danyork.com DNSSEC Outage: 2017-02-23
Updated: May 8, 2017
Overview
This page gives some details on the danyork.com DNSSEC outage on February 23. Dan York is a DNSSEC evangelist and Senior Content Strategist at the Internet Society. His DNS is handled by Cloudflare. (The Internet Society had an unrelated, separate DNSSEC outage only a few days before.)
Timeline / DNSViz
- 2017-02-23 14:35:28 UTC — Bogus DNSSEC delegation
- 2017-02-23 14:37:24 UTC — Bogus DNSSEC delegation
OpenDNS & Google Public DNS
OpenDNS does not support DNSSEC, and instead supports DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under danyork.com during this outage.
With OpenDNS, queries succeed:
$ dig danyork.com @resolver1.opendns.com.
; <<>> DiG 9.4.2-P2 <<>> danyork.com @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2418
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;danyork.com. IN A
;; ANSWER SECTION:
danyork.com. 300 IN A 104.28.13.110
danyork.com. 300 IN A 104.28.12.110
;; Query time: 3 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Thu Feb 23 14:35:20 2017
;; MSG SIZE rcvd: 61
With Google Public DNS, because of DNSSEC, queries fail:
$ dig +dnssec danyork.com @8.8.8.8
; <<>> DiG 9.4.2-P2 <<>> +dnssec danyork.com @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 34613
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;danyork.com. IN A
;; Query time: 75 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Feb 23 14:35:20 2017
;; MSG SIZE rcvd: 40
Zonemaster
- zonemaster.net archived "Delegation from parent to child is not properly signed (no_dnskey)."
- zonemaster.fr archived "Delegation from parent to child is not properly signed (no_dnskey)."
Logfile examples
- [1487860503] unbound[341:0] info: validation failure <www.danyork.com. A IN>: no keys have a DS with algorithm RSASHA1 from 173.245.58.114 for key danyork.com. while building chain of trust
- [1487860518] unbound[15919:0] info: validation failure <danyork.com. A IN>: no keys have a DS with algorithm RSASHA1 from 173.245.58.114 for key danyork.com. while building chain of trust
- [1487861117] unbound[15919:0] info: validation failure <www.danyork.com. A IN>: no keys have a DS with algorithm RSASHA1 from 173.245.59.102 for key danyork.com. while building chain of trust