.bw (Botswana) DNSSEC Outage: 20151225 - 20160106

Updated: January 7, 2015

Overview

This page gives some details on the .bw (Botswana) TLD DNSSEC outage from December 25 to January 6, 2016. This 12-day DNSSEC outage disrupted all DNS service under .bw for DNSSEC users.

Timeline / DNSViz

2015-12-25 07:24:35 UTC — RRSIGs expire
2015-12-25 07:26:39 UTC — expired RRSIGs
2015-12-25 11:37:25 UTC — expired RRSIGs
2015-12-26 02:14:57 UTC — expired RRSIGs
2015-12-27 02:29:11 UTC — expired RRSIGs
2015-12-28 02:12:32 UTC — expired RRSIGs
2015-12-29 01:01:51 UTC — expired RRSIGs
2015-12-30 00:25:52 UTC — expired RRSIGs
2015-12-31 05:37:02 UTC — expired RRSIGs
2016-01-01 04:06:36 UTC — expired RRSIGs
2016-01-02 05:17:01 UTC — expired RRSIGs
2016-01-03 10:04:55 UTC — expired RRSIGs
2016-01-03 15:54:01 UTC — bogus DNSSEC delegation
2016-01-04 00:52:29 UTC — bogus DNSSEC delegation
2016-01-05 00:41:45 UTC — bogus DNSSEC delegation
2016-01-06 00:03:57 UTC — bogus DNSSEC delegation
2016-01-06 10:04:54 UTC — bogus DNSSEC delegation
2016-01-06 10:54:27 UTC — last personally observed bw DNSSEC failure
2016-01-06 11:00:44 UTC — DNSSEC outage over

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from December 25, 2015:

December 25 2015 .bw (Botswana) TLD DNSSEC outage

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under .bw during this outage.

With OpenDNS, queries succeed:

$ dig www.google.co.bw. @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> www.google.co.bw. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33857
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.co.bw. IN A

;; ANSWER SECTION:
www.google.co.bw. 300 IN A 216.58.216.195

;; Query time: 28 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Fri Dec 25 14:38:25 2015
;; MSG SIZE rcvd: 50

With Google Public DNS, because of DNSSEC, queries fail:

$ dig www.google.co.bw. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> www.google.co.bw. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 4826
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.co.bw. IN A

;; Query time: 24 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Dec 25 14:38:32 2015
;; MSG SIZE rcvd: 34

dnscheck

dnscheck.iis.se shows expired signatures at 2015-12-25 07:27:06 (requires javascript).

dnscheck.labs.nic.cz shows expired signatures at 2015-12-25 07:27:15 (requires javascript).

Zonemaster

Zonemaster archived this .bw TLD DNSSEC outage.

Logfile examples

[1451030757] unbound[13897:0] info: validation failure <bw. NS IN>: signature expired from 168.167.168.37 for key bw. while building chain of trust
[1451055044] unbound[13897:0] info: validation failure <www.bankofbotswana.bw. A IN>: key for validation bw. is marked as invalid because of a previous validation failure <www.google.co.bw. A IN>: signature expired from 168.167.98.218 for key bw. while building chain of trust