.xn--qxam TLD DNSSEC Outage: 2021-08-01
Date: August 1, 2021
Overview
This page gives some details on the .xn--qxam (Greek IDN) TLD DNSSEC outage on August 1, 2021.
Timeline / DNSViz
- 2021-08-01 16:43:27 UTC — No DNSSEC records
- 2021-08-01 16:45:04 UTC — No DNSSEC records
- 2021-08-01 17:39:46 UTC — No DNSSEC records
- 2021-08-01 21:14:12 UTC — last personally observed xn--qxam DNSSEC failure
I've also included a screenshot, given DNSViz's propensity to lose its archives.
DNSSEC Debugger
Here's a screenshot of my web browser's output from August 1, 2021:
Google DNS: with and without DNSSEC
DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.
$ dig +dnssec ns xn--qxam. @8.8.8.8.
; <<>> dig 9.10.8-P1 <<>> +dnssec ns xn--qxam. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 17743
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;xn--qxam. IN NS
;; Query time: 35 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Aug 01 16:38:48 UTC 2021
;; MSG SIZE rcvd: 37
You have to disable DNSSEC to make DNS queries work:
$ dig +cd ns xn--qxam. @8.8.8.8.
; <<>> dig 9.10.8-P1 <<>> +cd ns xn--qxam. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 852
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;xn--qxam. IN NS
;; ANSWER SECTION:
xn--qxam. 10799 IN NS gr-c.ics.forth.gr.
xn--qxam. 10799 IN NS gr-d.ics.forth.gr.
xn--qxam. 10799 IN NS gr-m.ics.forth.gr.
xn--qxam. 10799 IN NS estia.ics.forth.gr.
xn--qxam. 10799 IN NS gr-at.ics.forth.gr.
xn--qxam. 10799 IN NS grdns.ics.forth.gr.
;; Query time: 36 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Aug 01 16:38:48 UTC 2021
;; MSG SIZE rcvd: 166
drill trace
Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):
[T] xn--qxam. 86400 IN DS 55983 7 1 ee1acba7831fee4d79f434131be29bd9962901d4
xn--qxam. 86400 IN DS 55983 7 2 3e135aa5a7c428e65386925a99da9404b0135eaa5f5a3fc4e747d75c99618e0c
;; Domain: xn--qxam.
;; No DNSKEY record found for xn--qxam.
[U] No data found for: xn--qxam. type A
;;[S] self sig OK; [B] bogus; [T] trusted
Logfile examples
These Unbound log entries come from different Unbound instances, each on different servers in different geographical regions.
- [1627835712] unbound[316:0] info: validation failure <xn--qxam. NS IN>: no signatures from 78.104.145.227
- [1627835904] unbound[316:0] info: validation failure <xn--qxam. NS IN>: no signatures from 194.0.11.102
- [1627836086] unbound[316:0] info: validation failure <xn--qxam. NS IN>: no signatures from 194.0.4.10
- [1627836272] unbound[316:0] info: validation failure <xn--qxam. NS IN>: no signatures from 139.91.191.3
- [1627835926] unbound[63248:0] info: validation failure <xn--qxam. NS IN>: No DNSKEY record from 78.104.145.227 for key xn--qxam. while building chain of trust
- [1627852087] unbound[63248:0] info: validation failure <xn--qxam. NS IN>: No DNSKEY record from 194.0.11.102 for key xn--qxam. while building chain of trust
- [1627852452] unbound[316:0] info: validation failure <xn--qxam. NS IN>: No DNSKEY record from 139.91.191.3 for key xn--qxam. while building chain of trust