.ci (Côte d'Ivoire / Ivory Coast) DNSSEC Outage: 2023-10-21 to 2023-10-22

Date: October 21, 2023

Overview

This page gives some details on the .ci DNSSEC outage from October 21 to October 22, 2023.

Timeline / DNSViz

Here's a screenshot:

October 22 .ci DNSSEC outage

DNSSEC Debugger

Verisign's DNSSEC Debugger doesn't archive results, so here's a screenshot of my web browser's output from April 4, 2023:

October 22, 2023 .ci TLD DNSSEC outage as shown by DNSSEC Debugger

Google DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC.

$ dig +dnssec ns ci. @8.8.8.8.

; <<>> dig 9.10.8-P1 <<>> +dnssec ns ci. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12704
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;ci. IN NS

;; Query time: 44 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Oct 21 07:17:50 UTC 2023
;; MSG SIZE rcvd: 31

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns ci. @8.8.8.8.

; <<>> dig 9.10.8-P1 <<>> +cd ns ci. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49321
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;ci. IN NS

;; ANSWER SECTION:
ci. 7200 IN NS ns.nic.ci.
ci. 7200 IN NS ns-ci.afrinic.net.
ci. 7200 IN NS ci.hosting.nic.fr.
ci. 7200 IN NS phloem.uoregon.edu.
ci. 7200 IN NS any.nic.ci.

;; Query time: 22 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Oct 21 07:17:50 UTC 2023
;; MSG SIZE rcvd: 164

Zonemaster

Please note that Zonemaster requires javascript to display webpage text.

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file, with the relevant portion below (emphasis added):

[T] ci. 86400 IN DS 60224 8 2 0fb751f1b2230b9ef643ddce8c30acd1e7cc20fa7d52346ca074a32b8f01c686
;; Domain: ci.
[B] ci. 7200 IN DNSKEY 257 3 8 ;{id = 60224 (ksk), size = 1024b}
ci. 7200 IN DNSKEY 256 3 8 ;{id = 36075 (zsk), size = 1024b}
[U] No data found for: ci. type A
;;[S] self sig OK; [B] bogus; [T] trusted; [U] unsigned

Logfile examples