dnssec-name-and-shame.com DNSSEC Outage:
2017-09-14 to 2017-09-18

Updated: September 18, 2017

Overview

This page gives some details on the dnssec-name-and-shame.com DNSSEC outage from September 14 to September 18, 2017. This is not their first DNSSEC outage.

Timeline / DNSViz

2017-09-14 09:10:10 UTC — dnssec-name-and-shame.com/A RRSIG expires
2017-09-14 09:10:27 UTC — expired RRSIG
2017-09-14 09:12:11 UTC — expired RRSIG
2017-09-14 09:13:05 UTC — expired RRSIG
2017-09-14 09:14:35 UTC — expired RRSIG
2017-09-14 09:15:03 UTC — expired RRSIG
2017-09-14 09:17:24 UTC — expired RRSIG
2017-09-14 13:25:08 UTC — expired RRSIG
2017-09-15 02:31:20 UTC — expired RRSIGs (for both A and NS records)
2017-09-16 01:47:58 UTC — first personally observed bogus DNSKEY; complete DNSSEC outage
2017-09-16 05:08:02 UTC — expired RRSIGs; complete DNSSEC outage
2017-09-16 05:35:03 UTC — expired RRSIGs; complete DNSSEC outage
2017-09-17 17:36:40 UTC — expired RRSIGs; complete DNSSEC outage
2017-09-17 17:37:19 UTC — expired RRSIGs; complete DNSSEC outage
2017-09-18 02:24:01 UTC — expired RRSIGs; complete DNSSEC outage
2017-09-18 07:21:14 UTC — last personally observed DNSSEC failure

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from September 16, 2017:

September 16, 2017 dnssec-name-and-shame.com DNSSEC outage

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

;; Domain: dnssec-name-and-shame.com.
[T] dnssec-name-and-shame.com. 3600 IN DNSKEY 257 3 7 ;{id = 52335 (ksk), size = 2048b}
dnssec-name-and-shame.com. 3600 IN DNSKEY 257 3 7 ;{id = 11841 (ksk), size = 2048b}
dnssec-name-and-shame.com. 3600 IN DNSKEY 256 3 7 ;{id = 46764 (zsk), size = 1024b}
[B] dnssec-name-and-shame.com. 3600 IN A 185.49.141.38
;; Error: DNSSEC signature has expired

Google Public DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

With DNSSEC, DNS queries fail:

$ dig +dnssec dnssec-name-and-shame.com. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec dnssec-name-and-shame.com. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 40247
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;dnssec-name-and-shame.com. IN A

;; Query time: 453 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Sep 14 14:10:49 2017
;; MSG SIZE rcvd: 54

You have to disable DNSSEC to make DNS queries work:

$ dig +cd dnssec-name-and-shame.com. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +cd dnssec-name-and-shame.com. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45591
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;dnssec-name-and-shame.com. IN A

;; ANSWER SECTION:
dnssec-name-and-shame.com. 3599 IN A 185.49.141.38

;; Query time: 290 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Sep 14 14:10:49 2017
;; MSG SIZE rcvd: 59

Logfile examples

[1505397883] unbound[86237:0] info: validation failure <www.dnssec-name-and-shame.com. A IN>: signature expired from 185.49.141.40 and 185.49.141.40
[1505398173] unbound[86237:0] info: validation failure <dnssec-name-and-shame.com. A IN>: signature expired from 185.49.141.40
[1505526478] unbound[76884:0] info: validation failure <www.dnssec-name-and-shame.com. A IN>: signature expired from 185.49.141.40 for key dnssec-name-and-shame.com. while building chain of trust
[1505719274] unbound[48568:0] info: validation failure <dnssec-name-and-shame.com. A IN>: signature expired from 185.49.140.10 for key dnssec-name-and-shame.com. while building chain of trust