Comment 3 for bug 1376373

> This was fixed in v2.71test2~7

Okay, things are a bit more complicated than that. My router really is running v2.71 with that fix. But the there’s a second problem that is not addressed: even though the query eventually succeeds, it takes too long (over 10 seconds), because something is translating the SERVFAILs into timeouts.

This is apparently a difficult problem for dnsmasq to solve. Although it seems stupid for dnsmasq to make DS queries starting in xvm.mit.edu and proceeding up to the root until it finds proof that the record is unsigned, it actually has to work that way, because as a non-recursive forwarder, it doesn’t know exactly where the zone boundaries are. For details, see this message from the author:
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2014q2/008518.html

Bottom line, invirt-dns really should be fixed.