time.nist.gov DNSSEC Outage: 2019-07-31 to 2019-08-01

Date: August 1, 2019

Overview

This page gives some details on the time.nist.gov DNSSEC outage from July 31 to August 1, 2019. It was not the first DNSSEC outage for time.nist.gov. This one lasted a whole day.

Timeline / DNSViz

DNSViz historical archives have been down for months at the time of this writing.

I contend that DNSSEC makes its users and advocates numb to outages, which creeps into and degrades their other work.

2019-07-31 14:31:09 UTC — first personally observed time.nist.gov DNSSEC failure
2019-08-01 14:04:49 UTC — last personally observed time.nist.gov DNSSEC failure

Here's a screenshot of DNSViz output, since dnsviz.net appears to be abandoned:

August 1, 2019 glb.nist.gov dnssec outage, shown by dnsviz.net

DNSSEC Debugger

Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from July 31, 2019:

July 31, 2019 glb.nist.gov DNSSEC outage

Zonemaster

zonemaster.iis.se archived "Det finns ingen DS-post som har en DNSKEY-post med matchande keytag." Here is a copy from archive.is.
zonemaster.labs.nic.cz archived "No DS record had a DNSKEY with a matching keytag."

dns.google.com

dns.google.com is related to but separate from Google Public DNS. During this DNSSEC outage, dns.google.com showed the following for glb.nist.gov:

This data is also saved by archive.org.

Logfile examples

[1564583469] unbound[93227:0] info: validation failure <time.nist.gov. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 129.6.13.8 for key glb.nist.gov. while buildi ng chain of trust
[1564598900] unbound[177:0] info: validation failure <time.nist.gov. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 132.163.4.64 for key glb.nist.gov. while building chain of trust
[1564599398] unbound[177:0] info: validation failure <time.nist.gov. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 129.6.13.8 for key glb.nist.gov. while building chain of trust
[1564668289] unbound[93227:0] info: validation failure <time.nist.gov. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 132.163.4.64 for key glb.nist.gov. while building chain of trust