Hello,
anyone else is facing this issue with knot-resolver and dnssec?
System
- IPFire 2.29 (x86_64)
- Core Update 203
- Knot Resolver 6.4.0
- IPv4 enabled, IPv6 disabled in Knot
- Upstream DNS:
- 1.1.1.1
- 1.0.0.1
- DNS Firewall lists removed for testing
- Related Suricata provider removed for testing
Problem
After running for some time, or immediately after restarting Knot Resolver, all kresd workers enter a high CPU state and DNS resolution through 127.0.0.1 stops working.
Typical state:
kresd0 ~57-60% CPU
kresd1 ~57-60% CPU
kresd2 ~57-60% CPU
kresd3 ~57-60% CPU
At the same time, UDP receive queues on port 53 start to grow:
UNCONN 2304 0 0.0.0.0:53 ...
DNS requests then time out:
dig @127.0.0.1 google.com
;; communications error to 127.0.0.1#53: timed out
Direct DNS queries to upstream resolvers work normally:
dig @1.1.1.1 pakfire.ipfire.org
returns:
status: NOERROR
pakfire.ipfire.org. IN A 81.3.27.49
Pakfire also works immediately if /etc/resolv.conf is temporarily changed from:
nameserver 127.0.0.1
to:
nameserver 1.1.1.1
nameserver 1.0.0.1
This confirms that WAN connectivity, routing, HTTPS and Pakfire are working correctly and that the failure is inside the local Knot Resolver path.
Relevant log messages
The logs repeatedly contain Trust Anchor / DNSSEC related messages:
[taupd ] active refresh failed for . with rcode: 2
[tasign] signalling query triggered: _ta-4f66-9728.
During the failure, the tasign message is repeated very rapidly by multiple workers.
There are also recurring messages like:
[rules ] skipping out-of-zone record(s); first name .
Similar Trust Anchor refresh failures had already been occurring for many hours before the complete DNS failure.
DNSSEC isolation test
As a controlled test, I added the following to /etc/knot-resolver/config.yaml:
dnssec:
enable: false
The result was immediate and reproducible.
With DNSSEC enabled:
- 4 kresd workers at ~57-60% CPU each
- UDP Recv-Q starts growing
- dig @127.0.0.1 google.com times out
- dig @127.0.0.1 pakfire.ipfire.org times out
- repeated taupd/tasign Trust Anchor messages
With DNSSEC disabled:
- kresd workers remain at 0.0-0.4% CPU
- UDP Recv-Q remains 0
- google.com resolves successfully in ~22 ms
- pakfire.ipfire.org resolves successfully in ~82 ms
- resolver remains stable after several minutes
Example stable state:
11082 ... 0.0% CPU ... /usr/sbin/kresd -c kresd0.conf -n
11083 ... 0.0% CPU ... /usr/sbin/kresd -c kresd1.conf -n
11084 ... 0.0% CPU ... /usr/sbin/kresd -c kresd2.conf -n
11085 ... 0.0% CPU ... /usr/sbin/kresd -c kresd3.conf -n
and:
UNCONN 0 0 0.0.0.0:53 ...
Trust Anchor file
/var/lib/knot-resolver/root.keys contains:
. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
Additional tests already performed
- DNS cache cleared
- Knot fully stopped and restarted
- verified no stale
kresdprocesses remained - DNS Firewall lists removed
- Suricata provider removed
- problematic/non-responsive DNS.WATCH resolver removed from active testing
- Cloudflare resolvers tested directly and working
- Pakfire tested successfully with direct Cloudflare DNS
- no duplicate
127.0.0.1entries in/var/ipfire/main/hosts
Current workaround
Temporarily disabling DNSSEC in Knot:
dnssec:
enable: false
This immediately restores normal CPU usage and DNS functionality.
Conclusion
The issue appears to be triggered by the DNSSEC / Trust Anchor handling in Knot Resolver 6.4.0 on IPFire Core 203.
The A/B test with dnssec.enable: false is fully reproducible:
DNSSEC enabled -> high CPU, tasign/taupd loop, DNS timeouts
DNSSEC disabled -> normal CPU, empty Recv-Q, DNS works normally
I would be happy to provide additional logs, configuration files or tests if needed.
Best regards