.na TLD DNSSEC Outage: 2019-07-08

Date: July 8, 2019

Overview

This page gives some details on the .na (Namibia) TLD DNSSEC outage on July 8, 2019. It lasted about four hours.

Timeline / DNSViz

At the time of this writing, DNSViz historical archives have been down for months. DNSSEC makes its users think downtime doesn't matter, so here's a screenshot of my web browser's output:

July 8, 2019 .na TLD DNSSEC outage as shown by dnsviz.net

archive.fo was kind enough to save a report of this .na DNSSEC outage.

DNSSEC Debugger

Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from July 8, 2019:

July 8, 2019 .na TLD DNSSEC outage as shown by DNSSEC Debugger

archive.fo was also kind enough to save this DNSSEC output for na.

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

;; Domain: na.
;; No DNSKEY record found for na.
[U] No data found for: na. type A
;;[S] self sig OK; [B] bogus; [T] trusted

Google DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

$ dig +dnssec ns na. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec ns na. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48107
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;na. IN NS

;; Query time: 30 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jul 8 12:07:20 2019
;; MSG SIZE rcvd: 31

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns na. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +cd ns na. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8472
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;na. IN NS

;; ANSWER SECTION:
na. 21599 IN NS anyc2.irondns.net.
na. 21599 IN NS merlin.net.na.
na. 21599 IN NS na-ns.anycast.pch.net.
na. 21599 IN NS a.na.dyntld.net.
na. 21599 IN NS b.na.dyntld.net.
na. 21599 IN NS sns-pb.isc.org.

;; Query time: 15 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jul 8 12:07:20 2019
;; MSG SIZE rcvd: 178

dns.google.com

dns.google.com is related to but separate from Google Public DNS. During this DNSSEC outage, dns.google.com showed the following for na:

July 8, 2019 dns.google.com output for na

This data is also saved by archive.org and archive.fo.

Zonemaster

Logfile examples

These Unbound log entries come from different Unbound instances, each on different servers in different geographical regions.