Sample Header Ad - 728x90

Debugging systemd-resolved cache / systemd-resolved returns outdated responses

1 vote
0 answers
131 views
I updated the DNS settings at my DNS provider for my domain. While all public DNS servers including the DNS resolver of my router have picked up the new settings after some hours, systemd-resolved still shows the previous (outdated) records. I already tried resolvectrl flush-cashes but it did not help. How do I debug systemd-resolved where the outdated records come from? **`systemd-resolved` Configuration**
myuser@desktop-pc ~ $ resolvectl status
Global
           Protocols: +LLMNR -mDNS -DNSOverTLS DNSSEC=allow-downgrade/supported
    resolv.conf mode: stub
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google 1.0.0.1#cloudflare-dns.com 8.8.4.4#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2001:4860:4860::8888#dns.google 2606:4700:4700::1001#cloudflare-dns.com
                      2001:4860:4860::8844#dns.google

Link 2 (enp6s0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
         Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=allow-downgrade/supported
Current DNS Server: 192.168.178.1
       DNS Servers: 192.168.178.1
        DNS Domain: fritz.box

Link 3 (sit0)
    Current Scopes: none
         Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=allow-downgrade/supported
**Querying "upstream" DNS servers returns correct response**
myuser@desktop-pc ~ $ dig +nocmd +nocomments +nostats +noquestion @192.168.178.1 my-domain.tld. DNSKEY my-domain.tld. DS
my-domain.tld.              3600    IN      DNSKEY  257 3 13 lwrfAkszf5Ntm0HOvMcU5Hy9mRdIcdJCePC5yiEdFzDvYP/d3/A1JfoT di4xDocD1rK7hzC3RLyC/u87Y6lRkQ==
my-domain.tld.              85456   IN      DS      48469 13 2 B2744CEE8C59AE34191B6BED6C1710364C4857F59727FC155F53A575 EADAF835
myuser@desktop-pc ~ $ dig +nocmd +nocomments +nostats +noquestion @1.1.1.1 my-domain.tld. DNSKEY my-domain.tld. DS
my-domain.tld.              3600    IN      DNSKEY  257 3 13 lwrfAkszf5Ntm0HOvMcU5Hy9mRdIcdJCePC5yiEdFzDvYP/d3/A1JfoT di4xDocD1rK7hzC3RLyC/u87Y6lRkQ==
my-domain.tld.              86400   IN      DS      48469 13 2 B2744CEE8C59AE34191B6BED6C1710364C4857F59727FC155F53A575 EADAF835
myuser@desktop-pc ~ $ dig +nocmd +nocomments +nostats +noquestion @1.0.0.1 my-domain.tld. DNSKEY my-domain.tld. DS
my-domain.tld.              3600    IN      DNSKEY  257 3 13 lwrfAkszf5Ntm0HOvMcU5Hy9mRdIcdJCePC5yiEdFzDvYP/d3/A1JfoT di4xDocD1rK7hzC3RLyC/u87Y6lRkQ==
my-domain.tld.              86400   IN      DS      48469 13 2 B2744CEE8C59AE34191B6BED6C1710364C4857F59727FC155F53A575 EADAF835
All DNS servers (incl. my local Internet router 192.168.178.1) return the correct (new) DS record. **Local stub resolver returns outdated response**
myuser@desktop-pc ~ $ dig +nocmd +nocomments +nostats +noquestion my-domain.tld. DNSKEY my-domain.tld. DS
my-domain.tld.              1627    IN      DNSKEY  257 3 13 lwrfAkszf5Ntm0HOvMcU5Hy9mRdIcdJCePC5yiEdFzDvYP/d3/A1JfoT di4xDocD1rK7hzC3RLyC/u87Y6lRkQ==
my-domain.tld.              6644    IN      DS      6769 8 2 61D117BD41CC280C4907804324B3F2B6E6810D881F1E1D1F4C0E8423 39976A70
The local stub resolver (127.0.0.53), which is built into systemd-resolved, returns the outdated DS record.
Asked by user2690527 (412 rep)
Jul 28, 2024, 11:50 AM
Last activity: Jul 28, 2024, 12:36 PM