DNSSEC & DoT with Stubby on OpenWrt 🌸

1

Install Stubby

on stable releases

opkg update
opkg install stubby ca-bundle nano

💡

ca-bundle lets Stubby verify TLS certs from upstream servers. Skip it and enjoy mysterious failures at 1am.

2

Enable & Start Stubby

wake it up, watch it breathe

/etc/init.d/stubby enable
/etc/init.d/stubby start
logread -e stubby

3

The Directory That Doesn't Exist

create stubby's home for DNSSEC state

On OpenWrt, DNSSEC validation lives inside Stubby/getdns — not in DoT itself. Stubby needs a writable directory. OpenWrt won't create it. Because of course it won't.

mkdir -p /var/lib/stubby
chown -R stubby:stubby /var/lib/stubby

🫧

/var is RAM-backed on most OpenWrt devices — it vanishes on every reboot like your will to live. Add those two lines to /etc/rc.local before exit 0 if Stubby doesn't recreate it on boot.

4

Set Manual Mode

make stubby.yml the actual boss

OpenWrt manages Stubby via UCI by default. Switch to manual mode so stubby.yml is in charge. Or as I like to call it: the "let me drive" setting.

✏️ edit

nano /etc/config/stubby

⚙️ set this option

option manual '1'

5

Enable DNSSEC in stubby.yml

the two lines you actually came here for

✏️ edit

nano /etc/stubby/stubby.yml

➕ add / uncomment

# Writable dir from Step 3
appdata_dir: "/var/lib/stubby"

# Enable DNSSEC validation
dnssec_return_status: GETDNS_EXTENSION_TRUE

6

Restart & Check Logs

the moment of truth. act casual.

/etc/init.d/stubby restart
logread -e stubby

🌸

If you see DNSSEC messages in the logs — congratulations. Something is happening. That's more than most setups can say.

7

Test DNSSEC Validation

failing on purpose has never felt so right

🔍 if you have dig installed

# Normal domain — should resolve fine
dig @127.0.0.1 -p 5453 example.com +dnssec

💥 test a broken domain

# Intentionally broken DNSSEC — should SERVFAIL
dig @127.0.0.1 -p 5453 dnssec-failed.org

🎉

SERVFAIL on dnssec-failed.org = you win. DNSSEC validation is working. It's failing successfully. You did it. Go to sleep.

Enable DNSSEC & DoT
with Stubby on OpenWrt

Your DNS is encrypted & validated.