smart TLD DNSSEC Outage: 2016-10-06
Updated: October 8, 2016
Overview
This page gives some details on the .smart TLD DNSSEC outage on October 6, 2016.
Timeline / DNSViz
- 2016-10-06 00:18:50 UTC — bogus DNSSEC delegation
- 2016-10-06 00:24:18 UTC — bogus DNSSEC delegation
- 2016-10-06 01:59:32 UTC — bogus DNSSEC delegation
- 2016-10-06 08:39:41 UTC — bogus DNSSEC delegation
- 2016-10-06 08:55:23 UTC — bogus DNSSEC delegation
- 2016-10-06 12:10:40 UTC — bogus DNSSEC delegation
- 2016-10-06 12:48:14 UTC — bogus DNSSEC delegation
- 2016-10-06 14:43:10 UTC — bogus DNSSEC delegation
- 2016-10-06 20:32:04 UTC — bogus DNSSEC delegation
- 2016-10-06 22:17:01 UTC — bogus DNSSEC delegation
- 2016-10-07 02:35:50 UTC — outage debris, but DNSSEC outage essentially over
- 2016-10-07 20:22:01 UTC — last personnaly observed DNSSEC failure, due to caching
DNSSEC Debugger
Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from October 2, 2016:
OpenDNS & Google Public DNS
OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under smart during this outage.
$ dig ns nic.smart. @resolver1.opendns.com.
; <<>> DiG 9.4.2-P2 <<>> ns nic.smart. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54117
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;nic.smart. IN NS
;; ANSWER SECTION:
nic.smart. 3600 IN NS ns1.nic.smart.
nic.smart. 3600 IN NS apdns3.nic.smart.
nic.smart. 3600 IN NS apdns4.nic.smart.
;; Query time: 56 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Thu Oct 6 01:32:45 2016
;; MSG SIZE rcvd: 87
With Google Public DNS, because of DNSSEC, queries fail:
$ dig +dnssec ns nic.smart. @8.8.8.8
; <<>> DiG 9.4.2-P2 <<>> +dnssec ns nic.smart. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 45745
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;nic.smart. IN NS
;; Query time: 654 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 6 01:32:46 2016
;; MSG SIZE rcvd: 38
dnscheck
- dnscheck.labs.nic.cz shows "The zone smart has published DS records, but none of them work" (requires javascript).
- dnscheck.iis.se shows "The zone smart has published DS records, but none of them work" (requires javascript).
Zonemaster
- zonemaster.net archived "Delegation from parent to child is not properly signed (no_dnskey)."
- zonemaster.fr archived "Delegation from parent to child is not properly signed (no_dnskey)."
Logfile examples
- [1475718657] unbound[23847:0] info: validation failure <dnssec.is.smart. MX IN>: no keys have a DS with algorithm RSASHA256 from 203.87.166.125 for key smart. while building chain of trust
- [1475717791] unbound[69949:0] info: validation failure <smart. NS IN>: no keys have a DS with algorithm RSASHA256 from 194.169.218.70 for key smart. while building chain of trust