---
type: source
title: "Nutzung von DNSSec unter Linux"
tags: [dnssec, linux, network-security, configuration]
related: [dnssec, systemd-resolved, dnsmasq]
created: 2026-07-01
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_support_dokumentation_anleitungen_dnssec_linux.md"]
---

# Nutzung von DNSSec unter Linux

This source provides technical instructions for enabling DNSSEC (Domain Name System Security Extensions) on Linux operating systems, specifically focusing on two common resolver implementations: `systemd-resolved` and `dnsmasq`.

## Key Technical Instructions

### systemd-resolved Configuration
For systems using `systemd-resolved`, DNSSEC is enabled by modifying the configuration file:
- **File**: `/etc/systemd/resolved.conf`
- **Setting**: Under the `[Resolve]` section, set `DNSSEC=yes`.
- **Activation**: Restart the service using `systemctl restart systemd-resolved.service`.
- **Legacy Note**: For systemd versions older than 236 (e.g., Debian 9), `/etc/resolv.conf` must be manually updated to point to the local stub resolver: `nameserver 127.0.0.53`.

### dnsmasq Configuration
For systems using `dnsmasq`, the following directives must be added to `/etc/dnsmasq.conf`:
- `dnssec`: Enables DNSSEC validation.
- `trust-anchor`: Specific root keys are provided to establish the chain of trust.
- `dnssec-check-unsigned`: Ensures that unsigned zones are handled correctly.
- **Activation**: Restart the service using `systemctl restart dnsmasq.service`.

## Support
Technical issues regarding these configurations are handled by the [[universitatsrechenzentrum-urz]] via their [[groupware]] ticket system or the central hotline (ext. 1420).