dnssec-deployment.org DNSSEC Outage: 2020-09-18 to 2020-09-21

Date: September 21, 2020

Overview

This page gives some details on the dnssec-deployment.org DNSSEC outage from September 18 to September 21, 2020.

Timeline / DNSViz

I've included a screenshot of DNSViz output since DNSViz archives are unreliable.

September 20, 2020 DNSViz output for dnssec-deployment.org

Since DNSViz archives are unreliable, here are a couple copies from archive.is and archive.org.

DNSSEC Debugger

Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from September 18, 2020:

September 18, 2020 dnssec-deployment.org DNSSEC outage

Google DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

With DNSSEC, DNS queries fail:

$ dig +dnssec www.dnssec-deployment.org. @8.8.8.8

; <<>> dig 9.10.8-P1 <<>> +dnssec www.dnssec-deployment.org. @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 39583
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.dnssec-deployment.org. IN A

;; Query time: 45 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 19 03:31:50 UTC 2020
;; MSG SIZE rcvd: 54

You have to disable DNSSEC to make DNS queries work:

$ dig +cd www.dnssec-deployment.org. @8.8.8.8

; <<>> dig 9.10.8-P1 <<>> +cd www.dnssec-deployment.org. @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31965
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.dnssec-deployment.org. IN A

;; ANSWER SECTION:
www.dnssec-deployment.org. 299 IN CNAME d2w2n83npbbh31.amimoto-cdn.com.
d2w2n83npbbh31.amimoto-cdn.com. 59 IN A 13.227.21.97
d2w2n83npbbh31.amimoto-cdn.com. 59 IN A 13.227.21.66
d2w2n83npbbh31.amimoto-cdn.com. 59 IN A 13.227.21.14
d2w2n83npbbh31.amimoto-cdn.com. 59 IN A 13.227.21.16

;; Query time: 187 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Sep 19 03:32:06 UTC 2020
;; MSG SIZE rcvd: 162

Zonemaster

Note: Zonemaster requires javascript to display text.

dns.google.com

dns.google.com is related to but separate from Google Public DNS. During this DNSSEC outage, dns.google.com showed the following for dnssec-deployment.org:

September 18, 2020 DNSSEC outage for dnssec-deployment.org

Logfile examples

These log entries come from different servers in different geographical regions: