.mm (Myanmar) DNSSEC Outage: 2016-03-02 to 2016-04-05
Updated: April 5, 2016
Overview
This page gives some details on the .mm (Myanmar) TLD DNSSEC outage from April 2 to April 5, 2016. It lasted approximately 70 hours.
Timeline / DNSViz
- 2016-04-02 06:32:52 UTC — RRSIGs expire
- 2016-04-02 06:34:19 UTC — expired RRSIGs
- 2016-04-02 12:12:14 UTC — expired RRSIGs
- 2016-04-02 19:31:59 UTC — expired RRSIGs
- 2016-04-02 23:40:45 UTC — expired RRSIGs
- 2016-04-03 03:48:37 UTC — expired RRSIGs
- 2016-04-03 08:08:36 UTC — expired RRSIGs
- 2016-04-03 12:36:38 UTC — expired RRSIGs
- 2016-04-03 17:42:42 UTC — expired RRSIGs
- 2016-04-03 21:48:37 UTC — expired RRSIGs
- 2016-04-04 01:55:20 UTC — expired RRSIGs
- 2016-04-04 06:46:31 UTC — expired RRSIGs
- 2016-04-04 09:14:41 UTC — expired RRSIGs
- 2016-04-04 14:36:04 UTC — expired RRSIGs
- 2016-04-04 18:53:02 UTC — expired RRSIGs
- 2016-04-04 22:59:09 UTC — expired RRSIGs
- 2016-04-05 03:48:52 UTC — expired RRSIGs
- 2016-04-05 04:44:00 UTC — last personally observed DNSSEC failure
- 2016-04-05 08:08:14 UTC — DNSSEC outage over
DNSSEC Debugger
Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from April 2, 2016:
OpenDNS & Google Public DNS
OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under .mm during this outage.
With OpenDNS, queries succeed:
$ dig www.google.com.mm. @resolver1.opendns.com
; <<>> DiG 9.4.2-P2 <<>> www.google.com.mm. @resolver1.opendns.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14421
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.google.com.mm. IN A
;; ANSWER SECTION:
www.google.com.mm. 300 IN A 216.58.216.99
;; Query time: 23 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Sat Apr 2 19:22:12 2016
;; MSG SIZE rcvd: 51
With Google Public DNS, because of DNSSEC, queries fail:
$ dig +dnssec www.google.com.mm. @8.8.8.8
; <<>> DiG 9.4.2-P2 <<>> +dnssec www.google.com.mm. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 64826
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.google.com.mm. IN A
;; Query time: 603 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Apr 2 19:22:13 2016
;; MSG SIZE rcvd: 46
dnscheck
dnscheck.iis.se shows expired signatures at 2016-04-02 06:34:15 (requires javascript).
dnscheck.labs.nic.cz shows expired signatures at 2016-04-02 06:34:50 (requires javascript).
Zonemaster
Zonemaster archived this .mm TLD DNSSEC outage.
Logfile examples
- [1459579981] unbound[20428:0] info: validation failure <google.com.mm. A IN>: signature expired from 193.0.9.96 for key mm. while building chain of trust
- [1459831440] unbound[20428:0] info: validation failure <mm. NS IN>: signature expired from 203.81.81.85 for key mm. while building chain of trust