nasa.gov DNSSEC Outage: 2017-10-07

Updated: October 8, 2017

Overview

This page gives some details on the nasa.gov DNSSEC outage on October 7, 2017.

Timeline / DNSViz

• 2017-10-07 12:05:44 UTC — bogus DNSSEC delegation
• 2017-10-07 12:07:41 UTC — bogus DNSSEC delegation
• 2017-10-07 15:27:10 UTC — bogus DNSSEC delegation
• 2017-10-07 15:27:30 UTC — bogus DNSSEC delegation
• 2017-10-07 15:30:45 UTC — bogus DNSSEC delegation
• 2017-10-07 15:38:54 UTC — bogus DNSSEC delegation
• 2017-10-07 15:44:03 UTC — bogus DNSSEC delegation
• 2017-10-07 15:50:09 UTC — bogus DNSSEC delegation
• 2017-10-07 15:58:40 UTC — bogus DNSSEC delegation
• 2017-10-07 16:02:10 UTC — bogus DNSSEC delegation
• 2017-10-07 16:21:28 UTC — bogus DNSSEC delegation
• 2017-10-07 16:21:44 UTC — bogus DNSSEC delegation
• 2017-10-07 16:36:12 UTC — bogus DNSSEC delegation
• 2017-10-07 16:51:15 UTC — bogus DNSSEC delegation
• 2017-10-07 17:00:14 UTC — bogus DNSSEC delegation
• 2017-10-07 17:01:29 UTC — bogus DNSSEC delegation
• 2017-10-07 17:02:25 UTC — bogus DNSSEC delegation
• 2017-10-07 17:03:57 UTC — bogus DNSSEC delegation
• 2017-10-07 17:08:56 UTC — bogus DNSSEC delegation
• 2017-10-07 17:10:08 UTC — bogus DNSSEC delegation
• 2017-10-07 17:11:45 UTC — bogus DNSSEC delegation
• 2017-10-07 17:14:56 UTC — DNSSEC outage over

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from October 7, 2017:

DNS-OARC: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

With DNSSEC, DNS queries fail:

$ dig +dnssec a nasa.gov. @184.105.193.73

; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec a nasa.gov. @184.105.193.73
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 52189
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;nasa.gov. IN A

;; Query time: 532 msec
;; SERVER: 184.105.193.73#53(184.105.193.73)
;; WHEN: Sat Oct 07 12:05:40 UTC 2017
;; MSG SIZE rcvd: 37

---

You have to disable DNSSEC to make DNS queries work:

$ dig +cd a nasa.gov. @184.105.193.73

; <<>> DiG 9.10.3-P4-Debian <<>> +cd a nasa.gov. @184.105.193.73
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35093
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 7

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nasa.gov. IN A

;; ANSWER SECTION:
nasa.gov. 595 IN A 52.0.14.116

;; AUTHORITY SECTION:
nasa.gov. 86393 IN NS ns1.nasa.gov.
nasa.gov. 86393 IN NS ns3.nasa.gov.
nasa.gov. 86393 IN NS ns2.nasa.gov.

;; ADDITIONAL SECTION:
ns1.nasa.gov. 86393 IN A 198.116.4.189
ns2.nasa.gov. 86393 IN A 198.116.4.185
ns3.nasa.gov. 86393 IN A 198.116.4.181
ns1.nasa.gov. 86393 IN AAAA 2001:4d0:8300:401::189
ns2.nasa.gov. 86393 IN AAAA 2001:4d0:2300:401::185
ns3.nasa.gov. 86393 IN AAAA 2001:4d0:6300:401::181

;; Query time: 532 msec
;; SERVER: 184.105.193.73#53(184.105.193.73)
;; WHEN: Sat Oct 07 12:05:45 UTC 2017
;; MSG SIZE rcvd: 239

Logfile examples

• [1507378099] unbound[44675:0] info: validation failure <www.nasa.gov. A IN>: no keys have a DS with algorithm RSASHA256 from 198.116.4.185 for key nasa.gov. while building chain of trust
• [1507396280] unbound[84115:0] info: validation failure <nasa.gov. A IN>: no keys have a DS with algorithm RSASHA256 from 198.116.4.189 for key nasa.gov. while building chain of trust
• [1507396544] unbound[84115:0] info: validation failure <www.nasa.gov. A IN>: no keys have a DS with algorithm RSASHA256 from 198.116.4.181 for key nasa.gov. while building chain of trust