Screenshot of TeamViewer in the 'Not ready' state.

TeamViewer (sometimes) doesn’t work with DNSSEC enabled

Update (2022-11-12): I tested again after Frankie in the comments noted that it works on his machine, and indeed it does for me, too, even with DNSSEC turned back on. My only explanation is that it’s an intermittent issue.

I couldn’t figure out why TeamViewer was perpetually stuck in the ‘Not ready. Please check your connection’ state, and the help article didn’t give any clues (port 5938 was already open for outbound connections).

The dreaded ‘Not ready. Please check your connection’

The log files (/opt/teamviewer/logfiles/TeamViewer15_Logfile.log in Fedora) gave a hint:

The host would cycle from router1.teamviewer.com to router16.teamviewer.com, but none of them would resolve. Long story short, DNSSEC is broken for these TeamViewer domains, and the application won’t work if none of them can be reached.

Sadly, this problem was reported years ago but nothing has changed.

Workarounds

Neither of these is good! I recommend contacting TeamViewer and letting them know about this issue (particularly if you’re a paying customer).

Hard code an IP address in hosts

Adding an IP address for router1.teamviewer.com to hosts seems to make the application functional.

I just picked the first IPv4 address and added it to /etc/hosts:

These IP addresses are of course liable to change.

Disable DNSSEC

Note: DNSSEC exists for a reason – don’t disable it unless absolutely necessary.

The nuclear option is to turn off DNSSEC checks entirely, or switch to using DNS servers that don’t support it in the first place (I recommend neither).

On Fedora 36 with systemd-resolved, this means editing /etc/systemd/resolved.conf and adding DNSSEC=no under [Resolve].


Posted

in

, ,

by

Comments

5 responses to “TeamViewer (sometimes) doesn’t work with DNSSEC enabled”

  1. Frankie Avatar
    Frankie

    Hello,

    I tested it with Fedora 36 VM, but it works, see on https://ibb.co/7rxdfxz

    BR,
    Frankie

    1. quppa Avatar

      Just to confirm – are you using Cloudflare or Google DNS? DNS=1.1.1.1 DNSSEC=yes under [Resolve] in /etc/systemd/resolved.conf

  2. Frankie Avatar
    Frankie

    Yes, it`s configured, also Cloudflare as DNS, also dig results looks fine

    1. quppa Avatar

      Thanks, you’re completely correct – I tested in a new Fedora 37 VM with the same settings my machine originally had (Cloudflare DNS, DNSSEC=yes) and all the router*.teamviewer.com domains resolve fine. I turned on DNSSEC again on the original Fedora 36 machine and it also works.

      Looking back through my TeamViewer log file, it looks like it’s intermittent – DNS wasn’t working on 2022-08-26, 2022-09-27 and 2022-11-07 (the date of this post), but was working on some other days. No settings were changed, so I’m more confused than ever.

  3. Frankie Avatar
    Frankie

    I will definitely test it again several times in the next 2-3 weeks. Maybe it was really just a coincidence or it was somehow fixed.

Leave a Reply

Your email address will not be published. Required fields are marked *