Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Provide option to disable DNSSEC in resolved
Reported by nkasco · filed Sep 21, 2025Closed upstream on 2026-02-01. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
What do you need?
Recent changes to systemd-resolved changed default behavior of the DNSSEC setting to be enabled by default, for me this broke my Unifi DNS config (couldn't resolve A records from my internal DNS)
This is discussed here:
- https://bbs.archlinux.org/viewtopic.php?id=308364
- https://gitlab.archlinux.org/archlinux/packaging/packages/systemd/-/issues/57
It took me a while to find the root cause for this since it wasn't caused by Omarchy, but since this is an opinionated distro I think it would make sense to either disable it by default or provide a setting toggle for it with some minor guidance.
Necessary resultant change config:
- Add to /etc/systemd/resolved.conf: DNSSEC=no
- Ensure this isn't overwritten in any migrations
- Provide a menu option when selecting a custom DNS (i.e. Does your DNS support DNSSEC? (A records may not resolve properly if not))
View raw text
### What do you need? Recent changes to systemd-resolved changed default behavior of the DNSSEC setting to be enabled by default, for me this broke my Unifi DNS config (couldn't resolve A records from my internal DNS) This is discussed here: - https://bbs.archlinux.org/viewtopic.php?id=308364 - https://gitlab.archlinux.org/archlinux/packaging/packages/systemd/-/issues/57 It took me a while to find the root cause for this since it wasn't caused by Omarchy, but since this is an opinionated distro I think it would make sense to either disable it by default or provide a setting toggle for it with some minor guidance. Necessary resultant change config: - Add to `/etc/systemd/resolved.conf`: `DNSSEC=no` - Ensure this isn't overwritten in any migrations - Provide a menu option when selecting a custom DNS (i.e. Does your DNS support DNSSEC? (A records may not resolve properly if not))
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/9454· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.