.tn TLD DNSSEC Outage: 2019-10-01

Date: October 1, 2019

Overview

This page gives some details on the .tn (Tunisia) TLD DNSSEC outage on October 1, 2019.

Timeline / DNSViz

(At the time of this writing, DNSViz historical archives have been down for months. DNSSEC makes its users think downtime doesn't matter.)

2019-10-01 12:10:42 UTC — first personally witnessed <tn. NS IN> DNSSEC failure
2019-10-01 13:24:25 UTC — last personally witnessed <tn. NS IN> DNSSEC failure

DNSSEC Debugger

Here's a screenshot of my web browser's output from October 1, 2019:

October 1, 2019 .tn (Tunisia) TLD DNSSEC outage

Google DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

$ dig +dnssec ns tn. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +dnssec ns tn. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 7031
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;tn. IN NS

;; Query time: 21 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Oct 1 12:10:44 2019
;; MSG SIZE rcvd: 31

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns tn. @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> +cd ns tn. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22788
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;tn. IN NS

;; ANSWER SECTION:
tn. 21599 IN NS pch.ati.tn.
tn. 21599 IN NS ns1.ati.tn.
tn. 21599 IN NS ns2.ati.tn.
tn. 21599 IN NS ns2.nic.fr.
tn. 21599 IN NS ns-tn.afrinic.net.
tn. 21599 IN NS rip.psg.com.

;; Query time: 16 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Oct 1 12:10:44 2019
;; MSG SIZE rcvd: 158

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

;; Domain: tn.
;; No DNSKEY record found for tn.
[U] No data found for: tn. type A
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples

These Unbound log entries come from different Unbound instances, each on different servers in different geographical regions.

[1569931842] unbound[95122:0] info: validation failure <tn. NS IN>: no signatures from 196.216.168.25
[1569932085] unbound[95122:0] info: validation failure <tn. NS IN>: No DNSKEY record from 192.93.0.4 for key tn. while building chain of trust
[1569933751] unbound[185:0] info: validation failure <tn. NS IN>: No DNSKEY record from 41.228.62.63 for key tn. while building chain of trust
[1569935604] unbound[185:0] info: validation failure <tn. NS IN>: No DNSKEY record from 204.61.216.94 for key tn. while building chain of trust
[1569936159] unbound[95122:0] info: validation failure <tn. NS IN>: no signatures from 41.228.63.62 for key tn. while building chain of trust
[1569936265] unbound[185:0] info: validation failure <tn. NS IN>: No DNSKEY record from 147.28.0.39 for key tn. while building chain of trust