I installed gpg4win version 5.0.2. Also tried an earlier version 4.4.1 after uninstalling 5.0.2
C:\\Program Files (x86)\\GnuPG\\bin>gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
gpg: error retrieving ‘torbrowser@torproject.org’ via WKD: Server indicated a failure
gpg: error reading key: Server indicated a failure
If I go to https://keys.openpgp.org and search ‘torbrowser@torproject.org’ - that works. It only fails on the commandline, and subsequently kleopatra ofc.
Is there a magic port number or something I am missing? Is there a Windows service gpg relies on?
I did notice the 3 GnuPG daemons are 32 bit. Same for the net access daemon. But that shouldn’t matter, right?
If you use the option --auto-key-locate nodefault,wkd you explicitly tell GnuPG not to contact any keyserver but only use WKD to fetch a key. If you want to include keyservers you have to add it to the parameters like this --auto-key-locate nodefault,wkd,keyserver.
Adding ‘keyserver’ to MECHANISMS still produces the same errors, +1
\>gpg --auto-key-locate nodefault,wkd,keyserver --locate-keys torbrowser@torproject.org
gpg: error retrieving ‘torbrowser@torproject.org’ via WKD: Server indicated a failure
gpg: error retrieving ‘torbrowser@torproject.org’ via keyserver: Server indicated a failure
gpg: error reading key: Server indicated a failure
That command works here with Gpg4win 5.0.2. without configuring any keyserver, via WKD. And the variant with keyserver works, too. As a lot of projects have problems due to crawlers, I suspect your IP might be blocked by both servers, the WKD server from the TOR project and the keyserver keys.openpgp.org. Please inquire there if you have repeatedly no success contacting the servers.
I had already tried that. Initial run looks for the dirmngr daemon. After that, just the errors.
% gpg -v --dry-run --auto-key-locate nodefault,wkd,keyserver --locate-keys torbrowser@torproject.org
gpg: enabled compatibility flags:
gpg: using pgp trust model
gpg: no running dirmngr - starting ‘C:\\Program Files (x86)\\GnuPG\\bin\\dirmngr.exe’
gpg: waiting for the dirmngr to come up … (8s)
gpg: connection to the dirmngr established
gpg: error retrieving ‘torbrowser@torproject.org’ via WKD: Server indicated a failure
gpg: error retrieving ‘torbrowser@torproject.org’ via keyserver: Server indicated a failure
gpg: error reading key: Server indicated a failure
I uninstalled the older version and re-installed 5.0.2
% gpg --auto-key-locate nodefault,wkd,keyserver --locate-keys torbrowser@torproject.org
gpg: error retrieving ‘torbrowser@torproject.org’ via WKD: Server indicated a failure
gpg: error retrieving ‘torbrowser@torproject.org’ via keyserver: Server indicated a failure
gpg: error reading key: Server indicated a failure
I set the keyserver to pgpkeys.eu (I also tried keys.openpgp.org)
I suspect the requests are not leaving the machine if the logs are showing no contact. There’s nothing in my firewall blocking outbound requests. It does not seem to be a permissions problem.
First, check if there is a file called dirmngr.conf in C:/Users/your_user_name/AppData/Roaming/gnupg/. If not create one. Then write the following content into it:
(Of couse you can choose a different path for log-file.)
Then stop the dirmngr with dirmngr --shutdown and start it with dirmngr --daemon. Then run the command to fetch the key again and look into the log file. Can you find something that might help to understand the problem?
dirmngr.conf: keyserver hkps://pgpkeys.eu
% gpg --auto-key-locate nodefault,wkd,keyserver --locate-keys torbrowser@torproject.org
gpg: error retrieving 'torbrowser@torproject.org' via WKD: Server indicated a failure
gpg: error retrieving 'torbrowser@torproject.org' via keyserver: Server indicated a failure
gpg: error reading key: Server indicated a failure
logfile:
-----
2026-04-22 07:12:47 dirmngr[2396] listening on socket 'C:\\Users\user\\AppData\\Local\\gnupg\\S.dirmngr'
2026-04-22 07:12:47 dirmngr[2396] error loading certificate 'ROOT': Certificate expired
... above line repeated 14 more times...
2026-04-22 07:12:47 dirmngr[2396] error loading certificate 'CA': Certificate expired
... above line repeated 2 more times...
2026-04-22 07:12:47 dirmngr[2396] permanently loaded certificates: 63
2026-04-22 07:12:47 dirmngr[2396] runtime cached certificates: 0
2026-04-22 07:12:47 dirmngr[2396] trusted certificates: 63 (63,0,0,0)
2026-04-22 07:13:00 dirmngr[2396] handler for fd 680 started
2026-04-22 07:13:00 dirmngr[2396] DBG: dns: libdns initialized (tor mode)
2026-04-22 07:13:20 dirmngr[2396] DBG: dns: resolve_dns_name(openpgpkey.torproject.org): Server indicated a failure
2026-04-22 07:13:20 dirmngr[2396] DBG: dns: libdns initialized (tor mode)
2026-04-22 07:13:30 dirmngr[2396] DBG: dns: getsrv(_openpgpkey._tcp.torproject.org): Server indicated a failure
2026-04-22 07:13:30 dirmngr[2396] DBG: Using TLS library: NTBTLS 0.3.2
2026-04-22 07:13:30 dirmngr[2396] DBG: check_inet_support: family: 23
2026-04-22 07:13:30 dirmngr[2396] DBG: check_inet_support: addr: ::1
2026-04-22 07:13:30 dirmngr[2396] DBG: check_inet_support: family: 2
2026-04-22 07:13:30 dirmngr[2396] DBG: check_inet_support: addr: [ MY LOCAL IP ]
2026-04-22 07:13:30 dirmngr[2396] detected interfaces: IPv4
2026-04-22 07:13:30 dirmngr[2396] DBG: http.c:connect_server: trying name='torproject.org' port=443
2026-04-22 07:13:50 dirmngr[2396] DBG: dns: resolve_dns_name(torproject.org): Server indicated a failure
2026-04-22 07:13:50 dirmngr[2396] resolving 'torproject.org' failed: Server indicated a failure
2026-04-22 07:13:50 dirmngr[2396] can't connect to 'torproject.org': host not found
2026-04-22 07:13:50 dirmngr[2396] error connecting to 'https://torproject.org/.well-known/openpgpkey/hu/kounek7zrdx745qydx6p59t9mqjpuhdf?l=torbrowser': Server indicated a failure
2026-04-22 07:13:50 dirmngr[2396] command 'WKD_GET' failed: Server indicated a failure
2026-04-22 07:14:02 dirmngr[2396] DBG: dns: getsrv(_pgpkey-https._tcp.pgpkeys.eu): Server indicated a failure
2026-04-22 07:14:02 dirmngr[2396] command 'KS_GET' failed: Server indicated a failure <Unspecified source>
2026-04-22 07:14:02 dirmngr[2396] handler for fd 680 terminated
-----
% nslookup openpgpkey.torproject.org
Non-authoritative answer:
Name: static.torproject.org
Addresses: 2620:7:6002:0:466:39ff:fe32:e3dd
2620:7:6002:0:466:39ff:fe7f:1826
2a01:4f8:fff0:4f:266:37ff:fe2c:5d19
2a01:4f8:fff0:4f:266:37ff:feae:3bbc
2a01:4f9:c010:19eb::1
95.216.163.36
116.202.120.165
116.202.120.166
204.8.99.144
204.8.99.146
Aliases: openpgpkey.torproject.org
% nslookup torproject.org
Non-authoritative answer:
Name: torproject.org
Addresses: 2620:7:6002:0:466:39ff:fe32:e3dd
2620:7:6002:0:466:39ff:fe7f:1826
2a01:4f8:fff0:4f:266:37ff:fe2c:5d19
2a01:4f8:fff0:4f:266:37ff:feae:3bbc
2a01:4f9:c010:19eb::1
95.216.163.36
116.202.120.165
116.202.120.166
204.8.99.144
204.8.99.146
primary dns is cloudflare: 1.1.1.1
The only things that stand out to my untrained eyes, are the failure to resolve torproject.org, and the Unspecified source for the keyserver. But I don’t know what might cause those.
For the record, I’ve not seen a successful log file to compare to.
Yes, I’m on Linux and yes the code is different but the steps should be the same so I’d expect that the logs were not too different.
Another one is 2026-04-22 07:13:30 dirmngr[2396] DBG: Using TLS library: NTBTLS 0.3.2
vs 2026-04-22 16:33:38 dirmngr[20040.6] DBG: Using TLS library: GNUTLS 3.8.3.
But since eeeb cannot reproduce this on their machine I don’t think it’s the fault of the TLS library.
No, no proxy here. The IP on my router matches the IP WhatsMyIP.org tells me.
But I did find this: I removed Cloudflare as my DNS provider (1.1.1.1) and went with the default from my ISP. Rebooted and ‘lo and behold’ the query works. “It’s always DNS.”
I am off to ask Matthew Prince why, but before I go, thank you to Herr Klassen and eebb for your invaluable assistance.
2026-04-23 09:41:44 dirmngr[6056] DBG: dns: dnsserver[0] 'x.x.x.x'
2026-04-23 09:41:44 dirmngr[6056] DBG: dns: libdns initialized
2026-04-23 09:41:44 dirmngr[6056] DBG: dns: resolve_dns_name(openpgpkey.torproject.org): Success
2026-04-23 09:41:44 dirmngr[6056] DBG: Using TLS library: NTBTLS 0.3.2
2026-04-23 09:41:44 dirmngr[6056] DBG: check_inet_support: family: 23
2026-04-23 09:41:44 dirmngr[6056] DBG: check_inet_support: addr: ::1
2026-04-23 09:41:44 dirmngr[6056] DBG: check_inet_support: family: 2
2026-04-23 09:41:44 dirmngr[6056] DBG: check_inet_support: addr: [ MY LOCAL IP ]
2026-04-23 09:41:44 dirmngr[6056] detected interfaces: IPv4
2026-04-23 09:41:44 dirmngr[6056] DBG: http.c:connect_server: trying name='openpgpkey.torproject.org' port=443
2026-04-23 09:41:46 dirmngr[6056] DBG: dns: resolve_dns_name(openpgpkey.torproject.org): Success
2026-04-23 09:41:46 dirmngr[6056] DBG: http.c:2893:socket_new: object 0x00000000030ffb10 for fd 964 created
2026-04-23 09:41:46 dirmngr[6056] certificate cached
2026-04-23 09:41:46 dirmngr[6056] Note: non-critical certificate policy not allowed
2026-04-23 09:41:46 dirmngr[6056] DBG: find_cert_bysubject: certificate found in the cache by subject DN
2026-04-23 09:41:46 dirmngr[6056] certificate is good
2026-04-23 09:41:46 dirmngr[6056] Note: non-critical certificate policy not allowed
2026-04-23 09:41:46 dirmngr[6056] DBG: find_cert_bysubject: certificate found in the cache by subject DN
2026-04-23 09:41:46 dirmngr[6056] certificate is good
2026-04-23 09:41:46 dirmngr[6056] root certificate is good and trusted
2026-04-23 09:41:46 dirmngr[6056] certificate chain is good
2026-04-23 09:41:46 dirmngr[6056] certificate #008210CFB0D240E3594463E0BB63828B00/CN=ISRG Root X1,O=Internet Security Research Group,C=US
2026-04-23 09:41:46 dirmngr[6056] certificate #00C212324B70A9B49171DC40F7E285263C/CN=ISRG Root X1,O=Internet Security Research Group,C=US
2026-04-23 09:41:46 dirmngr[6056] certificate #0699BEB6585F7F8A34C5A015B2E1E5F563FD/CN=R12,O=Let's Encrypt,C=US
2026-04-23 09:41:46 dirmngr[6056] target certificate is valid
....
