DNSSEC doesn't work for me on OpenWrt

[lessneek]

I have no ad flag with dnscrypt-proxy2 2.0.34-1 on OpenWrt 19.07.0 r10860-a3ffeb413b:

$ drill -D dnscrypt.info
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 8616
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 

but if I make a direct request to 1.1.1.1 e.g. the ad is here:

$ drill -D dnscrypt.info @1.1.1.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 41161
;; flags: qr rd ra ad ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 

what causes the problem?

There is require_dnssec = true and [NOTICE] Server with the lowest initial latency: jp.tiarap.org (rtt: 19ms).

[jedisct1]

Check that the query is actually sent to dnscrypt-proxy. Find the line that starts with listen_addresses = in dnscrypt-proxy.toml and specifically send the query to one of the IP addresses and ports found in that line. For example:

drill -p 553 -D dnscrypt.info @127.0.0.1

[lessneek]

okay, thanks, found the issue: openwrt uses dnsmasq to serve on port 53 and translate requests to dnscrypt-proxy listening on '127.0.0.53:53'. Direct request to dnscrypt-proxy returns with ad flag as expected. Now I need to configure dnsmasq to work correctly with dnssec. Is it good to completely disable dnsmasq and use dnscrypt-proxy instead?

[ibksturm]

okay, thanks, found the issue: openwrt uses dnsmasq to serve on port 53 and translate requests to dnscrypt-proxy listening on '127.0.0.53:53'. Direct request to dnscrypt-proxy returns with ad flag as expected. Now I need to configure dnsmasq to work correctly with dnssec. Is it good to completely disable dnsmasq and use dnscrypt-proxy instead?

hi there
no it istn a good solution, cause dnsmasq handle also dhcp server and many other things in openwrt

my solution was:

• configure dnscrypt listen on 127.0.0.53:5353
• configure dnsmasq forward to 127.0.0.53:5353

this workaround does also function with stubby, AdGuardHome and other solutions

b) for DNSSEC you NEED to uninstall dnsmasq and after install dnsmasq-full.
IMPORTANT: switch dnsserver on you WAN- interface bevor uninstall dnsmasq to something like 9.9.9.9, 1.1.1.1 or any other open dnsserver, you name it. after all, you could change back to 127.0.0.1 / ::1

[lessneek]

Nothing helps, even proxy-dnssec '1' in /etc/config/dhcp.

[lessneek]

at last, all I need is to set option dnssec '1' in the /etc/config/dhcp