iastate.edu DNSSEC Outage: 2017-05-12 - 2017-05-13

Updated: May 13, 2017

Overview

This page gives some details on the iastate.edu (Iowa State University) DNSSEC outage from May 12 to May 13, 2017.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from May 13, 2017:

May 13, 2017 iastate.edu DNSSEC outage

Zonemaster

OpenDNS & Google Public DNS

OpenDNS does not support DNSSEC, and instead supports DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under iastate.edu during this outage.

With OpenDNS, without DNSSEC, queries succeed:

$ dig mx iastate.edu. @resolver1.opendns.com.

; <<>> DiG 9.4.2-P2 <<>> mx iastate.edu. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30987
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;iastate.edu. IN MX

;; ANSWER SECTION:
iastate.edu. 900 IN MX 10 mailin.iastate.edu.

;; Query time: 13 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Sat May 13 04:17:13 2017
;; MSG SIZE rcvd: 52

With Google Public DNS, because of DNSSEC, queries fail:

$ dig +dnssec mx iastate.edu. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec mx iastate.edu. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 24332
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;iastate.edu. IN MX

;; Query time: 55 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat May 13 04:17:01 2017
;; MSG SIZE rcvd: 40

Logfile examples