irs.gov DNSSEC Outage: 2020-04-25

Date: April 25, 2020

Overview

This page gives some details on the irs.gov DNSSEC outage on April 25, 2020.

Timeline / DNSViz

Since DNSViz has lots its archives multiple times, here are some 3rd party copies:

DNSSEC Debugger

Unlike DNSViz, Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from April 25, 2020:

April 25, 2020 irs.gov DNSSEC outage

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

;; Domain: irs.gov.
[B] irs.gov. 7200 IN DNSKEY 256 3 8 ;{id = 11886 (zsk), size = 2048b}
irs.gov. 7200 IN DNSKEY 256 3 8 ;{id = 44484 (zsk), size = 2048b}
irs.gov. 7200 IN DNSKEY 257 3 8 ;{id = 60439 (ksk), size = 2048b}
irs.gov. 7200 IN DNSKEY 257 3 8 ;{id = 44947 (ksk), size = 2048b}
[B] irs.gov. 600 IN A 152.216.7.110
irs.gov. 600 IN A 152.216.11.110
;; Error: No keys with the keytag and algorithm from the RRSIG found
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples