dnssec-check: add new package #26941

liuyuf78fk · 2025-07-08T23:43:00Z

This adds a lightweight tool to check whether the current DNS resolver supports DNSSEC validation. The tool uses dig for DNS queries and supports configuring two reference domains for testing via UCI:

secure domain (default: nic.cz)
broken domain (default: dnssec-failed.org)

It determines DNSSEC support based on these queries and reports severity levels: secure, medium, insecure.

liuyuf78fk · 2025-07-08T23:49:07Z

Functional Test Report: dnssec-check

This report demonstrates how dnssec-check works under different resolver configurations, verifying its logic in classifying DNSSEC support levels.

Test Environment

Device Model: Redmi AX6
Target Platform: qualcommax/ipq807x
Firmware Version: OpenWrt SNAPSHOT r30287-604355e8c4
Kernel Version: 6.12.35

Case 1: Secure (Local resolver validates DNSSEC)

/etc/resolv.conf:
nameserver 1.1.1.1
nameserver 2606:4700:4700::1111

$ dnssec-check
[INFO] Loaded configuration from UCI.
[*] Querying nic.cz ...
[*] Querying dnssec-failed.org ...
Parsed nic.cz: AD=true, Status=NOERROR
Parsed dnssec-failed.org: AD=false, Status=SERVFAIL
-> Severity level: secure

Explanation: The local resolver successfully performs full DNSSEC validation.

Case 2: Medium (Upstream validates, local does not)

/etc/resolv.conf:
nameserver 127.0.0.1 #(DNSSEC not enabled)

If the upstream DNS server is:
1.1.1.1

$ dnssec-check
[INFO] Loaded configuration from UCI.
[*] Querying nic.cz ...
[*] Querying dnssec-failed.org ...
Parsed nic.cz: AD=false, Status=NOERROR
Parsed dnssec-failed.org: AD=false, Status=SERVFAIL
-> Severity level: medium

Explanation: The local resolver does not validate DNSSEC, but the upstream resolver blocks domains that fail DNSSEC validation.

Case 3: Insecure (Neither local nor upstream validates DNSSEC)

/etc/resolv.conf:
nameserver 127.0.0.1 #(DNSSEC not enabled)

If the upstream DNS server is:
192.168.137.1 #(DNSSEC not enabled)

$ dnssec-check
[INFO] Loaded configuration from UCI.
[*] Querying nic.cz ...
[*] Querying dnssec-failed.org ...
Parsed nic.cz: AD=false, Status=NOERROR
Parsed dnssec-failed.org: AD=false, Status=NOERROR
-> Severity level: insecure

Explanation: Both the local and upstream resolvers return unsigned responses without blocking invalid domains.

Summary

The tool accurately distinguishes between the following DNSSEC support levels:

secure: local DNSSEC validation is active
medium: upstream DNSSEC validation is active, but local is not
insecure: no DNSSEC validation at any level

This tool might assist OpenWrt users with elementary DNSSEC validation.

Copilot

Pull Request Overview

Adds a minimal DNSSEC validation tool that queries two reference domains and reports support level via UCI.

Introduces a UCI defaults script to populate /etc/config/dnssec-check
Adds a Makefile to build and install the binary and defaults file

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
files/dnssec-check.defaults	New script to initialize UCI configuration with defaults
Makefile	Package build/install rules and metadata for dnssec-check

Comments suppressed due to low confidence (2)

net/dnssec-check/Makefile:25

[nitpick] The new DNSSEC validation tool currently lacks any automated tests. Consider adding a test suite to verify secure, medium, and insecure outcomes against known domains to ensure future changes don’t break core logic.

define Package/dnssec-check

net/dnssec-check/Makefile:34

[nitpick] Package description is in the Makefile, but the repository’s README or other user-facing docs aren’t updated to explain how to configure and run the tool. Adding usage examples and config details would help new users.

define Package/dnssec-check/description

liuyuf78fk · 2025-07-12T10:04:27Z

Hello, I'd like to check if anything is missing from this PR. Happy to update based on suggestions 😊.

My home OpenWrt device has DNSSEC enabled in its DNS resolver. Here's the output of running dnssec-check:

This screenshot shows my current UCI settings for dnssec-check on my OpenWrt router:

Here's the system info from my OpenWrt router, showing the environment where I tested the package:

I’m happy to maintain this package and keep it updated if accepted.

wehagy

You know how this works, it's maintained by the community. Hopefully, someone will review it eventually. Unfortunately, it's me this time 😅.

Anyway, you need to fix the build so I can check if the package is working.

wehagy · 2025-08-04T05:46:17Z

net/dnssec-check/Makefile

+#
+# Copyright (C) 2025 Liu Yu <[email protected]>
+#
+# This is free software, licensed under the GNU General Public License v2.0 or later.
+# See /LICENSE for more information.
+#


Suggested change

#

# Copyright (C) 2025 Liu Yu <[email protected]>

#

# This is free software, licensed under the GNU General Public License v2.0 or later.

# See /LICENSE for more information.

#

# SPDX-License-Identifier: GPL-2.0-only

#

# Copyright (C) 2025 Liu Yu <[email protected]>

wehagy · 2025-08-04T05:47:39Z

net/dnssec-check/Makefile

+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/liuyuf78fk/$(PKG_NAME)/releases/download/v$(PKG_VERSION)


Suggested change

PKG_SOURCE_URL:=https://github.com/liuyuf78fk/$(PKG_NAME)/releases/download/v$(PKG_VERSION)

PKG_SOURCE_URL:=https://codeload.github.com/liuyuf78fk/dnssec-check/tar.gz/v$(PKG_VERSION)?

wehagy · 2025-08-04T05:50:08Z

net/dnssec-check/Makefile

+PKG_LICENSE:=GPL-2.0-or-later
+PKG_MAINTAINER:=Liu Yu <[email protected]>


Suggested change

PKG_LICENSE:=GPL-2.0-or-later

PKG_MAINTAINER:=Liu Yu <[email protected]>

PKG_MAINTAINER:=Liu Yu <[email protected]>

PKG_LICENSE:=GPL-2.0-or-later

PKG_LICENSE_FILES:=LICENSE

wehagy · 2025-08-04T05:52:35Z

net/dnssec-check/files/dnssec-check.defaults

Leave uci-defaults alone, use a plain config and apk/opkg will take care for this for you.

One more suggestion, you don't want to maintain the config file in your repo? IHMO you have full control there, but is up to you as a maintainer to decide.

wehagy · 2025-08-04T05:59:16Z

net/dnssec-check/Makefile

+
+define Package/dnssec-check/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/dnssec-check $(1)/usr/bin/
+
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/dnssec-check.defaults $(1)/etc/uci-defaults/99-dnssec-check
+endef


Suggested change

define Package/dnssec-check/install

$(INSTALL_DIR) $(1)/usr/bin

$(INSTALL_BIN) $(PKG_BUILD_DIR)/dnssec-check $(1)/usr/bin/

$(INSTALL_DIR) $(1)/etc/uci-defaults

$(INSTALL_BIN) ./files/dnssec-check.defaults $(1)/etc/uci-defaults/99-dnssec-check

endef

define Package/dnssec-check/conffiles

/etc/config/dnssec-check

endef

define Package/dnssec-check/install

$(INSTALL_DIR) $(1)/usr/bin

$(INSTALL_BIN) $(PKG_BUILD_DIR)/dnssec-check $(1)/usr/bin/

$(INSTALL_DIR) $(1)/etc/config

$(INSTALL_CONF) ./files/dnssec-check.conf $(1)/etc/config/dnssec-check

endef

Leave uci-defaults alone.

liuyuf78fk · 2025-08-05T14:12:07Z

You know how this works, it's maintained by the community. Hopefully, someone will review it eventually. Unfortunately, it's me this time 😅.

Anyway, you need to fix the build so I can check if the package is working.

Thank you for your review. I’ve updated the package according to your suggestions and tested it on the amd64 platform — it works well.

The build errors on other platforms are due to a dependency on bind-dig, which currently fails to build on the OpenWrt main branch. However, this issue has already been fixed in the following PR:
#27095
e40f5d5

This adds a lightweight tool to check whether the current DNS resolver supports DNSSEC validation. The tool uses dig for DNS queries and supports configuring two reference domains for testing via UCI: - secure domain (default: nic.cz) - broken domain (default: dnssec-failed.org) It determines DNSSEC support based on these queries and reports severity levels: secure, medium, insecure. Signed-off-by: Liu Yu <[email protected]>

liuyuf78fk force-pushed the dnssec-check branch from 9ca47bb to 076a2c4 Compare July 9, 2025 01:29

BKPepe requested a review from Copilot July 9, 2025 06:42

Copilot AI reviewed Jul 9, 2025

View reviewed changes

liuyuf78fk force-pushed the dnssec-check branch 7 times, most recently from 98b570d to a3e5b0a Compare July 10, 2025 20:18

liuyuf78fk force-pushed the dnssec-check branch from a3e5b0a to d74af3b Compare July 16, 2025 19:22

liuyuf78fk changed the title ~~dnssec-check: add simple DNSSEC validation tool~~ dnssec-check: add new package Jul 16, 2025

liuyuf78fk force-pushed the dnssec-check branch 6 times, most recently from 104e565 to ddc699c Compare July 30, 2025 12:39

liuyuf78fk force-pushed the dnssec-check branch 4 times, most recently from 7787662 to 5a18d2f Compare August 2, 2025 09:10

wehagy requested changes Aug 4, 2025

View reviewed changes

liuyuf78fk force-pushed the dnssec-check branch from 5a18d2f to f97851f Compare August 5, 2025 13:53

liuyuf78fk force-pushed the dnssec-check branch 2 times, most recently from 783352e to b92ff16 Compare August 5, 2025 19:44

GeorgeSapkin requested a review from wehagy August 30, 2025 21:13

GeorgeSapkin added the Add package label Aug 30, 2025

wehagy force-pushed the dnssec-check branch from b92ff16 to c82ae53 Compare September 11, 2025 02:37

wehagy self-assigned this Sep 11, 2025

liuyuf78fk force-pushed the dnssec-check branch from c82ae53 to b2d5799 Compare October 2, 2025 11:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

dnssec-check: add new package #26941

dnssec-check: add new package #26941

Uh oh!

liuyuf78fk commented Jul 8, 2025

Uh oh!

liuyuf78fk commented Jul 8, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

liuyuf78fk commented Jul 12, 2025 •

edited

Loading

Uh oh!

wehagy left a comment

Uh oh!

wehagy Aug 4, 2025

Uh oh!

wehagy Aug 4, 2025

Uh oh!

wehagy Aug 4, 2025

Uh oh!

wehagy Aug 4, 2025

Uh oh!

wehagy Aug 4, 2025 •

edited

Loading

Uh oh!

liuyuf78fk commented Aug 5, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	PKG_SOURCE_URL:=https://github.com/liuyuf78fk/$(PKG_NAME)/releases/download/v$(PKG_VERSION)
	PKG_SOURCE_URL:=https://codeload.github.com/liuyuf78fk/dnssec-check/tar.gz/v$(PKG_VERSION)?

		PKG_LICENSE:=GPL-2.0-or-later
		PKG_MAINTAINER:=Liu Yu <[email protected]>

dnssec-check: add new package #26941

Are you sure you want to change the base?

dnssec-check: add new package #26941

Uh oh!

Conversation

liuyuf78fk commented Jul 8, 2025

Uh oh!

liuyuf78fk commented Jul 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Test Report: dnssec-check

Test Environment

Case 1: Secure (Local resolver validates DNSSEC)

Case 2: Medium (Upstream validates, local does not)

Case 3: Insecure (Neither local nor upstream validates DNSSEC)

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

liuyuf78fk commented Jul 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wehagy left a comment

Choose a reason for hiding this comment

Uh oh!

wehagy Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

wehagy Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

wehagy Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

wehagy Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

wehagy Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liuyuf78fk commented Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

liuyuf78fk commented Jul 8, 2025 •

edited

Loading

liuyuf78fk commented Jul 12, 2025 •

edited

Loading

wehagy Aug 4, 2025 •

edited

Loading

liuyuf78fk commented Aug 5, 2025 •

edited

Loading