berkeley.edu partial DNSSEC Outage: 2016-12-06
Updated: December 10, 2016
Overview
This page gives some details on the berkeley.edu partial DNSSEC outage on December 6, 2016.
Additionally, it shows the ucberkeley.edu DNSSEC outage from December 6 onward.
Timeline / DNSViz
- 2016-12-06 07:08:37 UTC — first personally observed berkeley.edu DNSSEC failure (bnrg.eecs.berkeley.edu)
- 2016-12-06 07:28:17 UTC — math.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 09:34:00 UTC — its.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 11:09:11 UTC — mcb.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 12:13:23 UTC — ucberkeley.edu bogus DNSSEC delegation
- 2016-12-06 12:14:28 UTC — law.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 13:11:43 UTC — ischool.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 13:16:56 UTC — stat.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 14:33:11 UTC — grad.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 15:28:16 UTC — math.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 16:08:41 UTC — elsa.berkeley.edu bogus DNSSEC
- 2016-12-06 16:10:44 UTC — twitter.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 16:11:07 UTC — africam.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 16:11:34 UTC — ggia.berkeley.edu bogus DNSSEC
- 2016-12-06 17:33:51 UTC — its.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 19:09:50 UTC — mcb.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 20:14:07 UTC — law.berkeley.edu bogus DNSSEC delegation
- 2016-12-06 21:16:32 UTC — stat.berkeley.edu bogus DNSSEC delegation
- 2016-12-07 12:13:26 UTC — ucberkeley.edu bogus DNSSEC delegation
- 2016-12-08 12:12:35 UTC — ucberkeley.edu bogus DNSSEC delegation
- 2016-12-09 12:12:38 UTC — ucberkeley.edu bogus DNSSEC delegation
- 2016-12-08 22:57:57 UTC — berkeley.edu numerious DNSSEC issues
- 2016-12-09 00:19:12 UTC — berkeley.edu unsigned
dnscheck
- dnscheck.labs.nic.cz doesn't see any problems.
- dnscheck.iis.se reports "Not enough valid signatures over SOA RRset found for glb.nist.gov."
Zonemaster
- zonemaster.net notes "Server[s]... sent 0 DNSKEY records, and 0 RRSIG records."
Logfile examples
- [1481009076] unbound[50532:0] info: validation failure <math.berkeley.edu. A IN>: no signatures from 128.253.35.148 for key math.berkeley.edu. while building chain of trust
- [1481011667] unbound[50532:0] info: validation failure <stat.berkeley.edu. A IN>: no signatures from 128.32.136.3 for key stat.berkeley.edu. while building chain of trust
- [1481011860] unbound[50532:0] info: validation failure <ucberkeley.edu. A IN>: no signatures from 128.253.35.148 for key ucberkeley.edu. while building chain of trust
- [1481024814] unbound[50532:0] info: validation failure <bnrg.eecs.berkeley.edu. A IN>: no signatures from 128.32.136.3 for key ist.berkeley.edu. while building chain of trust
- [1481025229] unbound[50532:0] info: validation failure <elsa.berkeley.edu. A IN>: no signatures from 128.32.136.14 for key econ.berkeley.edu. while building chain of trust
- [1482165878] unbound[85059:0] info: validation failure <ucberkeley.edu. A IN>: no signatures from 128.253.35.148 for key ucberkeley.edu. while building chain of trust