38696) on 2026-10-11. To handle this, Canonical released systemd 237-3ubuntu10.57+esm4, which adds KSK-2024 to systemd-resolved’s built- in trust anchor (LP #2170538). Unattended-upgrades installed it on this host at 06:21 EEST on 2026-10-15, replacing +esm3.
On systemd 237 the patch breaks loading of the built-in trust anchor, and resolved exits at startup. We suspect the anchor list in 237 only has room for two keys, and the patch adds a third. Fix applied (workaround) When a local root trust anchor file exists, resolved skips the built-in anchor, so we created one: mkdir -p /etc/dnssec-trust-anchors.d cp /usr/share/dns/root.ds /etc/dnssec-trust-anchors.d/root.positive systemctl reset-failed systemd-resolved systemctl start systemd-resolved -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170852 Title: Ubuntu 18.04: systemd-resolved fails to start for 237-3ubuntu10.57+esm4 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-pro/+bug/2170852/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
