From 463f9b7de893424e1439bfd4bad2d880423cacc3 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Wed, 19 Aug 2026 14:28:17 -0700 Subject: fix(installer): relax DNSSEC to allow-downgrade, keep DoT strict Venue resolvers that mangle DNSSEC records are common on hotel and airport wifi, and DNSSEC=yes turns that into no answer at all rather than an unauthenticated one. The encryption is the half worth being strict about, so DNSOverTLS stays yes. This is not what fixes the clock deadlock, despite being the obvious reach. Resolved downgrades when a server lacks DNSSEC support, and a clock-skew signature failure is a validation failure, so no downgrade fires. Measured on velox: dead across six retries and a reset-server-features. The IP-addressed NTP source is what breaks that. --- archsetup | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/archsetup b/archsetup index 4a64eb0..7dcdad2 100755 --- a/archsetup +++ b/archsetup @@ -1825,7 +1825,17 @@ EOF DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net FallbackDNS=1.0.0.1#cloudflare-dns.com 149.112.112.112#dns.quad9.net DNSOverTLS=yes -DNSSEC=yes +# allow-downgrade, not yes. Venue resolvers that mangle DNSSEC records are +# common on hotel and airport wifi, and yes turns that into no answer at all +# rather than an unauthenticated one. The encryption is the part worth being +# strict about, so DNSOverTLS stays yes. +# +# This is not what fixes the clock deadlock, despite being the obvious reach. +# Resolved downgrades when a server lacks DNSSEC support, and a clock-skew +# signature failure is a validation failure, so no downgrade fires. Measured on +# velox 2026-08-19: dead across six retries and a reset-server-features. The +# IP-addressed NTP source above is what breaks that deadlock. +DNSSEC=allow-downgrade # Disable mDNS in resolved - avahi handles .local resolution exclusively MulticastDNS=no EOF -- cgit v1.2.3