.vu TLD DNSSEC Outage: 2018-01-11

Updated: January 11, 2018

Overview

This page gives some details on the .vu (Vanuatu) TLD DNSSEC outage on January 11, 2018.

Timeline / DNSViz

2018-01-11 00:00:00 UTC — RRSIGs expire
2018-01-11 00:01:32 UTC — expired RRSIGs
2018-01-11 00:03:33 UTC — expired RRSIGs
2018-01-11 00:05:13 UTC — expired RRSIGs
2018-01-11 00:07:47 UTC — expired RRSIGs
2018-01-11 03:38:52 UTC — expired RRSIGs
2018-01-11 07:41:20 UTC — expired RRSIGs
2018-01-11 08:39:54 UTC — expired RRSIGs
2018-01-11 08:52:20 UTC — last personally observed DNSSEC failure

Verisign's DNSSEC Debugger

Here's a screenshot I took on January 11, 2018, of the DNSSEC Debugger output:

Google Public DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC. With DNSSEC, DNS queries result in SERVFAIL:

$ dig +dnssec ns vu. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec ns vu. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2609
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;vu. IN NS

;; Query time: 863 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Jan 11 00:07:28 2018
;; MSG SIZE rcvd: 31

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns vu. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +cd ns vu. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19006
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;vu. IN NS

;; ANSWER SECTION:
vu. 19944 IN NS ns2-cctld.vunic.vu.
vu. 19944 IN NS fork.sth.dnsnode.net.
vu. 19944 IN NS ns1-cctld.vunic.vu.
vu. 19944 IN NS efate.vanuatu.com.vu.
vu. 19944 IN NS anytld.apnic.net.
vu. 19944 IN NS santo.vanuatu.com.vu.
vu. 19944 IN NS rip.psg.com.

;; Query time: 8 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Jan 11 00:07:28 2018
;; MSG SIZE rcvd: 212

Zonemaster

zonemaster.net archived "Delegation from parent to child is not properly signed signature: DNSSEC signature has expired."

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file with the relevant portion below (emphasis added):

;; Domain: vu.
[B] vu. 86400 IN DNSKEY 256 3 10 ;{id = 37496 (zsk), size = 1024b}
vu. 86400 IN DNSKEY 257 3 10 ;{id = 32532 (ksk), size = 2048b}
[U] No data found for: vu. type A
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples

[1515629242] unbound[66569:0] info: validation failure <vu. NS IN>: signature expired from 77.72.229.254 and 202.80.32.9 for key vu. while building chain of trust
[1515629439] unbound[66569:0] info: validation failure <vu. NS IN>: signature expired from 202.80.32.9 for key vu. while building chain of trust
[1515642543] unbound[66569:0] info: validation failure <parliament.gov.vu. A IN>: signature expired from 77.72.229.254 for key vu. while building chain of trust
[1515660740] unbound[92886:0] info: validation failure <vu. NS IN>: signature expired from 77.72.229.254