tinydnssec.org DNSSEC Outage: 2017-08-12 - 2017-08-14

Updated: August 14, 2017

Overview

This page gives some details on the tinydnssec.org DNSSEC outage from August 12 to August 14, 2017.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from August 12, 2017:

August 12, 2017 www.tinydnssec.org DNSSEC outage

Google Public DNS

With DNSSEC enabled, queries failed. With DNSSEC disabled, queries succeeded.

$ dig +dnssec a www.tinydnssec.org. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec a www.tinydnssec.org. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 7214
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.tinydnssec.org. IN A

;; Query time: 160 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Aug 12 05:09:19 2017
;; MSG SIZE rcvd: 47

You have to disable DNSSEC to get queries to work:

$ dig +cd a www.tinydnssec.org. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +cd a www.tinydnssec.org. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38859
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.tinydnssec.org. IN A

;; ANSWER SECTION:
www.tinydnssec.org. 32211 IN A 81.7.11.13

;; Query time: 8 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Aug 12 05:09:19 2017
;; MSG SIZE rcvd: 52

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

;; Domain: tinydnssec.org.
[T] tinydnssec.org. 86400 IN DNSKEY 257 3 7 ;{id = 1053 (ksk), size = 1304b}
tinydnssec.org. 86400 IN DNSKEY 256 3 7 ;{id = 57752 (zsk), size = 1024b}
[B] Error verifying denial of existence for www.tinydnssec.org. DS: No DNSSEC signature(s)
;; No ds record for delegation
;; Domain: www.tinydnssec.org.
;; No DNSKEY record found for www.tinydnssec.org.
[B] www.tinydnssec.org. 86400 IN A 81.7.11.13
;; Error: Bogus DNSSEC signature
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples

This DNSSEC outage was observed on 4 different resolvers, all on different networks.