DNS Resolver Operator Discovers Missing DNSSEC Validation After Six Months via External Test
A solo developer operating VantageDNS, a recursive DNS resolver with content filtering, discovered that DNSSEC validation had been completely disabled for six months. The issue came to light only after running the public DNS-OARC test suite, not through any internal monitoring alerts.
External Test Reveals Critical Gap
The DNS-OARC cmdns test sends dozens of queries with randomized names and checks port randomization, DNS ID entropy, TCP support, IPv6, QNAME minimization, and DNSSEC behavior. Five checks passed with green results, but one line appeared in red: "Lookup succeeded while signature was invalid." Manual verification with dig against dnssec-failed.org confirmed the resolver returned NOERROR and a valid answer instead of the required SERVFAIL status.
Why Passive Monitoring Failed
Existing health checks, latency metrics, and cache-hit-rate alerts could not detect the missing validation. When DNSSEC checking is disabled, the resolver answers faster, returns more successful responses, and appears completely healthy. The only reliable detection method is an active probe that deliberately supplies an invalid signature and verifies rejection.
Configuration History and Technical Debt
The cause was a comment left in the Unbound configuration during the MVP stage:
- DNSSEC validation — disabled in MVP, add in Sprint 5
- Requires auto-trust-anchor-file + root.key, which is absent by default
Subsequent sprints passed without addressing the item. A separate Go-based DNSSEC validator existed but was bypassed because production recursion was handled by an Unbound sidecar that forwarded traffic without validation.
Enabling Validation and Crash-Loop
Initial attempts to enable validation using auto-trust-anchor-file caused a permission-denied error inside the chroot environment because Unbound (running as _unbound) needed write access to the directory to perform RFC 5011 key-rollover updates. The container entered a crash-loop until the configuration was switched to a static trust-anchor-file pointing to a pre-generated root.key.
Verification Steps and Performance Impact
After the change, the operator established a repeatable verification checklist:
- dnssec-failed.org and sigfail.verteiltesysteme.net must consistently return SERVFAIL
- Signed domains must return the ad (authenticated data) flag
- Popular domains must resolve identically to results from 1.1.1.1 and 8.8.8.8
Latency measurements showed no measurable penalty: cold-cache queries to signed zones averaged 24 ms versus 28 ms for unsigned zones. Memory usage remained around 25 MB.
The operator now runs periodic active checks against dnssec-failed.org and recommends that anyone operating a resolver perform the same DNS-OARC test immediately.
Related articles
Deploying Self-Hosted Hysteria 2 Proxy on Debian-Based Linux VPS via Terminal
A detailed guide explains how to set up a personal Hysteria 2 proxy server on a KVM VPS running Debian or Ubuntu without any web panels. The process begins with generating ed25519 SSH keys, hardening the sshd_config file, and restricting access with ufw to only TCP port 22 and UDP port 443. Hysteria 2 is downloaded from GitHub, made executable, and configured using a TOML file that enables salamander obfuscation and a self-signed TLS certificate. A custom systemd unit ensures the service restarts on failure. The client configuration includes SHA256 pinning of the server certificate to prevent MITM attacks. The guide emphasizes manual CLI operations that apply equally to other services such as Nginx and stresses checking local laws before deployment.
Rostec Scales PCAT Platform Nationwide as Russia's First Industrial Marketplace
Rostec has expanded its PCAT platform to every organization within the state corporation that manufactures civilian products. Operating since 2025 and upgraded in September 2026, the platform now unites more than 180 enterprises and research organizations. Its catalog contains over 1,250 finished products along with 370 technological and manufacturing competencies. Visitors can locate not only equipment and components but also partners able to design, test, or produce required solutions. The portal receives more than 23,000 weekly visits, 60 percent of them from corporations and large enterprises. Rostec is extending the network into the regions through supply-chain agreements already signed with Krasnodar Krai and the oblasts of Tver, Tula, and Ryazan. In parallel the corporation launched the Robot Management System in November 2025 for centralized control of robots, sensors, and related IT services.
Kate Mobile Loses VK API Access After New Request Limits Exhaust Quota in 1.5 Days
Popular third-party Android client Kate Mobile has been cut off from VK services following the introduction of strict monthly API request caps. VK implemented the new limits on September 7, offering verified partners up to 100 million requests per month while requiring payment for additional access by third-party services. Kate Mobile developers had requested pricing details in advance but received no response from VK. Calculations showed that the app's real user base would consume the entire 100-million-request allowance in roughly 36 hours, with the messages.send method alone generating twice the allowed volume. Caching optimizations cannot mitigate the issue because message sending cannot be cached. Developers view the change as an effort to eliminate alternative clients rather than a genuine monetization strategy. Users expressed disappointment, praising the app's long-term support and criticizing the official VK client for excessive features and advertising.
Russian AI Research Ranks High in Global Science but Struggles with Commercialization
Russia has secured third place among BRICS nations and twentieth worldwide in the number of scientific papers presented at ten leading international conferences on machine learning and artificial intelligence. According to a study by the Scientometric Center of HSE University, Russian organizations contributed 560 papers between 2020 and 2025 that received over 12,300 citations. The average international citation rate reached 3.59, surpassing India despite fewer total publications. Russian strengths are most evident in the mathematics of machine learning, optimization, and formal concept analysis, with notable results also in computer vision and speech technologies. More than 40 percent of domestic publications involve business participation, led by Yandex among companies, HSE University and Skoltech among universities, and AIRI among non-profit organizations. Significant barriers remain, including shortages of computing power, limited access to high-quality data, and weak transfer of research into commercial products, particularly in natural language processing, AI agents, and infrastructure technologies. The Ministry of Digital Development has announced plans to stimulate demand for domestic AI solutions, expand computing infrastructure, improve regulation, and accelerate the implementation of scientific developments.