diff options
| -rwxr-xr-x | archsetup | 12 |
1 files changed, 11 insertions, 1 deletions
@@ -1825,7 +1825,17 @@ EOF DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net FallbackDNS=1.0.0.1#cloudflare-dns.com 149.112.112.112#dns.quad9.net DNSOverTLS=yes -DNSSEC=yes +# allow-downgrade, not yes. Venue resolvers that mangle DNSSEC records are +# common on hotel and airport wifi, and yes turns that into no answer at all +# rather than an unauthenticated one. The encryption is the part worth being +# strict about, so DNSOverTLS stays yes. +# +# This is not what fixes the clock deadlock, despite being the obvious reach. +# Resolved downgrades when a server lacks DNSSEC support, and a clock-skew +# signature failure is a validation failure, so no downgrade fires. Measured on +# velox 2026-08-19: dead across six retries and a reset-server-features. The +# IP-addressed NTP source above is what breaks that deadlock. +DNSSEC=allow-downgrade # Disable mDNS in resolved - avahi handles .local resolution exclusively MulticastDNS=no EOF |