.tn TLD DNSSEC Outage: 2021-05-27

Date: May 27, 2021

Overview

This page gives some details on the .tn (Tunisia) TLD DNSSEC outage on May 27, 2021.

Timeline / DNSViz

2021-05-27 08:13:26 UTC — first personally witnessed <tn. NS IN> DNSSEC failure
2021-05-27 08:30:06 UTC — No DNSKEY
- (archive.is copy)
- (archive.org copy)
2021-05-27 10:07:12 UTC — last personally witnessed <tn. NS IN> DNSSEC failure

Since DNSViz regularly loses its own archives, I saved a screenshot of the DNSViz output:

May 27, 2021 .tn (Tunisia) TLD DNSSEC outage, at DNSViz

DNSSEC Debugger

Here's a screenshot of my web browser's output from May 27, 2021:

May 27, 2021 .tn (Tunisia) TLD DNSSEC outage

Google DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

$ dig +dnssec ns tn. @8.8.8.8.

; <<>> dig 9.10.8-P1 <<>> +dnssec ns tn. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 52865
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;tn. IN NS

;; Query time: 175 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu May 27 08:23:41 UTC 2021
;; MSG SIZE rcvd: 31

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns tn. @8.8.8.8.

; <<>> dig 9.10.8-P1 <<>> +cd ns tn. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41670
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;tn. IN NS

;; ANSWER SECTION:
tn. 21599 IN NS ns2.ati.tn.
tn. 21599 IN NS rip.psg.com.
tn. 21599 IN NS ns-tn.afrinic.net.
tn. 21599 IN NS ns1.ati.tn.
tn. 21599 IN NS ns2.nic.fr.
tn. 21599 IN NS pch.ati.tn.

;; Query time: 15 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu May 27 08:23:41 UTC 2021
;; MSG SIZE rcvd: 169

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

[T] tn. 86400 IN DS 8629 8 2 05c891303fdee4fdae258e2a7d48370ce21f98058c0ee0a50c438c2878a8e2d6
;; Domain: tn.
;; No DNSKEY record found for tn.
[U] No data found for: tn. type A
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples

These Unbound log entries come from different Unbound instances, each on different servers in different geographical regions.

[1622103206] unbound[316:0] info: validation failure <tn. NS IN>: no signatures from 196.216.168.25
[1622104178] unbound[316:0] info: validation failure <tn. NS IN>: no signatures from 41.228.63.62
[1622103816] unbound[33032:0] info: validation failure <tn. NS IN>: No DNSKEY record from 41.228.63.62 for key tn. while building chain of trust
[1622104928] unbound[316:0] info: validation failure <tn. NS IN>: no signatures from 192.93.0.4
[1622109391] unbound[33032:0] info: validation failure <tn. NS IN>: No DNSKEY record from 196.216.168.25 for key tn. while building chain of trust
[1622109680] unbound[33032:0] info: validation failure <tn. NS IN>: No DNSKEY record from 204.61.216.94 for key tn. while building chain of trust
[1622110010] unbound[33032:0] info: validation failure <tn. NS IN>: No DNSKEY record from 41.228.63.62 for key tn. while building chain of trust
[1622110032] unbound[316:0] info: validation failure <tn. NS IN>: no signatures from 147.28.0.39