DNSSec disabled in asuswrt-merlin build

[ledge]

Hi,

After setting up dnscrypt on my rt-ac68u, I've noticed several dnscrypt servers also support DNSSec.
However, I noticed that the build of dnsmasq on my asuswrt-merlins v378.53_0 doesn't support DNSSec:

# dnsmasq --dnssec

dnsmasq: DNSSEC not available: set HAVE_DNSSEC in src/config.h

I believe that for DNSSec to be available in dnsmasq, dnsmasq needs to be recompiled with the above compile-time option set.
Rmerlin, can you please enable DNSSec in asuswrt-merlin?
If not, what are the issues surrounding DNSSec?

Thanks!

 

[RMerlin]

Rmerlin, can you please enable DNSSec in asuswrt-merlin?
If not, what are the issues surrounding DNSSec?

Thanks!

It's not just a matter of flicking the switch on. dnsmasq's DNSSec support requires additional libraries that aren't currently part of the firmware.

 

[lancethepants]

DNSSec in dnsmasq requires libgmp and libnettle. dnsmasq's changelog mentions compiling these two libraries statically which removes unneeded portions of the libraries and saves on space compared to adding the shared library. This is the route tomato uses.

 

[RMerlin]

DNSSec in dnsmasq requires libgmp and libnettle. dnsmasq's changelog mentions compiling these two libraries statically which removes unneeded portions of the libraries and saves on space compared to adding the shared library. This is the route tomato uses.

I know. Just saying it's not a 2 minutes fix, and right now not a priority for me either.