time.nist.gov intermittent DNSSEC Outage: 2016-12-07 - 2016-12-16

Updated: December 20, 2016

Overview

This page gives some details on the time.nist.gov partial DNSSEC outage from December 7 to December 16, 2016. It was not the first DNSSEC outage for time.nist.gov.

Timeline / DNSViz

• 2016-12-07 23:31:33 UTC — first personally observed time.nist.gov DNSSEC failure
• 2016-12-08 05:06:14 UTC — various DNSSEC errors

dnscheck

• dnscheck.labs.nic.cz doesn't see any problems.
• dnscheck.iis.se reports "Not enough valid signatures over SOA RRset found for glb.nist.gov."

Zonemaster

• zonemaster.net notes "Server[s]... sent 0 DNSKEY records, and 0 RRSIG records." This is confusing because there should be RRSIGs.

Logfile examples

• [1481153493] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481169838] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481172429] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481173742] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481174369] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481175004] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481174369] unbound[48970:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481255565] unbound[60808:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481364338] unbound[38548:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481437593] unbound[6473:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481552979] unbound[6473:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481619233] unbound[2749:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481737157] unbound[71527:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481778749] unbound[11079:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust
• [1481861327] unbound[11079:0] info: validation failure <time.nist.gov. A IN>: no NSEC3 closest encloser from 132.163.4.64 for DS ntp1.glb.nist.gov. while building chain of trust