DNSSEC failing for bserver-1.kbfs.keybase.io

Keybase GUI Version: 5.5.2-20201016183637+d4ebf7d999

My Linux client is not able to connect on Ubuntu Linux 20.10. The systemd logs say: `DNSSEC validation failed for question bserver-1.kbfs.keybase.io IN AAAA: failed auxiliary` (I get the exact error for bserver-0, too.)

[Running the URL through Verisign returns the following result](https://dnssec-debugger.verisignlabs.com/bserver-1.kbfs.keybase.io), which indicated a DNSSEC failure on Amazon's subdomain:

. | Found 2 DNSKEY records for . DS=20326/SHA-256 verifies DNSKEY=20326/SEP Found 1 RRSIGs over DNSKEY RRset RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset |   | Found 2 DNSKEY records for . |   | DS=20326/SHA-256 verifies DNSKEY=20326/SEP |   | Found 1 RRSIGs over DNSKEY RRset |   | RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
-- | -- | -- | -- | -- | -- | -- | -- | -- | --
  | Found 2 DNSKEY records for .
  | DS=20326/SHA-256 verifies DNSKEY=20326/SEP
  | Found 1 RRSIGs over DNSKEY RRset
  | RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
io | Found 1 DS records for io in the . zone DS=57355/SHA-256 has algorithm RSASHA256 Found 1 RRSIGs over DS RRset RRSIG=42351 and DNSKEY=42351 verifies the DS RRset Found 3 DNSKEY records for io DS=57355/SHA-256 verifies DNSKEY=57355/SEP Found 1 RRSIGs over DNSKEY RRset RRSIG=57355 and DNSKEY=57355/SEP verifies the DNSKEY RRset |   | Found 1 DS records for io in the . zone |   | DS=57355/SHA-256 has algorithm RSASHA256 |   | Found 1 RRSIGs over DS RRset |   | RRSIG=42351 and DNSKEY=42351 verifies the DS RRset |   | Found 3 DNSKEY records for io |   | DS=57355/SHA-256 verifies DNSKEY=57355/SEP |   | Found 1 RRSIGs over DNSKEY RRset |   | RRSIG=57355 and DNSKEY=57355/SEP verifies the DNSKEY RRset
  | Found 1 DS records for io in the . zone
  | DS=57355/SHA-256 has algorithm RSASHA256
  | Found 1 RRSIGs over DS RRset
  | RRSIG=42351 and DNSKEY=42351 verifies the DS RRset
  | Found 3 DNSKEY records for io
  | DS=57355/SHA-256 verifies DNSKEY=57355/SEP
  | Found 1 RRSIGs over DNSKEY RRset
  | RRSIG=57355 and DNSKEY=57355/SEP verifies the DNSKEY RRset
keybase.io | No DS records found for keybase.io in the io zone No DNSKEY records found bserver-1.kbfs.keybase.io is a CNAME to elb-bserver-922704615.us-east-1.elb.amazonaws.com No RRSIGs found |   | No DS records found for keybase.io in the io zone |   | No DNSKEY records found |   | bserver-1.kbfs.keybase.io is a CNAME to elb-bserver-922704615.us-east-1.elb.amazonaws.com |   | No RRSIGs found
  | No DS records found for keybase.io in the io zone
  | No DNSKEY records found
  | bserver-1.kbfs.keybase.io is a CNAME to elb-bserver-922704615.us-east-1.elb.amazonaws.com
  | No RRSIGs found
. |  
com | Found 1 DS records for com in the . zone DS=30909/SHA-256 has algorithm RSASHA256 Found 1 RRSIGs over DS RRset RRSIG=42351 and DNSKEY=42351 verifies the DS RRset Found 2 DNSKEY records for com DS=30909/SHA-256 verifies DNSKEY=30909/SEP Found 1 RRSIGs over DNSKEY RRset RRSIG=30909 and DNSKEY=30909/SEP verifies the DNSKEY RRset |   | Found 1 DS records for com in the . zone |   | DS=30909/SHA-256 has algorithm RSASHA256 |   | Found 1 RRSIGs over DS RRset |   | RRSIG=42351 and DNSKEY=42351 verifies the DS RRset |   | Found 2 DNSKEY records for com |   | DS=30909/SHA-256 verifies DNSKEY=30909/SEP |   | Found 1 RRSIGs over DNSKEY RRset |   | RRSIG=30909 and DNSKEY=30909/SEP verifies the DNSKEY RRset
  | Found 1 DS records for com in the . zone
  | DS=30909/SHA-256 has algorithm RSASHA256
  | Found 1 RRSIGs over DS RRset
  | RRSIG=42351 and DNSKEY=42351 verifies the DS RRset
  | Found 2 DNSKEY records for com
  | DS=30909/SHA-256 verifies DNSKEY=30909/SEP
  | Found 1 RRSIGs over DNSKEY RRset
  | RRSIG=30909 and DNSKEY=30909/SEP verifies the DNSKEY RRset
amazonaws.com | No DS records found for amazonaws.com in the com zone No DNSKEY records found |   | No DS records found for amazonaws.com in the com zone |   | No DNSKEY records found
  | No DS records found for amazonaws.com in the com zone
  | No DNSKEY records found
us-east-1.elb.amazonaws.com | No DS records found for us-east-1.elb.amazonaws.com in the amazonaws.com zone No DNSKEY records found elb-bserver-922704615.us-east-1.elb.amazonaws.com A RR has value 34.196.208.15 No RRSIGs found |   | No DS records found for us-east-1.elb.amazonaws.com in the amazonaws.com zone |   | No DNSKEY records found |   | elb-bserver-922704615.us-east-1.elb.amazonaws.com A RR has value 34.196.208.15 |   | No RRSIGs found
  | No DS records found for us-east-1.elb.amazonaws.com in the amazonaws.com zone
  | No DNSKEY records found
  | elb-bserver-922704615.us-east-1.elb.amazonaws.com A RR has value 34.196.208.15
  | No RRSIGs found

I'm not sure if there's anything that can be done, other than manually disabling DNSSEC validation on my system. I'm using Cloudflare's DNS servers. This might not be a Keybase problem, but might be an Amazon problem.

Start by checking the DNSSEC chain for bserver-1.kbfs.keybase.io and bserver-0.kbfs.keybase.io, including their CNAME targets at Amazon's ELB service, and compare the result with the Ubuntu systemd resolver logs. Done means establishing whether Keybase or the external DNS/ELB configuration is responsible and documenting a confirmed fix or external cause.

Written by the indexing model from the issue text.