Issue DNSSEC configuration still gets broken by dnsmng --update – possibly related to PPPM-15337

[GCM]

Server operating system version

Ubuntu 26.04

Plesk version and microupdate number

18.0.81.4

Hello,​

we are experiencing a reproducible DNSSEC/BIND issue on a Plesk server which appears to be related to PPPM-15337, but affects a different Plesk code path.

Environment:

• Plesk Obsidian 18.0.81.3
• Ubuntu 26.04
• BIND
• Plesk DNSSEC extension installed
• DNSSEC enabled for multiple domains

PPPM-15337 was reported as fixed in Plesk 18.0.81. As far as we understand, that issue mainly affected plesk repair dns.

However, we can still reproduce a similar problem when Plesk regenerates a DNS zone using dnsmng.

For example:

plesk sbin dnsmng --update example.com
After the DNS configuration has been regenerated, the required DNSSEC policy assignment is removed from the generated BIND configuration.

The zone itself still expects DNSSEC handling, but the corresponding dnssec-policy configuration is no longer present or correctly assigned.

As a result, BIND may no longer be able to reload the affected zone correctly.

We have reproduced this behaviour several times.

Expected behaviour​

Running

plesk sbin dnsmng --update example.com
for a DNSSEC-enabled domain should regenerate the Plesk DNS configuration while preserving all required DNSSEC settings.

Actual behaviour​

The DNSSEC-related BIND configuration is modified and the required dnssec-policy assignment disappears.

The problem is therefore not limited to plesk repair dns.

Workaround​

We currently use our own monitoring/repair script which checks the generated BIND configuration after Plesk DNS changes and restores the required DNSSEC policy configuration if necessary.

Without this workaround, normal DNS changes performed through Plesk could potentially leave a DNSSEC-enabled zone in an invalid state.

Because this happens during normal Plesk DNS regeneration, we consider the issue particularly problematic for production systems with multiple DNSSEC-enabled domains.

Could Plesk please check whether the fix for PPPM-15337 was also implemented in the code path used by:

plesk sbin dnsmng --update
or whether this should be handled as a separate bug?

We can provide before/after BIND configuration, command output and additional logs if required.

 

[Sebahat.hadzhi]

Thank you for the report, @GCM . I have attempted to replicate the behavior. However, after running plesk sbin dnsmng --update example.com the keys are still remaining in /etc/named.conf:

dnssec-policy "example.com" {
        keys {
                zsk lifetime unlimited algorithm ecdsap256sha256 1024;
                ksk lifetime unlimited algorithm ecdsap256sha256 2048;
        };
};
zone "example.com" {
        type master;
        file "example.com";
        key-directory "keys/example.com";
        inline-signing yes;
        dnssec-policy "example.com";
        allow-transfer {
                common-allow-transfer;
        };
};

Could you please provide the BIND config snippets before and after running dnsmng? In terms of steps to reproduce is there anything specific you are performing other than signing the zone through the DNSSEC extension?