Bogus DNSSEC

Checklist

• I am able to reproduce the bug with the latest version given here: CLICK THIS LINK.
• I made sure that there are no existing issues - open or closed - which I could contribute my information to.
• I have read the FAQ and my problem isn't listed.
• I have taken the time to fill in all the required details. I understand that the bug report will be dismissed otherwise.
• This issue contains only one bug.
• I have read and understood the contribution guidelines.

Affected version

not needed

Steps to reproduce the bug

# dig @8.8.8.8 newpipe.net +dnssec

; <<>> DiG 9.18.31 <<>> @8.8.8.8 newpipe.net +dnssec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29308
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
; EDE: 6 (DNSSEC Bogus): (RRSIG with malformed signature found for newpipe.net/dnskey (keytag=35320))
;; QUESTION SECTION:
;newpipe.net.                   IN      A

;; ANSWER SECTION:
newpipe.net.            114     IN      A       159.69.138.33
newpipe.net.            114     IN      RRSIG   A 8 2 120 20250226212500 20250126212500 1776 newpipe.net. DrRgwC3F1mIhqWbh9Y4axqPIAmxd/0QsuN7ja2NPCmR17fnbLCgWegDF KG+7sDLCIWM8r/jhBctgjXpTBjmpZ3h3F1OGZxo3sT77SC4sMdpv7YiU HQprGP7Is/YulKMmq+Twp1PZrBWGYJAIKXp16ZR4CTNl7eFx9LuUu3xf doc=
newpipe.net.            114     IN      RRSIG   A 8 2 120 20250302195000 20250130195000 63741 newpipe.net. SuOORTzyGTyUPMRBjGEusNLZF65JEI8ijV4OZeAZQ/HW/luX/o49wkvo WFcpV715bxu7EMwvdsRqQxkLYFY2uIXe9tXQmtqcvdYLEf+X1+DljkX/ wmr0e1URiOwGmGcDZF/Z7ur6G00uLV19pNATk6bjLW9N2a6PknSkBSpn htk=

;; Query time: 19 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Sat Feb 01 14:07:24 UTC 2025
;; MSG SIZE  rcvd: 478

1.1.1.1 does not send A at all.

Expected behavior

No response

Actual behavior

No response

Screenshots/Screen recordings

No response

Logs

No response

Affected Android/Custom ROM version

No response

Affected device model

No response

Additional information

No response

Start by rerunning the provided dig @8.8.8.8 newpipe.net +dnssec command and compare it with the reported 1.1.1.1 result. Inspect the DNSSEC records for newpipe.net and determine what configuration change is required; done should mean resolvers no longer report a malformed signature or inconsistent A-record response.