af.mil partial DNSSEC Outage: 2014-06-09

Date: June 9, 2014

Overview

This page gives some details on the partial af.mil DNSSEC outage of June 9, 2014.

Verisign's DNSSEC Debugger

Verisign doesn't archive test results, unlike DNSViz. So here's a screenshot I took on June 9, 2014:

af.mil dnssec outage

DNSViz

DNSViz archived DNSSEC issues that don't show the full impact of the outage at 2014-06-10 02:10:51 UTC and 2014-06-10 02:30:04 UTC. Some subdomains, such as hq.af.mil and macdill.af.mil were outright failing.

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for many but not all queries for names under af.mil during this outage.

With OpenDNS, queries succeed:

$ dig mx af.mil @resolver1.opendns.com

; <<>> DiG 9.4.2-P2 <<>> mx af.mil @resolver1.opendns.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10910
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;af.mil. IN MX

;; AUTHORITY SECTION:
af.mil. 500 IN SOA langley-ns10.afnoc.af.mil. dnsman.afnet.af.mil. 2014060802 3600 360 604800 500

;; Query time: 292 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Mon Jun 9 21:18:21 2014
;; MSG SIZE rcvd: 104

With Google Public DNS, queries fail:

$ dig mx af.mil @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> mx af.mil @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 40389
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;af.mil. IN MX

;; Query time: 103 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jun 9 21:18:02 2014
;; MSG SIZE rcvd: 24

Logfile examples