gsu.edu DNSSEC Outage: 2017-01-31
Updated: January 31, 2017
Overview
This page gives some details on the gsu.edu DNSSEC outage on January 31, 2017. At the time of this writing, Georgia State University has more than 53,000 students.
Timeline / DNSViz
- 2017-01-31 13:32:09 UTC — Bogus DNSSEC delegation
- 2017-01-31 13:39:29 UTC — Bogus DNSSEC delegation
- 2017-01-31 17:42:28 UTC — DNSSEC outage over
OpenDNS & Google Public DNS
OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under gsu.edu during this outage.
With OpenDNS, queries succeed:
$ dig gsu.edu @resolver1.opendns.com.
; <<>> DiG 9.4.2-P2 <<>> gsu.edu @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45558
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;gsu.edu. IN A
;; ANSWER SECTION:
gsu.edu. 300 IN A 104.130.251.77
;; Query time: 81 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Tue Jan 31 13:32:04 2017
;; MSG SIZE rcvd: 41
With Google Public DNS, because of DNSSEC, queries fail:
$ dig +dnssec gsu.edu @8.8.8.8
; <<>> DiG 9.4.2-P2 <<>> +dnssec gsu.edu @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 44734
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;gsu.edu. IN A
;; Query time: 125 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jan 31 13:32:04 2017
;; MSG SIZE rcvd: 36
Zonemaster
- zonemaster.net archived "Delegation from parent to child is not properly signed (no_dnskey)."
- zonemaster.fr archived "Delegation from parent to child is not properly signed (no_dnskey)."
Logfile examples
- [1485869520] unbound[86236:0] info: validation failure <gsu.edu. A IN>: no keys have a DS with algorithm RSASHA1 from 198.72.72.10 for key gsu.edu. while building chain of trust
- [1485871248] unbound[86236:0] info: validation failure <cs.gsu.edu. A IN>: no keys have a DS with algorithm RSASHA1 from 198.72.72.11 for key gsu.edu. while building chain of trust
- [1485873261] unbound[86236:0] info: validation failure <gsu.edu. A IN>: no keys have a DS with algorithm RSASHA1 from 131.144.4.10 for key gsu.edu. while building chain of trust