Bogus DNSSEC

[szmarczak]

Checklist

• I am able to reproduce the bug with the latest version given here: CLICK THIS LINK.
• I made sure that there are no existing issues - open or closed - which I could contribute my information to.
• I have read the FAQ and my problem isn't listed.
• I have taken the time to fill in all the required details. I understand that the bug report will be dismissed otherwise.
• This issue contains only one bug.
• I have read and understood the contribution guidelines.

Affected version

not needed

Steps to reproduce the bug

# dig @8.8.8.8 newpipe.net +dnssec

; <<>> DiG 9.18.31 <<>> @8.8.8.8 newpipe.net +dnssec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29308
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
; EDE: 6 (DNSSEC Bogus): (RRSIG with malformed signature found for newpipe.net/dnskey (keytag=35320))
;; QUESTION SECTION:
;newpipe.net.                   IN      A

;; ANSWER SECTION:
newpipe.net.            114     IN      A       159.69.138.33
newpipe.net.            114     IN      RRSIG   A 8 2 120 20250226212500 20250126212500 1776 newpipe.net. DrRgwC3F1mIhqWbh9Y4axqPIAmxd/0QsuN7ja2NPCmR17fnbLCgWegDF KG+7sDLCIWM8r/jhBctgjXpTBjmpZ3h3F1OGZxo3sT77SC4sMdpv7YiU HQprGP7Is/YulKMmq+Twp1PZrBWGYJAIKXp16ZR4CTNl7eFx9LuUu3xf doc=
newpipe.net.            114     IN      RRSIG   A 8 2 120 20250302195000 20250130195000 63741 newpipe.net. SuOORTzyGTyUPMRBjGEusNLZF65JEI8ijV4OZeAZQ/HW/luX/o49wkvo WFcpV715bxu7EMwvdsRqQxkLYFY2uIXe9tXQmtqcvdYLEf+X1+DljkX/ wmr0e1URiOwGmGcDZF/Z7ur6G00uLV19pNATk6bjLW9N2a6PknSkBSpn htk=

;; Query time: 19 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Sat Feb 01 14:07:24 UTC 2025
;; MSG SIZE  rcvd: 478

1.1.1.1 does not send A at all.

Expected behavior

No response

Actual behavior

No response

Screenshots/Screen recordings

No response

Logs

No response

Affected Android/Custom ROM version

No response

Affected device model

No response

Additional information

No response

[TobiGr]

@TheAssassin Can this be closed?

[tzagim]

#379

EDIT:
working fine now.

[TheAssassin]

@TobiGr I think we need a more permanent solution at some point because it just broke again (and was fixed automatically, apparently). We use the automated DNSSEC feature of our provider. We should probably escalate it there. Also, monitoring would be good to have, albeit we still need some more infrastructure for that.