dnssek.info DNSSEC Outage: 2016-12-12
Updated: December 16, 2016
Overview
This page gives some details on the dnssek.info DNSSEC outage on December 12, 2016. dnssek.info provides what it calls the "DNSSEC EARLY WARNING SYSTEM (DEWS)" for expiring and expired TLD RRSIGs...
Timeline / DNSViz
- 2016-12-12 18:41:01 UTC — expired RRSIGs
- 2016-12-13 00:44:51 UTC — outage debris
- 2016-12-13 05:52:40 UTC — DNSSEC outage over
Google Public DNS
With Google Public DNS, because of DNSSEC, queries fail:
$ dig +dnssec www.dnssek.info @8.8.8.8
; <<>> DiG 9.4.2-P2 <<>> +dnssec www.dnssek.info @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19258
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.dnssek.info. IN A
;; Query time: 414 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Dec 12 18:42:30 2016
;; MSG SIZE rcvd: 44
dnscheck
- dnscheck.labs.nic.cz shows "Not enough valid signatures found for dnssek.info" (requires javascript).
- dnscheck.iis.se shows "Not enough valid signatures found for dnssek.info" (requires javascript).
Zonemaster
- zonemaster.net archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature has expired)."
- zonemaster.fr archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature has expired)."
Logfile examples
- [1481568017] unbound[72824:0] info: validation failure <dnssek.info. A IN>: signature expired from 106.187.89.79 for key dnssek.info. while building chain of trust
- [1481589686] unbound[72824:0] info: validation failure <dnssek.info. A IN>: signature expired from 106.187.89.79 for key dnssek.info. while building chain of trust
- [1481589702] unbound[72824:0] info: validation failure <www.dnssek.info. A IN>: key for validation dnssek.info. is marked as invalid because of a previous validation failure <dnssek.info. A IN>: signature expired from 106.187.89.79 for key dnssek.info. while building chain of trust