.vn TLD DNSSEC Outage: 2018-03-15

Updated: March 21, 2018

Overview

This page gives some details on the .vn (Vietnam) TLD DNSSEC outage on March 15, 2018. It specifically addresses the 2nd-level DNSSEC failures of com.vn, net.vn, org.vn, etc., which cover a substantial percentage of vn's end-user domains. 2nd-level end-user domains such as example.vn were unaffected, while example.com.vn, example.org.vn and other such domains all failed.

Timeline / DNSViz

Google Public DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC. With DNSSEC, DNS queries result in SERVFAIL:

$ dig +dnssec ns com.vn. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec ns com.vn. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 37389
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;com.vn. IN NS

;; Query time: 527 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Mar 15 03:51:23 2018
;; MSG SIZE rcvd: 35

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns com.vn. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +cd ns com.vn. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43373
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;com.vn. IN NS

;; ANSWER SECTION:
com.vn. 20973 IN NS e.dns-servers.vn.
com.vn. 20973 IN NS a.dns-servers.vn.
com.vn. 20973 IN NS f.dns-servers.vn.
com.vn. 20973 IN NS b.dns-servers.vn.
com.vn. 20973 IN NS d.dns-servers.vn.
com.vn. 20973 IN NS g.dns-servers.vn.
com.vn. 20973 IN NS c.dns-servers.vn.

;; Query time: 13 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Mar 15 03:51:23 2018
;; MSG SIZE rcvd: 148

Zonemaster

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file with the relevant portion below (emphasis added):

;; Domain: com.vn.
;; No DNSKEY record found for com.vn.
[U] No data found for: com.vn. type A
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples