.vn TLD DNSSEC Outage: 2026-10-22

Updated: October 22, 2026

Overview

This page gives some details on the .vn (Vietnam) TLD DNSSEC outage on October 22, 2026. This is not the first DNSSEC outage for Vietnam.

Timeline / DNSViz

2026-10-22 02:33:15 UTC — first personally observed .vn DNSSEC failure
2026-10-22 02:33:46 UTC — No RRSIGs
2026-10-22 02:40:17 UTC — No RRSIGs
2026-10-22 03:21:28 UTC — DNSSEC mess
2026-10-22 03:24:46 UTC — DNSSEC mess
2026-10-22 03:31:38 UTC — last personally observed .vn DNSSEC failure
2026-10-22 03:32:25 UTC — outage over but DNSSEC debris remains

Google Public DNS: with and without DNSSEC

DNSSEC can be disabled in queries via the CD (checking disabled) bit. Let's compare DNS queries with and without DNSSEC. With DNSSEC, DNS queries result in SERVFAIL:

$ dig +dnssec ns vn. @8.8.8.8.

; <<>> dig 9.10.8-P1 <<>> +dnssec ns vn. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 44901
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
; EDE: 10 (RRSIGs Missing): 46 6f 72 20 76 6e 2f 6e 73 ("For vn/ns")
;; QUESTION SECTION:
;vn. IN NS

;; Query time: 15 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 22 02:33:18 UTC 2026
;; MSG SIZE rcvd: 46

You have to disable DNSSEC to make DNS queries work:

$ dig +cd ns vn. @8.8.8.8.

; <<>> dig 9.10.8-P1 <<>> +cd ns vn. @8.8.8.8.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12352
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;vn. IN NS

;; ANSWER SECTION:
vn. 21600 IN NS b.dns-servers.vn.
vn. 21600 IN NS d.dns-servers.vn.
vn. 21600 IN NS a.dns-servers.vn.
vn. 21600 IN NS c.dns-servers.vn.
vn. 21600 IN NS f.dns-servers.vn.
vn. 21600 IN NS e.dns-servers.vn.
vn. 21600 IN NS g.dns-servers.vn.
vn. 21600 IN NS h.dns-servers.vn.

;; Query time: 15 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 22 02:33:18 UTC 2026
;; MSG SIZE rcvd: 171

drill trace

Since DNSSEC contains so much garbage, I put the complete drill trace into its own file with the relevant portion below (emphasis added):

[T] vn. 86400 IN DS 16196 8 2 cb68c5384104b31e1d9cbc1c45f861a92cda9d8121afe76f9a8978527983fd99
vn. 86400 IN DS 16196 8 4 276643f5ef43a0610277c06cc5261056728450b1584b34f6d19f4c5bd9dd1deff2d5d3cb805b86718b1e0778682afe91
;; Domain: vn.
;; No DNSKEY record found for vn.
[U] No data found for: vn. type A
;;[S] self sig OK; [B] bogus; [T] trusted; [U] unsigned

Logfile examples

[1792636395] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 203.119.73.105 for key vn. while building chain of trust
[1792636523] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 203.119.38.105 and 203.119.38.105 for key vn. while building chain of trust
[1792636645] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 204.61.216.115 for key vn. while building chain of trust
[1792636797] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 203.119.73.105 for key vn. while building chain of trust
[1792637044] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 203.119.68.105 for key vn. while building chain of trust
[1792637437] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 203.119.38.105 and 203.119.60.105 for key vn. while building chain of trust
[1792637660] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 203.119.60.105 for key vn. while building chain of trust
[1792637918] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 202.47.142.105 for key vn. while building chain of trust
[1792638083] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 194.0.1.18 and 194.0.1.18 for key vn. while building chain of trust
[1792638167] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 203.119.44.105 for key vn. while building chain of trust
[1792638313] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 202.47.142.105 for key vn. while building chain of trust
[1792638474] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 203.119.44.105 for key vn. while building chain of trust
[1792638576] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 203.119.60.105 for key vn. while building chain of trust
[1792638970] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 203.119.38.105 for key vn. while building chain of trust
[1792639147] unbound[72081:0] info: validation failure <vn. NS IN>: no keys have a DS with algorithm RSASHA256 from 203.119.73.105 for key vn. while building chain of trust
[1792639898] unbound[72081:0] info: validation failure <vn. NS IN>: No DNSKEY record [misc failure] from 204.61.216.115 and 203.119.73.105 and 203.119.73.105 for key vn. while building chain of trust