dnssek.info DNSSEC Outage: 2016-10-11 to 2016-10-13

Updated: October 14, 2016

Overview

This page gives some details on the dnssek.info DNSSEC outage from October 11 to October 13, 2016. dnssek.info provides what it calls the "DNSSEC EARLY WARNING SYSTEM (DEWS)" for expiring and expired TLD RRSIGs...

Timeline / DNSViz

2016-10-11 15:33:29 UTC — RRSIGs expire
2016-10-11 15:43:13 UTC — expired RRSIGs
2016-10-11 15:46:54 UTC — expired RRSIGs
2016-10-12 21:52:37 UTC — expired RRSIGs
2016-10-13 13:52:39 UTC — expired RRSIGs
2016-10-13 18:53:01 UTC — last personally observed DNSSEC failure
2016-10-13 21:52:16 UTC — DNSSEC outage over

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from October 11, 2016:

October 11, 2016 dnssek.info DNSSEC outage

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under dnssek.info during this outage.

$ dig www.dnssek.info @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> www.dnssek.info @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14858
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.dnssek.info. IN A

;; ANSWER SECTION:
www.dnssek.info. 3600 IN A 192.101.186.120

;; Query time: 161 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Tue Oct 11 15:43:26 2016
;; MSG SIZE rcvd: 49

With Google Public DNS, because of DNSSEC, queries fail:

$ dig +dnssec www.dnssek.info @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec www.dnssek.info @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59344
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.dnssek.info. IN A

;; Query time: 278 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Oct 11 15:43:26 2016
;; MSG SIZE rcvd: 44

dnscheck

dnscheck.labs.nic.cz shows an expired DNSKEY RRSIG (requires javascript).
dnscheck.iis.se shows an expired DNSKEY RRSIG (requires javascript).

Zonemaster

zonemaster.net archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature has expired).".
zonemaster.fr archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature has expired).".

Logfile examples

[1476210779] unbound[11672:0] info: validation failure <www.dnssek.info. A IN>: signature expired from 192.101.186.19 for key dnssek.info. while building chain of trust
[1476384781] unbound[22029:0] info: validation failure <www.dnssek.info. A IN>: key for validation dnssek.info. is marked as invalid because of a previous validation failure <dnssek.info. A IN>: signature expired from 45.56.97.49 for key dnssek.info. while building chain of trust