Change:
<ins> # This test verifies that systemd-timesyncd can resolve the NTP server hostname when DNSSEC validation # fails even though it is enforced in the systemd-resolved settings. It is required in order to solve # the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the # correct time, we need to connect to an NTP server, which usually requires resolving its hostname. # # This test does the following: # - Sets up a DNS server (tinydns) listening on the eth1 ip addess, serving .ntp and fake.ntp records. # - Configures that DNS server as a resolver and enables DNSSEC in systemd-resolved settings. # - Configures systemd-timesyncd to use fake.ntp hostname as an NTP server. # - Performs a regular DNS lookup, to ensure it fails due to broken DNSSEC. # - Waits until systemd-timesyncd resolves fake.ntp by checking its debug output. #   Here, we don't expect systemd-timesyncd to connect and synchronize time because there is no NTP #   server running. For this test to succeed, we only need to ensure that systemd-timesyncd #   resolves the IP address of the fake.ntp host. import ./make-test-python.nix ({ pkgs, ... }: let ntpHostname = "fake.ntp"; ntpIP = "192.0.2.1"; in { name = "systemd-timesyncd"; nodes.machine = { pkgs, lib, config, ... }: let eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address; in { # Setup a local DNS server for the NTP domain on the eth1 IP address services.tinydns = { enable = true; ip = eth1IP; data = '' .ntp:${eth1IP} +.${ntpHostname}:${ntpIP} ''; }; # Enable systemd-resolved with DNSSEC and use the local DNS as a name server services.resolved.enable = true; services.resolved.dnssec = "true"; networking.nameservers = [ eth1IP ]; # Configure systemd-timesyncd to use our NTP hostname services.timesyncd.enable = lib.mkForce true; services.timesyncd.servers = [ ntpHostname ]; services.timesyncd.extraConfig = '' FallbackNTP=${ntpHostname} ''; # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug"; }; testScript = '' machine.wait_for_unit("tinydns.service") machine.wait_for_unit("systemd-timesyncd.service") machine.fail("resolvectl query ${ntpHostname}") machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'") ''; }) </ins>

Discussion:
I'm bringing up new RPis and their clocks are often wrong. Even though upstream systemd has given exceptions to be able to skip dnssec check for ntp sync, it doesn't... appear to be working. If I set the date manually, often by time I check timesyncd will have already taken care of kicking in and it reports that it's synced. Steps to reproduce the behavior: the clock badly. . and see if your DNS works
If I read it right, only works for systemd-resolved. One general workaround is to use hard-coded IP addresses for NTP (our routers actually do that IIRC).
That commit seems to indicate that it should bypass DNSSEC for timesyncd. This would get my clock back in sync, thus resolving DNSSEC errors for the rest of the system. But timesyncd isn't doing its job. I assume that's because: date wrong -dnssec failure. But maybe also fails if the clock is just too askew? I'll try to look more later, maybe I have to opt-in large corrections? Seems a bit weird to me. Or do we maybe use timesyncd in a non-standard way?
I ran into this on a Raspberry Pi 3B. I'm using systemd-networkd including systemd-resolved. At some point DNS started failing, and I noticed the system clock was out of sync by about 4 hours and not synchronizing anymore. The log of systemd-resolved was full of DNSSEC s: I'm not sure what changed, because I was able to install NixOS just fine. It also was offline before for some time without this problem happening (as far as I noticed at least), and it started happening after it was online for some time without break. Also, the systemd-native workaround should be working on NixOS as well, I can't find anything that indicates a non-standard setup that might overwrite tha workaround. Checking is the standard original systemd unit file that includes the relevant line and as far as I can see it isn't overridden. I also checked and it includes . For now, I worked around the issue by specifying my NTP servers by IP (I used the ones by the ).
Closing as this should be fixed by Please reopen if this is still an issue.