fix(installer): relax DNSSEC to allow-downgrade, keep DoT strict

Venue resolvers that mangle DNSSEC records are common on hotel and airport wifi, and DNSSEC=yes turns that into no answer at all rather than an unauthenticated one. The encryption is the half worth being strict about, so DNSOverTLS stays yes.

This is not what fixes the clock deadlock, despite being the obvious reach. Resolved downgrades when a server lacks DNSSEC support, and a clock-skew signature failure is a validation failure, so no downgrade fires. Measured on velox: dead across six retries and a reset-server-features. The IP-addressed NTP source is what breaks that.

1 files changed, 11 insertions, 1 deletions

diff --git a/archsetup b/archsetup
index 4a64eb0..7dcdad2 100755
--- a/archsetup
+++ b/archsetup
@@ -1825,7 +1825,17 @@ EOF
 DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net
 FallbackDNS=1.0.0.1#cloudflare-dns.com 149.112.112.112#dns.quad9.net
 DNSOverTLS=yes
-DNSSEC=yes
+# allow-downgrade, not yes. Venue resolvers that mangle DNSSEC records are
+# common on hotel and airport wifi, and yes turns that into no answer at all
+# rather than an unauthenticated one. The encryption is the part worth being
+# strict about, so DNSOverTLS stays yes.
+#
+# This is not what fixes the clock deadlock, despite being the obvious reach.
+# Resolved downgrades when a server lacks DNSSEC support, and a clock-skew
+# signature failure is a validation failure, so no downgrade fires. Measured on
+# velox 2026-08-19: dead across six retries and a reset-server-features. The
+# IP-addressed NTP source above is what breaks that deadlock.
+DNSSEC=allow-downgrade
 # Disable mDNS in resolved - avahi handles .local resolution exclusively
 MulticastDNS=no
 EOF