Issues when looking up inexistent TLSA record with DNSSEC enabled

Today I found an unexpected behavior with blocky v0.28.2 in combination with postfix trying to lookup a TLSA record for DANE. I wanted to write a mail to a domain that generally has DNSSEC enabled but then mail submission failed because an expected TLSA record couldn't be resolved: ``` Jan 12 18:18:38 myhost postfix/smtp[1240232]: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.mail.boegli-bestattungen.ch type=TLSA: Host not found, try again Jan 12 18:18:38 myhost postfix/smtp[1240232]: warning: DANE TLSA lookup problem: Host or domain name not found. Name service error for name=_25._tcp.mail.boegli-bestattungen.ch type=TLSA: Host not found, try again Jan 12 18:18:38 myhost postfix/smtp[1240232]: warning: TLS policy lookup for boegli-bestattungen.ch/mail.boegli-bestattungen.ch: TLSA lookup error for mail.boegli-bestattungen.ch:25 Jan 12 18:18:38 myhost postfix/smtp[1240232]: 8CCDC8B00A: to=<mail@boegli-bestattungen.ch>, relay=none, delay=0.25, delays=0.12/0.03/0.1/0, dsn=4.7.5, status=deferred (TLSA lookup error for mail.boegli-bestattungen.ch:25) ``` When trying to lookup the TLSA record it indeed doesn't exist: ``` $ delv @9.9.9.9 +dnssec _25._tcp.mail.boegli-bestattungen.ch TLSA ;; resolution failed: ncache nxdomain ; negative response, fully validated ; _25._tcp.mail.boegli-bestattungen.ch. 900 IN \-ANY ;-$NXDOMAIN ; mail.boegli-bestattungen.ch. RRSIG NSEC ... ; mail.boegli-bestattungen.ch. NSEC pop.boegli-bestattungen.ch. A RRSIG NSEC ; boegli-bestattungen.ch. SOA ns1.webland.ch. postmaster.boegli-bestattungen.ch. 2025112841 86400 10800 604800 900 ; boegli-bestattungen.ch. RRSIG SOA ... ``` However when trying to resolve it through blocky that has `.dnssec.validate=true` it would give a signature validation error: ``` $ dig +dnssec _25._tcp.mail.boegli-bestattungen.ch TLSA ; <<>> DiG 9.18.42 <<>> +dnssec _25._tcp.mail.boegli-bestattungen.ch TLSA ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 5288 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; EDE: 15 (Blocked): (DNSSEC validation failed: bogus signatures) ;; QUESTION SECTION: ;_25._tcp.mail.boegli-bestattungen.ch. IN TLSA ;; Query time: 5 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Mon Jan 12 21:12:18 CET 2026 ;; MSG SIZE rcvd: 113 ``` It seems the SERVFAIL is what triggers postfix to stop submitting the mail. After switching blocky to stop validating DNSSEC I could send my mail. I guess there is something bogus with the blocky DNSSEC validation in this case?