nasa.gov DNSSEC Outage: 2017-10-07

Updated: October 8, 2017

Overview

This page gives some details on the nasa.gov DNSSEC outage on October 7, 2017.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from October 7, 2017:

October 7, 2017 nasa.gov DNSSEC outage

Zonemaster

DNS-OARC: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

With DNSSEC, DNS queries fail:

$ dig +dnssec a nasa.gov. @184.105.193.73

; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec a nasa.gov. @184.105.193.73
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 52189
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;nasa.gov. IN A

;; Query time: 532 msec
;; SERVER: 184.105.193.73#53(184.105.193.73)
;; WHEN: Sat Oct 07 12:05:40 UTC 2017
;; MSG SIZE rcvd: 37


You have to disable DNSSEC to make DNS queries work:

$ dig +cd a nasa.gov. @184.105.193.73

; <<>> DiG 9.10.3-P4-Debian <<>> +cd a nasa.gov. @184.105.193.73
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35093
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 7

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nasa.gov. IN A

;; ANSWER SECTION:
nasa.gov. 595 IN A 52.0.14.116

;; AUTHORITY SECTION:
nasa.gov. 86393 IN NS ns1.nasa.gov.
nasa.gov. 86393 IN NS ns3.nasa.gov.
nasa.gov. 86393 IN NS ns2.nasa.gov.

;; ADDITIONAL SECTION:
ns1.nasa.gov. 86393 IN A 198.116.4.189
ns2.nasa.gov. 86393 IN A 198.116.4.185
ns3.nasa.gov. 86393 IN A 198.116.4.181
ns1.nasa.gov. 86393 IN AAAA 2001:4d0:8300:401::189
ns2.nasa.gov. 86393 IN AAAA 2001:4d0:2300:401::185
ns3.nasa.gov. 86393 IN AAAA 2001:4d0:6300:401::181

;; Query time: 532 msec
;; SERVER: 184.105.193.73#53(184.105.193.73)
;; WHEN: Sat Oct 07 12:05:45 UTC 2017
;; MSG SIZE rcvd: 239

Logfile examples