.bw (Botswana) DNSSEC Outage: 20151225 - 20160106

Updated: January 7, 2015

Overview

This page gives some details on the .bw (Botswana) TLD DNSSEC outage from December 25 to January 6, 2016. This 12-day DNSSEC outage disrupted all DNS service under .bw for DNSSEC users.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from December 25, 2015:

December 25 2015 .bw (Botswana) TLD DNSSEC outage

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under .bw during this outage.

With OpenDNS, queries succeed:

$ dig www.google.co.bw. @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> www.google.co.bw. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33857
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.co.bw. IN A

;; ANSWER SECTION:
www.google.co.bw. 300 IN A 216.58.216.195

;; Query time: 28 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Fri Dec 25 14:38:25 2015
;; MSG SIZE rcvd: 50


With Google Public DNS, because of DNSSEC, queries fail:

$ dig www.google.co.bw. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> www.google.co.bw. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 4826
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.co.bw. IN A

;; Query time: 24 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Dec 25 14:38:32 2015
;; MSG SIZE rcvd: 34

dnscheck

dnscheck.iis.se shows expired signatures at 2015-12-25 07:27:06 (requires javascript).

dnscheck.labs.nic.cz shows expired signatures at 2015-12-25 07:27:15 (requires javascript).

Zonemaster

Zonemaster archived this .bw TLD DNSSEC outage.

Logfile examples