.mg TLD DNSSEC Outage: 2017-05-20
Date: May 20, 2017
Overview
This page gives some details on the .mg (Madagascar) TLD DNSSEC outage on May 20, 2017.
Timeline / DNSViz
- 2017-05-20 03:57:24 UTC — Signature inception field is in the future
- 2017-05-20 04:05:30 UTC — Signature inception field is in the future
- 2017-05-20 04:11:40 UTC — Signature inception field is in the future
Zonemaster
- zonemaster.net archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature not incepted yet)."
- zonemaster.fr archived "Delegation from parent to child is not properly signed (signature: DNSSEC signature not incepted yet)."
drill trace
;; Number of trusted keys: 1
;; Domain: .
[T] . 172800 IN DNSKEY 256 3 8 ;{id = 14796 (zsk), size = 2048b}
. 172800 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b}
Checking if signing key is trusted:
New key: . 172800 IN DNSKEY 256 3 8 AwEAAZLsvvPf/WDYE8L8ZUOiXEN9PSg3Nqyqu8WWKVu4LIvPW77Y0W1mBgmroFEHxzA9zM2edQbYIFhj536sx3fj1bx4n8yKwQ0y1MYkXvgU3aKWf0jnm8qz5RPVa4iEUgP5og/70muAXmo38Ru10asc3SNtN2OlAT1Tivp+U4JUlVA8ICvierUPg2Kgf2gtNFhuqMTx/IHrE5DdV+Z/rmHGqESe/mnaDzHdFnKy7Ma5zcPTekmwZ86CnG+vNWMT6wiO56YSAaiHX0jSCjmkL7JzT3xpp/vtoWLK1rir70i6NbsU48sPZOHLfhwzbownewAsng0QqMOcVcmhl6ifE3C/vjE= ;{id = 14796 (zsk), size = 2048b}
Trusted key: . 172800 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b}
Trusted key: . 172800 IN DNSKEY 256 3 8 AwEAAZLsvvPf/WDYE8L8ZUOiXEN9PSg3Nqyqu8WWKVu4LIvPW77Y0W1mBgmroFEHxzA9zM2edQbYIFhj536sx3fj1bx4n8yKwQ0y1MYkXvgU3aKWf0jnm8qz5RPVa4iEUgP5og/70muAXmo38Ru10asc3SNtN2OlAT1Tivp+U4JUlVA8ICvierUPg2Kgf2gtNFhuqMTx/IHrE5DdV+Z/rmHGqESe/mnaDzHdFnKy7Ma5zcPTekmwZ86CnG+vNWMT6wiO56YSAaiHX0jSCjmkL7JzT3xpp/vtoWLK1rir70i6NbsU48sPZOHLfhwzbownewAsng0QqMOcVcmhl6ifE3C/vjE= ;{id = 14796 (zsk), size = 2048b}
Key is now trusted!
Trusted key: . 172800 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b}
[T] mg. 86400 IN DS 64652 5 2 f55dcb5946c539f71b13fa83491864f672fc65589b313fc99dd65e4f14f8a8b3
;; Domain: mg.
[B] mg. 3600 IN DNSKEY 256 3 5 ;{id = 33060 (zsk), size = 1024b}
mg. 3600 IN DNSKEY 257 3 5 ;{id = 64652 (ksk), size = 2048b}
[B] Error verifying denial of existence for mg. type A: No keys with the keytag and algorithm from the RRSIG found
;;[S] self sig OK; [B] bogus; [T] trusted
Logfile examples
- [1495253120] unbound[42253:0] info: validation failure <mg. NS IN>: signature before inception date from 199.19.5.24 for key mg. while building chain of trust
- [1495254791] unbound[42253:0] info: validation failure <mg. NS IN>: signature before inception date from 196.192.32.2 for key mg. while building chain of trust