nasa.gov DNSSEC Outage: 2017-12-04

Updated: December 5, 2017

Overview

This page gives some details on the nasa.gov DNSSEC outage on December 4, 2017. NASA has had numerous DNSSEC outages.

Timeline / DNSViz

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from December 4, 2017:

December 4, 2017 nasa.gov DNSSEC outage

DNS-OARC: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

With DNSSEC, DNS queries fail:

$ dig +dnssec a nasa.gov. @184.105.193.73

; <<>> DiG 9.4.2-P2 <<>> +dnssec a nasa.gov. @184.105.193.73
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 57427
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;nasa.gov. IN A

;; Query time: 537 msec
;; SERVER: 184.105.193.73#53(184.105.193.73)
;; WHEN: Mon Dec 4 22:49:58 2017
;; MSG SIZE rcvd: 37

You have to disable DNSSEC to make DNS queries work:

$ dig +cd a nasa.gov. @184.105.193.73

; <<>> DiG 9.4.2-P2 <<>> +cd a nasa.gov. @184.105.193.73
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57850
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 6

;; QUESTION SECTION:
;nasa.gov. IN A

;; ANSWER SECTION:
nasa.gov. 600 IN A 52.0.14.116
nasa.gov. 600 IN A 23.22.39.120

;; AUTHORITY SECTION:
nasa.gov. 86389 IN NS ns1.nasa.gov.
nasa.gov. 86389 IN NS ns3.nasa.gov.
nasa.gov. 86389 IN NS ns2.nasa.gov.

;; ADDITIONAL SECTION:
ns1.nasa.gov. 86378 IN A 198.116.4.189
ns2.nasa.gov. 86378 IN A 198.116.4.185
ns3.nasa.gov. 86378 IN A 198.116.4.181
ns1.nasa.gov. 86378 IN AAAA 2001:4d0:8300:401::189
ns2.nasa.gov. 86378 IN AAAA 2001:4d0:2300:401::185
ns3.nasa.gov. 86378 IN AAAA 2001:4d0:6300:401::181

;; Query time: 456 msec
;; SERVER: 184.105.193.73#53(184.105.193.73)
;; WHEN: Mon Dec 4 22:49:59 2017
;; MSG SIZE rcvd: 244

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file with the relevant portion below (emphasis added):

;; Domain: nasa.gov.
[B] nasa.gov. 600 IN DNSKEY 256 3 8 ;{id = 45846 (zsk), size = 1024b}
nasa.gov. 600 IN DNSKEY 257 3 8 ;{id = 23962 (ksk), size = 2048b}
nasa.gov. 600 IN DNSKEY 256 3 8 ;{id = 57978 (zsk), size = 1024b}
[U] nasa.gov. 600 IN A 52.0.14.116
nasa.gov. 600 IN A 23.22.39.120
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples