Long time user, first time caller.

This package is shipping with outdated dns trust anchor information in
/usr/share/dnsmasq-base/trust-anchors.conf causing all DNSSEC
validations to fail.

Rather than correcting it I suggest making the package dependent on
dns-root-data which appears to be the Debian package for maintaining DNS
data.

As the dns-root-data maintainer I fully agree.
Not duplicating the trust anchors should be a policy-level requirement.

dnsmasq does not read natively any of the file formats provided by
dns-root-data, but its trust-anchor configuration parameters can be
trivially generated from /usr/share/dns/root.ds using e.g. awk.

Hi Jason,

According to https://data.iana.org/root-anchors/root-anchors.xml the
shipped trust anchor is still valid, however the newest trust anchor is
missing from dnsmasq-base 2.90-4~deb12u2.

As my tests didn't show failing DNSSEC validations, it would be great
you provide more details about how to reproduce your observation.

Hi Marco,

actually the dnsmasq package (not dnsmasq-base) applies
/usr/share/dns/root.ds translating it appropriately.

dnsmasq-base does not make use of /usr/share/dnsmasq-base/trust-
anchors.conf by itself, so, a solution might be to simply drop
/usr/share/dnsmasq-base/trust-anchors.conf from the dnsmasq-base
package.

Best,
Sven

useful, it should depend on it. Also see #1150960.

And yes, it is better to ship the package with no trust anchors and
DNSSEC disabled than with trust anchors that will get obsolete unless
another package is also installed.