Monero 0.18.5.4 adds the root KSK-2024 trust anchor; DNS checkpoints were failing on 0.18.5.3
Victoria Shinder2 min readThe Monero project tagged v0.18.5.4 "Fluorine Fermi" on 15 October 2026, nine days after v0.18.5.3. The tag, signed by tobtoht, comes without written release notes; what it contains is visible in the six commits between the two tags and the pull requests behind them.
The DNSSEC problem. Issue #11537, opened on 13 October, reported that the root zone's newest trust anchor, KSK-2024 (key tag 38696), had been added to Monero's master branch by an earlier pull request (#9600) but never backported to release-v0.18. v0.18.5.3 therefore shipped only the anchors with key tags 19036 and 20326. According to the report, the root zone's DNSKEY set was by then signed by key 38696 alone — on 13 October the reporter found keys 20326 and 38696 and a zone-signing key published, with the only signature over the set made by 38696. The consequence, the issue says, was that every DNSSEC validation performed by monerod v0.18.5.3 failed: DNS checkpoints, the DNS blocklist and the update check all logged validation failures and returned no valid records. The reporter supported this with a log from the official Linux x64 binary started with --enforce-dns-checkpointing --enable-dns-blocklist.
The fix. Pull request #11542, merged on 13 October and resolving that issue, changes the built-in list in src/common/dns_utils.cpp: the entry for key tag 19036 is removed and an entry for 38696 is added, so v0.18.5.4 ships 20326 and 38696.
A second fix. Pull request #11552 lets epee accept decimal strings again when converting to uint64. Its description calls this a regression from #11338, which removed an obsolete MyMonero conversion in September, and states that from v0.19 the conversion will no longer be supported.
What else changed. The comparison between the tags also touches the built-in checkpoint files (src/blocks/checkpoints.dat, src/checkpoints/checkpoints.cpp), blockchain.cpp, the version file and the README, through the preparation pull request #11553. None of these is described further in the pull requests.
Who is affected. The DNSSEC failure concerns features that rely on DNS records — checkpoints, the blocklist and the update check. Operators who run monerod with DNS checkpoint enforcement or the DNS blocklist enabled are the ones for whom, on the issue's evidence, v0.18.5.3 returned no valid records.
Source: monero-project/monero, tag v0.18.5.4 — https://github.com/monero-project/monero/releases/tag/v0.18.5.4 ; issue: https://github.com/monero-project/monero/issues/11537 ; fix: https://github.com/monero-project/monero/pull/11542