DNS Resolver Operator Discovers Missing DNSSEC Validation After Six Months via External Test
A solo developer running VantageDNS, a recursive DNS resolver with filtering, discovered that DNSSEC validation had been disabled for six months after running an external DNS-OARC test. The test flagged "Lookup succeeded while signature was invalid," revealing that the resolver was accepting and returning responses with invalid DNSSEC signatures instead of returning SERVFAIL. Internal monitoring remained green throughout because the absence of validation does not trigger latency spikes, error rates, or availability alerts. The root cause traced back to a comment in the Unbound configuration left from an MVP phase that referenced enabling validation in Sprint 5, which never occurred. After enabling validation using a static trust-anchor-file, the operator documented the correct verification steps using dnssec-failed.org and domains with the AD flag, while noting that performance impact was negligible. The incident highlighted that security properties like DNSSEC validation require active, periodic external probing rather than passive monitoring.
HabrAug 31, 2026Translated from Russian