www.nist.gov and time.nist.gov DNSSEC Outage: 2016-08-25 to 2016-08-26

Updated: August 29, 2016


This page gives some details on the www.nist.gov and time.nist.gov DNSSEC outages from August 25 to August 26, 2016. It was not the first DNSSEC outage within nist.gov. This particular outage was caused by a bogus DNSSEC delegation from nist.gov to glb.nist.gov. (CNAMEs for www.nist.gov and time.nist.gov point to www.glb.nist.gov and ntp1.glb.nist.gov, respectively.) All other hosts under glb.nist.gov were failing as well.

Timeline / DNSViz

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under www.nist.gov during this outage.

With OpenDNS, which doesn't support DNSSEC, queries succeed:

$ dig www.nist.gov @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> www.nist.gov @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61620
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;www.nist.gov. IN A

www.nist.gov. 627 IN CNAME www.glb.nist.gov.
www.glb.nist.gov. 30 IN A

;; Query time: 32 msec
;; WHEN: Thu Aug 25 17:27:17 2016
;; MSG SIZE rcvd: 68

With Google Public DNS, because of DNSSEC, queries fail:

$ dig +dnssec www.nist.gov. @

; <<>> DiG 9.4.2-P2 <<>> +dnssec www.nist.gov. @
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49473
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

; EDNS: version: 0, flags: do; udp: 512
;www.nist.gov. IN A

;; Query time: 170 msec
;; WHEN: Thu Aug 25 19:40:06 2016
;; MSG SIZE rcvd: 41



Twitter mentions

Outages mailing list

This outage was brought up in the thread [outages] NIST (time.nist.gov, etc) DNSSEC bogus.

Unbound mailing list

The outage was also discussed in DNSSEC and time.nist.gov on the Unbound mailing list.

Logfile examples