firmdale DNSSEC Outage: 20141206

Date: December 6, 2014

Overview

This page gives some details on the firmdale TLD DNSSEC outage of December 6, 2014. It lasted roughly 5.5 hours.

Timeline

Verisign's DNSSEC Debugger

Here's a screenshot I took of the DNSSEC Debugger output:

firmdale TLD DNSSEC outage 2014-12-06

OpenDNS vs. Google Public DNS

While Google Public DNS supports DNSSEC, OpenDNS supports the superior DNSCurve, which is (among other advantages) immune to DNSSEC failures. During this outage, Google failed to resolve names under firmdale while OpenDNS worked normally.

With OpenDNS, queries succeed:

$ dig whois.nic.firmdale @resolver1.opendns.com

; <<>> DiG 9.4.2-P2 <<>> whois.nic.firmdale @resolver1.opendns.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17863
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;whois.nic.firmdale. IN A

;; ANSWER SECTION:
whois.nic.firmdale. 3600 IN A 103.19.25.195

;; Query time: 237 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Sat Dec 6 15:57:50 2014
;; MSG SIZE rcvd: 52


With Google Public DNS, queries fail:

$ dig whois.nic.firmdale @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> whois.nic.firmdale @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2307
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;whois.nic.firmdale. IN A

;; Query time: 527 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Dec 6 15:58:29 2014
;; MSG SIZE rcvd: 36

dnscheck.iis.se

dnscheck.iis.se keeps an archive that requires javascript to be viewed. Have a look at dnscheck's view of the firmdale outage.

Logfile examples