APNIC DNSSEC Outage: 2016-03-15

Updated: March 16, 2016

Overview

This page gives some details on the huge APNIC DNSSEC outage on March 15, 2016. It broke DNSSEC service for 48 in-addr.arpa domains (normal DNS and DNSCurve were unaffected).

APNIC Service Announcement

APNIC released this statement which explained how it happened.

Autonomous Systems Affected

Using Team Cymru's IP to ASN bulk service, all possible netblocks from the list of affected domains below were checked on March 18, and a total of 7381 unique ASNs were found. So this DNSSEC outage affected approximately 7381 autonomous systems, a new record for in-addr.arpa DNSSEC outages.

Affected APNIC in-addr.arpa domains

Although APNIC states that 222.in-addr.arpa failed, IANIX didn't see failures for this domain, and neither did DNSViz. It is therefore not included in the following list:

• 1.in-addr.arpa
• 14.in-addr.arpa
• 27.in-addr.arpa
• 36.in-addr.arpa
• 39.in-addr.arpa
• 42.in-addr.arpa
• 43.in-addr.arpa
• 49.in-addr.arpa
• 58.in-addr.arpa
• 59.in-addr.arpa
• 60.in-addr.arpa
• 61.in-addr.arpa
• 101.in-addr.arpa
• 103.in-addr.arpa
• 106.in-addr.arpa
• 110.in-addr.arpa
• 111.in-addr.arpa
• 112.in-addr.arpa
• 113.in-addr.arpa
• 114.in-addr.arpa
• 115.in-addr.arpa
• 116.in-addr.arpa
• 117.in-addr.arpa
• 118.in-addr.arpa
• 119.in-addr.arpa
• 120.in-addr.arpa
• 121.in-addr.arpa
• 122.in-addr.arpa
• 123.in-addr.arpa
• 124.in-addr.arpa
• 125.in-addr.arpa
• 150.in-addr.arpa
• 153.in-addr.arpa
• 163.in-addr.arpa
• 171.in-addr.arpa
• 175.in-addr.arpa
• 180.in-addr.arpa
• 182.in-addr.arpa
• 183.in-addr.arpa
• 202.in-addr.arpa
• 203.in-addr.arpa
• 210.in-addr.arpa
• 211.in-addr.arpa
• 218.in-addr.arpa
• 219.in-addr.arpa
• 220.in-addr.arpa
• 221.in-addr.arpa
• 223.in-addr.arpa

dns-operations list

This DNSSEC outage was discussed in the thread [dns-operations] APNIC reverse zone are broken.

apnic-talk list

The outage was acknowledged in the thread [apnic-talk] Update on APNIC IPv4 reverse DNS zones validation.

It was also discussed in [apnic-talk] APNIC reverse DNS zones validation.

Twitter

The @apnic Twitter account discussed the DNSSEC outage here and here.