z.cash DNSSEC Outage: 2026-03-26 to 2026-03-28

Date: April 23, 2026

Overview

This page gives some details on the z.cash DNSSEC outage from March 26, 2026, to March 28, 2026. z.cash is the domain of the Zcash cryptocurrency.

Timeline / DNSViz

2026-03-27 19:45:15 UTC — No RRSIGs
2026-03-27 19:50:17 UTC — No RRSIGs
2026-03-27 19:52:14 UTC — No RRSIGs
2026-03-28 04:29:47 UTC — Last personally observed DNSSEC failure

DNSSEC Debugger

March 26 to March 28, 2028, DNSSEC outage of z.cash (Zcash)

CloudFlare Public DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC. With DNSSEC, DNS queries result in SERVFAIL:

$ dig +dnssec a z.cash. @1.1.1.1.

; <<>> DiG 9.11.5-P4-5.1+deb10u11-Debian <<>> +dnssec a z.cash. @1.1.1.1.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 15281
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; OPT=15: 00 16 ("..")
;; QUESTION SECTION:
;z.cash. IN A

;; Query time: 113 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Mar 27 15:52:07 EDT 2026
;; MSG SIZE rcvd: 41

You have do disable DNSSEC to make DNS queries work:

$ dig +cd a z.cash. @1.1.1.1.

; <<>> DiG 9.11.5-P4-5.1+deb10u11-Debian <<>> +cd a z.cash. @1.1.1.1.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12926
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;z.cash. IN A

;; ANSWER SECTION:
z.cash. 300 IN A 104.26.6.51
z.cash. 300 IN A 104.26.7.51
z.cash. 300 IN A 172.67.69.34

;; Query time: 9 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Mar 27 15:52:07 EDT 2026
;; MSG SIZE rcvd: 83

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file with the relevant portion below (emphasis added):

[T] z.cash. 3600 IN DS 2371 13 2 ee28cdf45f439751222c8dd75820034fe14f433f774d02ba267265db8f3a2d47
;; Domain: z.cash.
;; No DNSKEY record found for z.cash.
[U] z.cash. 300 IN A 159.223.106.103
z.cash. 300 IN A 104.26.6.51
z.cash. 300 IN A 172.67.69.34
z.cash. 300 IN A 104.26.7.51
;;[S] self sig OK; [B] bogus; [T] trusted

Logfile examples

[1774640700] unbound[452:0] info: validation failure <explorer.testnet.z.cash. A IN>: No DNSKEY record from 172.64.33.206 for key z.cash. while building chain of trust
[1774640712] unbound[452:0] info: validation failure <forum.z.cash. A IN>: key for validation z.cash. is marked as invalid because of a previous validation failure [1774640767] unbound[452:0] info: validation failure <mainnet.z.cash. A IN>: No DNSKEY record from 108.162.193.206 for key z.cash. while building chain of trust
[1774640857] unbound[452:0] info: validation failure <testnet.z.cash. A IN>: No DNSKEY record from 172.64.33.206 for key z.cash. while building chain of trust
[1774641009] unbound[452:0] info: validation failure <www.z.cash. A IN>: No DNSKEY record from 172.64.33.206 for key z.cash. while building chain of trust
[1774641020] unbound[452:0] info: validation failure <z.cash. A IN>: key for validation z.cash. is marked as invalid because of a previous validation failure <www.z.cash. A IN>: No DNSKEY record from 172.64.33.206 for key z.cash. while building chain of trust
[1774672000] unbound[452:0] info: validation failure <www.z.cash. A IN>: No DNSKEY record from 108.162.193.206 for key z.cash. while building chain of trust
[1774672011] unbound[452:0] info: validation failure <z.cash. A IN>: key for validation z.cash. is marked as invalid because of a previous validation failure <www.z.cash. A IN>: No DNSKEY record from 108.162.193.206 for key z.cash. while building chain of trust
[1774672065] unbound[452:0] info: validation failure <explorer.testnet.z.cash. A IN>: No DNSKEY record from 172.64.32.109 for key z.cash. while building chain of trust
[1774672077] unbound[452:0] info: validation failure <forum.z.cash. A IN>: key for validation z.cash. is marked as invalid because of a previous validation failure <explorer.testnet.z.cash. A IN>: No DNSKEY record from 172.64.32.109 for key z.cash. while building chain of trust
[1774672111] unbound[452:0] info: validation failure <mainnet.z.cash. A IN>: key for validation z.cash. is marked as invalid because of a previous validation failure <explorer.testnet.z.cash. A IN>: No DNSKEY record from 172.64.32.109 for key z.cash. while building chain of trust
[1774672187] unbound[452:0] info: validation failure <testnet.z.cash. A IN>: No DNSKEY record from 172.64.33.206 for key z.cash. while building chain of trust