gsu.edu DNSSEC Outage: 2022-03-18
Date: March 18, 2022
Overview
This page gives some details on the gsu.edu (Georgia State University) DNSSEC outage on March 18, 2022.
Timeline / DNSViz
I've included screenshots of DNSViz output since DNSViz archives have been lost multiple times.
- 2022-03-18 22:28:22 UTC — first personally observed gsu.edu DNSSEC failure
- 2022-03-18 22:28:42 UTC — Bogus DNSSEC delegation
Google Public DNS: with and without DNSSEC
DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC. With DNSSEC, DNS queries result in SERVFAIL:
$ dig +dnssec a gsu.edu. @8.8.8.8.
; <<>> dig 9.10.8-P1 <<>> +dnssec a gsu.edu. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 46745
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;gsu.edu. IN A
;; Query time: 65 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Mar 18 22:29:28 UTC 2022
;; MSG SIZE rcvd: 36
You have to disable DNSSEC to make DNS queries work:
$ dig +cd a gsu.edu. @8.8.8.8.
; <<>> dig 9.10.8-P1 <<>> +cd a gsu.edu. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22356
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;gsu.edu. IN A
;; ANSWER SECTION:
gsu.edu. 3600 IN A 166.78.46.98
;; Query time: 64 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Mar 18 22:29:28 UTC 2022
;; MSG SIZE rcvd: 52
Logfile example
- [1647642502] unbound[95966:0] info: validation failure <gsu.edu. A IN>: no keys have a DS with algorithm RSASHA1 from 131.96.7.116 for key gsu.edu. while building chain of trust