Raspberry DNS problems with ArchLinuxARM and DNSSEC

Andreas

Some of my Raspberry PIs are offline for some days/weeks. After that the system time is off big time.

I thought: We have systemd-timesyncd. That should be fixed after a few minutes. But DNSSEC doesn't work when the time is off this much.

Problem analysis

For example: ping google.com results in

ping: google.com: Name or service not known

But dig works. (When you have it installed! Not the default on archlinuxarm.)

The log in the systemd journal helps here:

DNSSEC validation failed for question google.com IN A: signature-expired

And the same for all the ntp domains:

DNSSEC validation failed for question ntp.org IN DS: no-signature

Add some of the ntp ip addresses to /etc/systemd/timesyncd.conf

NTP=185.120.22.23 185.126.112.98 104.248.145.172 46.29.176.73

After that restart timesyncd with systemctl restart systemd-timesyncd.

But the timesyncd always gets a time out:

systemd-timesyncd[295]: Timed out waiting for reply from 185.120.22.23:123 (185.120.22.23).

Add this line at the end of /etc/systemd/resolved.conf:

DNSSEC=false

After that restart resolved with systemctl restart systemd-resolved.

And after some minutes and the next update from timesyncd you have the correct system time again.

Disabling DNSSEC is not what I wanted, but atm I don't see another way to solve this reliably.