ad TLD DNSSEC Outage: 2017-05-23/24
Updated: May 24, 2017
Overview
This page gives some details on the ad TLD (Andorra) DNSSEC outage from May 23 to May 24, 2017.
Timeline / DNSViz
- 2017-05-23 17:34:02 UTC — Bogus DNSSEC delegation
- 2017-05-23 17:37:50 UTC — Bogus DNSSEC delegation
- 2017-05-23 17:40:15 UTC — Bogus DNSSEC delegation
- 2017-05-23 19:29:47 UTC — Bogus DNSSEC delegation
- 2017-05-23 20:53:14 UTC — Bogus DNSSEC delegation
- 2017-05-23 22:04:16 UTC — Bogus DNSSEC delegation
- 2017-05-23 22:34:02 UTC — Bogus DNSSEC delegation
- 2017-05-24 00:44:42 UTC — Bogus DNSSEC delegation
- 2017-05-24 02:16:38 UTC — DNSSEC outage over
Verisign's DNSSEC Debugger
Verisign doesn't archive test results, so here's a screenshot I took of my web browser's output on May 23, 2017:
dnscheck
- dnscheck.labs.nic.cz archived this ad DNSSEC outage, stating "The zone ad has published DS records, but none of them work."
- dnscheck.iis.se archived this ad DNSSEC outage, stating "The zone ad has published DS records, but none of them work."
Zonemaster
- zonemaster.net archived "Delegation from parent to child is not properly signed (no_dnskey)."
- zonemaster.fr archived "Delegation from parent to child is not properly signed (no_dnskey)."
OpenDNS & Google Public DNS
OpenDNS does not support DNSSEC, and instead supports DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under ad during this outage.
With OpenDNS, queries succeed:
$ dig www.google.ad. @resolver1.opendns.com.
; <<>> DiG 9.4.2-P2 <<>> www.google.ad. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51986
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.google.ad. IN A
;; ANSWER SECTION:
www.google.ad. 300 IN A 216.58.194.195
;; Query time: 61 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Wed May 24 01:01:51 2017
;; MSG SIZE rcvd: 47
With Google Public DNS, because of DNSSEC, queries fail:
; <<>> DiG 9.4.2-P2 <<>> +dnssec www.google.ad. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 28152
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.google.ad. IN A
;; Query time: 192 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed May 24 01:01:51 2017
;; MSG SIZE rcvd: 42
Logfile examples
- [1495560824] unbound[41445:0] info: validation failure <ad. NS IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 204.152.184.64 for key ad. while building chain of trust
- [1495588342] unbound[91810:0] info: validation failure <www.google.ad. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 194.158.74.10 for key ad. while building chain of trust