Invalid DNSSEC message

[balz666]

I keep getting this message in CLI:

2025-10-09 15:33:03.448 W Invalid DNSSEC A record signature for seeds.moneroseeds.ae.org: validation failure <seeds.moneroseeds.ae.org. A IN>: no DNSKEY rrset for trust anchor . while building chain of trust

I've been running my node for a while, and never had such message before. Now, I see it like 20 times every day, and it started a couple of weeks ago. I didn't do anything that could have caused that.

[selsta]

Does it show up if you start monerod with DNS_PUBLIC=tcp://1.1.1.1 env var?

[balz666]

I start it with this command :

`./monerod --ban-list /home/users/ban_list.txt --zmq-pub tcp://127.0.0.1:[port]

where [port] is the actual port.

I tried

`./monerod --ban-list /home/users/ban_list.txt --zmq-pub tcp://1.1.1.1:[port]

and got

2025-10-09 16:46:33.395	E ZMQ bind failed: Cannot assign requested address
2025-10-09 16:46:33.395	E Failed to create ZMQ/Pub listener: Unable to initialize ZMQ_XPUB socket

so it's not working.

It used to work fine, and suddenly I get this annoying message all the time.

[selsta]

This is an env var, not a command line argument. Try

DNS_PUBLIC=tcp://1.1.1.1 ./monerod --ban-list /home/users/ban_list.txt --zmq-pub tcp://127.0.0.1:[port]

[balz666]

Nope, didn't work.

Got this message as soon as it started :

2025-10-09 16:52:02.755	W Invalid DNSSEC TXT record signature for updates.moneropulse.no: validation failure <updates.moneropulse.no. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust

2025-10-09 16:52:08.167	W WARNING: no two valid DNS TXT records were received

2025-10-09 16:52:09.204	W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: key for validation . is marked as invalid because of a previous no DNSKEY rrset

2025-10-09 16:52:15.194	W WARNING: no two valid DNS TXT records were received

I think it still works, but I'd like to understand what this message is about and why I get it all the time.

[viktor4096]

@balz666 https://docs.getmonero.org/infrastructure/monero-pulse/#fixing-warning-no-two-valid-moneropulse-dns-checkpoint-records-were-received

Try both DNS providers.

FYI, you can safely ignore this error. This is not a critical issue. Your node will work just fine without MoneroPulse validation.

[nahuhh]

I do genuinely think there is an issue with the .no domain

[balz666]

Both

DNS_PUBLIC=tcp://1.1.1.1 ./monerod --ban-list /home/user/ban_list.txt --zmq-pub tcp://127.0.0.1:18083

and

DNS_PUBLIC=tcp://8.8.8.8 ./monerod --ban-list /home/user/ban_list.txtt --zmq-pub tcp://127.0.0.1:18083

did not work.

I'm happy to know it will work as fine, but curious as to why it suddenly started to do this.

And considering that

This means that the DNS server you're using doesn't acknowledge the +dnssec flag which is necessary to securely query for checkpoints.

does it mean there would be a security issue?

[selsta]

Just to confirm, did you try with 1.1.1.1 or 8.8.8.8 or both?

[balz666]

Ooops, sorry, I edited the post to avoid confusion. Yes, I tried both.

And I still get this hourly message :

2025-10-10 17:53:13.133 W No incoming connections - check firewalls/routers allow port 18080

which I have been getting for eons (no idea what it means... I get it exactly once every hour)

and

2025-10-10 18:06:23.240 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust 2025-10-10 18:06:23.241 W WARNING: no two valid DNS TXT records were received

which is a new message that I have been getting for only about two weeks... and I did not change anything, I still connect with my VPN like I used to, changed nothing.

[nahuhh]

And I still get this hourly message :

2025-10-10 17:53:13.133 W No incoming connections - check firewalls/routers allow port 18080

You're using a VPN and likely dont have incoming connections as a result

2025-10-10 18:06:23.240 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust 2025-10-10 18:06:23.241 W WARNING: no two valid DNS TXT records were received

If dns queries are going over the VPN, then the VPN's dns resolver doesnt support dnssec

which is a new message that I have been getting for only about two weeks... and I did not change anything, I still connect with my VPN like I used to, changed nothing.

[balz666]

You're using a VPN and likely dont have incoming connections as a result

But only once every hour. It works fine for like 59 minutes, and then it doesn't work.

Here is what my log looks like right now:

`2025-10-10 17:04:20.629 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust

2025-10-10 17:04:20.629 W WARNING: no two valid DNS TXT records were received

2025-10-10 17:53:13.133 W No incoming connections - check firewalls/routers allow port 18080

2025-10-10 18:06:23.240 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust

2025-10-10 18:06:23.241 W WARNING: no two valid DNS TXT records were received

2025-10-10 18:53:13.359 W No incoming connections - check firewalls/routers allow port 18080

2025-10-10 19:06:33.916 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust

2025-10-10 19:06:36.255 W WARNING: no two valid DNS TXT records were received

2025-10-10 19:53:13.708 W No incoming connections - check firewalls/routers allow port 18080

2025-10-10 20:06:55.397 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust

2025-10-10 20:06:55.397 W WARNING: no two valid DNS TXT records were received`

You see, EXACTLY one hour between each "No incoming connections" message.

If dns queries are going over the VPN, then the VPN's dns resolver doesnt support dnssec

It used to work fine and I didn't change my VPN provider or anything. Maybe they changed something? What are the consequences exactly?

[nahuhh]

You're using a VPN and likely dont have incoming connections as a result

But only once every hour. It works fine for like 59 minutes, and then it doesn't work.

it only checks dns checkpoints every 3600s (1hr)

Here is what my log looks like right now:

...

2025-10-10 20:06:55.397 W Invalid DNSSEC TXT record signature for checkpoints.moneropulse.co: validation failure <checkpoints.moneropulse.co. TXT IN>: no DNSKEY rrset for trust anchor . while building chain of trust

2025-10-10 20:06:55.397 W WARNING: no two valid DNS TXT records were received`

You see, EXACTLY one hour between each "No incoming connections" message.

yep. Expected, see above

If dns queries are going over the VPN, then the VPN's dns resolver doesnt support dnssec

It used to work fine and I didn't change my VPN provider or anything. Maybe they changed something? What are the consequences exactly?

in practice, no consequence. Your node is not set to enforce the checkpoints, so it would only print a warning if there was chain split.

you can hide these dns checkpoint logs by disabling the check using --disable-dns-checkpoints

[balz666]

What are the DNS checkpoints exactly and why did the second message appear out of nowhere two weeks ago?

I am a bit confused. First message was always there; second is brand new... so was wondering why it's there, as nothing changed on my side...

[nahuhh]

https://docs.getmonero.org/infrastructure/monero-pulse/