lb (Lebanon) DNSSEC Outage: 2020-11-02

Date: November 2, 2020

Overview

This page gives some details on the lb (Lebanon) DNSSEC outage on November 2, 2020.

Timeline / DNSViz

Verisign's DNSSEC Debugger

Here's a screenshot I took on November 2, 2020, of the DNSSEC Debugger output:

lb (Lebanon) TLD DNSSEC outage 2020-11-02

Google DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

$ dig +dnssec ns lb. @8.8.8.8

; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec ns lb. @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36853
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;lb. IN NS

;; Query time: 31 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Nov 02 00:13:45 UTC 2020
;; MSG SIZE rcvd: 31

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns lb. @8.8.8.8

; <<>> DiG 9.10.3-P4-Debian <<>> +cd ns lb. @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59137
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;lb. IN NS

;; ANSWER SECTION:
lb. 14399 IN NS FORK.STH.DNSNODE.NET.
lb. 14399 IN NS RIP.PSG.COM.
lb. 14399 IN NS ZEINA.AUB.EDU.lb.

;; Query time: 33 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Nov 02 00:13:45 UTC 2020
;; MSG SIZE rcvd: 118

Logfile examples