.mtr TLD DNSSEC Outage: 2018-09-15

Date: September 15, 2018

Overview

This page gives some details on the mtr TLD DNSSEC outage on September 15, 2018.

Timeline / DNSViz

Verisign's DNSSEC Debugger

Here's a screenshot I took on September 15, 2018, of the DNSSEC Debugger output:

September 15, 2018 .mtr TLD DNSSEC outage

Google Public DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC. With DNSSEC, DNS queries result in SERVFAIL:

$ dig +dnssec ns mtr. @8.8.8.8

; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec ns mtr. @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3244
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;mtr. IN NS

;; Query time: 209 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 15 00:42:00 UTC 2018
;; MSG SIZE rcvd: 32

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns mtr. @8.8.8.8

; <<>> DiG 9.10.3-P4-Debian <<>> +cd ns mtr. @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6229
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mtr. IN NS

;; ANSWER SECTION:
mtr. 21599 IN NS ns1.nic.mtr.
mtr. 21599 IN NS ns4.nic.mtr.
mtr. 21599 IN NS ns3.nic.mtr.
mtr. 21599 IN NS ns2.nic.mtr.

;; Query time: 205 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 15 00:42:00 UTC 2018
;; MSG SIZE rcvd: 108

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file with the relevant portion below (emphasis added):

;; Domain: mtr.
[B] mtr. 900 IN DNSKEY 256 3 8 ;{id = 20178 (zsk), size = 1024b}
mtr. 900 IN DNSKEY 257 3 8 ;{id = 40897 (ksk), size = 2048b}
[B] Error verifying denial of existence for mtr. type A: No keys with the keytag and algorithm from the RRSIG found
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples