Resolved DNSSEC and bind not start

[nMLxTMJTZ]

Username:

TITLE

DNSSEC and bind not start

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Debian 13

PROBLEM DESCRIPTION

If in my fresh installation of debian 13 activate DNSSEC for domain the service bind9 not start and give me policy error

"dnssec-policy doesn't match dnssec-policy config"

STEPS TO REPRODUCE

Enable DNSSEC

ACTUAL RESULT

when i try to start bind9 "dnssec-policy doesn't match dnssec-policy config"

EXPECTED RESULT

bind9 start without problem

ANY ADDITIONAL INFORMATION

(DID NOT ANSWER QUESTION)

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[Sebahat.hadzhi]

Thank you for the report, @nMLxTMJTZ . I opened an internal case with our engineers to further check the behavior. I will follow up with more details as soon as possible. Thank you for your patience in the meantime.

 

[Sebahat.hadzhi]

@nMLxTMJTZ , our engineers were unable to reproduce the issue on two test Debian 13 environments - with Plesk 18.0.76.4 & 18.0.77.0. Could you please provide more detailed steps to reproduce? Thank you in advance.

 

[nMLxTMJTZ]

hi, i only enable DNS sec for a domain with debian 13 and after you try to reboot the server and you can see bind9 not start

 

[Sebahat.hadzhi]

Thank you for the update. However, even after a server reboot the issue does not occur on a test Debian 13 environment with DNSEC extension enabled for a domain name.
I would suggest opening a ticket with Plesk support for further investigation on your server. To sign-in and open a ticket please go to:

• https://support.plesk.com

If you got your license from a reseller, your reseller is in charge of providing you with support. You can raise the inquiry with them and they can forward it to our team for further processing.

If the reseller does not provide support, here is an alternative to get support directly from Plesk:

• https://support.plesk.com/hc/en-us/articles/12388090147095-How-to-get-support-directly-from-Plesk

 

[nMLxTMJTZ]

Request #95972807

 

[Sebahat.hadzhi]

Thank you. It appears that the missing step was running the dns repair utility, which results in the disappearance of the dnssec-policy records from the /etc/named.conf file The behavior was recognized as a bug identified with ID PPPM-15337. The suggested workaround (in case a DNS repair is needed) is to rrecreate DNSSEC signature for the domain (unsign/sign again).

 

[nMLxTMJTZ]

Any news for this problem?

 

[Sebahat.hadzhi]

Hi, @nMLxTMJTZ . The bug is our team processing queue. However, I cannot yet provide an ETA on when the fix will be released.

 

[nMLxTMJTZ]

there is the bug also when reboot system

 

[21Matze]

Debian 13 Trixie

apt install systemd-resolved

sudo bash -c 'echo -e "nameserver 1.1.1.1\nnameserver 8.8.8.8" > /etc/resolv.conf'

reboot


Support email zertifikat ssl dnssec usw.

 

[nMLxTMJTZ]

not work

 

[Archerus]

Need patch ... We've been waiting for the fix for over six months...

 

[Sebahat.hadzhi]

The fix is in progress and it very likely be released along with Plesk Obsidian 18.0.80. The only workaround (in case a DNS repair is needed) is to recreate DNSSEC signature for the domain (unsign/sign again).

 

[Archerus]

The fix is in progress and it very likely be released along with Plesk Obsidian 18.0.80. The only workaround (in case a DNS repair is needed) is to recreate DNSSEC signature for the domain (unsign/sign again).

Is it fixed in the new update? It's getting tedious debugging DNSSEC every day.

 

[Sebahat.hadzhi]

Hi, @Archerus . Our team is still working on the fix. It has been created and tested, but the release has been postponed for a future update.

 

[Archerus]

Where can I add custom directives for `named` in the panel? I have a temporary fix that I add manually, but it keeps getting overwritten by Plesk...