DNSSEC support in Dual WAN configuration

[zzz]

When I change DNSSEC support status (enabled/disabled) for one connection in Dual WAN Fail Over mode it also changes for the other one.
Can DNSSEC support be configured independently for each connection?

 

[bbunge]

When I change DNSSEC support status (enabled/disabled) for one connection in Dual WAN Fail Over mode it also changes for the other one.
Can DNSSEC support be configured independently for each connection?

On Stock Asus firmware, no. On Merlin, maybe but you will have to configure two instances of DNSMASQ.

 

[RMerlin]

Can DNSSEC support be configured independently for each connection?

No, since dnsmasq makes it global, not per server.

 

[tgl]

Is there really a good reason to turn off DNSSEC support at all? Maybe ten years ago there were sites you needed to get to that had broken DNSSEC data, but those days are gone. Today I think the risk/reward ratio for disabling DNSSEC is pretty terrible.

 

[zzz]

Is there really a good reason to turn off DNSSEC support at all?

When I turn on DNSSEC in Strict mode - Internet is gone for me. That is why I kept it off for a while in my new location as I had no time to play with it. Now I tried Opportunistic mode, and it is working. Is the protection still good in this mode?

 

[RMerlin]

When I turn on DNSSEC in Strict mode - Internet is gone for me.

That would probably indicate that your upstream server does not support DNSSEC, so all validation requests are failing.