libsodium.org DNSSEC Outage: 2016-05-16 to 2016-05-17

Updated: May 17, 2016

Overview

This page gives some details on the libsodium.org DNSSEC outage from May 16 to May 17, 2016.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from May 17, 2016:

May 16, 2016 libsodium.org DNSSEC outage

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under .mm during this outage.

With OpenDNS, queries succeed (dnscrypt.org):

$ dig libsodium.org. @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> libsodium.org. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39178
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;libsodium.org. IN A

;; ANSWER SECTION:
libsodium.org. 10000 IN A 37.59.238.213

;; Query time: 103 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Tue May 17 03:11:21 2016
;; MSG SIZE rcvd: 47

With Google Public DNS, because of DNSSEC, queries fail:

$ dig +dnssec libsodium.org. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec libsodium.org. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36876
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;libsodium.org. IN A

;; Query time: 274 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue May 17 03:11:21 2016
;; MSG SIZE rcvd: 42

dnscheck

Note: dnscheck doesn't support DNSSEC signature algorithm 13, ECDSAP256SHA256. So even correctly configured DNSSEC sites show failure — see this example (cloudflare.com was not failing at the time of this test). The following links are provided for posterity.

dnscheck.labs.nic.cz doesn't support DNSSEC algorithm 13 (requires javascript).

dnscheck.iis.se doesn't support DNSSEC algorithm 13 (requires javascript).

Zonemaster

zonemaster.net archived bogus signatures for libsodium.org.

zonemaster.fr archived bogus signatures for libsodium.org.

Logfile examples