What the developer wrote
Authored by SomberNight
dnssec: log warning if dependency is missing
Calling dnssec.query() with missing "cryptography" dep behaves the same as if DNSSEC validation failed: validated=False will be returned.
When used for openalias, we mandate validated=True.
What changed, and why it matters
This commit only changes how Electrum logs a message when the optional 'cryptography' Python package is missing. It does not change any actual security behavior: DNSSEC validation still fails and falls back to plain DNS, and OpenAlias still rejects unvalidated results. The change simply makes the missing-dependency warning more visible in logs.
No security action required. This is a minor logging improvement. Ensure the 'cryptography' package is installed if DNSSEC validation for OpenAlias is desired.
Security signals we found
No functional security behavior changed
Missing dependency already caused validated=False fallback
OpenAlias caller already mandates validated=True
Log level change only (INFO to WARNING for ImportError)
No input validation, cryptographic, or network behavior changes
Evidence from the diff
The patch modifies electrum/dnssec.py to log an ImportError at WARNING level instead of INFO when the ‘cryptography’ dependency is absent. The query() function already catches all exceptions, sets validated=False, and falls back to dns.asyncresolver.resolve(). OpenAlias usage requires validated=True, so the functional security posture is unchanged. The change is purely diagnostic/UX.
Changed components
electrum/dnssec.pyInspect captured patch +3 / −1
diff --git a/electrum/dnssec.py b/electrum/dnssec.py
index c45c505..9a9d733 100644
--- a/electrum/dnssec.py
+++ b/electrum/dnssec.py
@@ -30,6 +30,7 @@
# http://backreference.org/2010/11/17/dnssec-verification-with-dig/
# https://github.com/rthalley/dnspython/blob/master/tests/test_dnssec.py
+import logging
import dns
import dns.name
@@ -150,7 +151,8 @@ async def query(url: str, rtype: dns.rdatatype.RdataType) -> Tuple[dns.rrset.RRs
out = await _get_and_validate(ns, url, rtype)
validated = True
except Exception as e:
- _logger.info(f"DNSSEC error: {repr(e)}")
+ log_level = logging.WARNING if isinstance(e, ImportError) else logging.INFO
+ _logger.log(log_level, f"DNSSEC error: {repr(e)}")
out = await dns.asyncresolver.resolve(url, rtype)
validated = False
return out, validated
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.