tinydnssec.org DNSSEC Outage: 2017-01-23

Updated: January 24, 2017

Overview

This page gives some details on the tinydnssec.org DNSSEC outage on January 23, 2017.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from January 23, 2017:

January 23, 2017 tinydnssec.org DNSSEC outage

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under tinydnssec.org during this outage.

With OpenDNS, queries succeed:

$ dig tinydnssec.org @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> tinydnssec.org @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53115
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;tinydnssec.org. IN A

;; ANSWER SECTION:
tinydnssec.org. 86400 IN A 81.7.11.13

;; Query time: 147 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Mon Jan 23 23:05:55 2017
;; MSG SIZE rcvd: 48

With Google Public DNS, because of DNSSEC, queries fail:

$ dig +dnssec tinydnssec.org @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec tinydnssec.org @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41187
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;tinydnssec.org. IN A

;; Query time: 201 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jan 23 23:05:55 2017
;; MSG SIZE rcvd: 43

dnscheck

dnscheck.labs.nic.cz found expired signatures and "Not enough valid signatures found for tinydnssec.org" (requires javascript).

dnscheck.iis.se found expired signatures and "Not enough valid signatures found for tinydnssec.org" (requires javascript).

Zonemaster

zonemaster.net archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature has expired)."

zonemaster.fr archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature has expired)."

Logfile examples