Important Note
Attention all node runners: please upgrade your nodes to v5.0.3 as soon as possible.
This patch fixes an issue with DNSSEC validation that prevents nodes from bootstrapping into the network when started or restarted. The issue affects all types of nodes.
Nodes that are currently connected to the network are functioning properly, but a new start or restart with versions less than 5.0.3 will not be able to validate DNSSEC signatures, which are required by default. This would result in the node being unable to connect to the network.
If you have any questions about upgrading your nodes, please reach out to us in the node-runners channel of the Algorand Discord server.
Node operators can ensure their nodes remain able to connect to the network by one of two approaches:
Primary Approach: Upgrade Node Software
Common Node Upgrade Paths
- Nodekit users: run
./nodekit upgrade - Package manager users: upgrade via your package manager normally
- FUNC users: Open FUNC and update the Node Software to 5.0.3
Fallback Approach: Temporary Configuration Change
If you are unable to upgrade your node immediately, ensure it is able to connect to the network by disabling DNSSEC validation in your node configuration:
-
Set the following value in config.json:
"DNSSecurityFlags": 0
-
Confirm that your config.json file has a Version value that is higher than 33. If not, add this value:
"Version": 34
After upgrading to v5.0.3, we recommend re-enabling DNSSEC validation by setting the DNSSecurityFlags value back to 9.
Overview
A root key update broke DNSSEC lookups due to anchor updates.
What's New
Update anchor file to include new root.
Changelog
Bug Fixes
- dnssec: add root KSK-2024 trust anchor (#6764)
Protocol Upgrade
This release does not contain a protocol upgrade.