usfj.mil DNSSEC Outage: 2015-08-20

Updated: August 20, 2015

Overview

This page gives some details on the usfj.mil DNSSEC outage on August 20, 2015. It appears the usfj.mil nameservers were completely down for over a day, then briefly returned to serve expired RRSIGs before bowing out again.

Timeline

• 2015-08-20 07:09:12 UTC — first personally observed DNSSEC failure (expired RRSIGs)
• 2015-08-20 07:41:55 UTC — last personally observed DNSSEC failure (expired RRSIGs)

DNSViz

DNSViz missed the brief window where usfj.mil servers returned serving expired RRSIGs.

• 2015-08-19 06:46:30 UTC — DNS servers appear entirely down
• 2015-08-19 14:47:13 UTC — DNS servers appear entirely down
• 2015-08-19 22:46:18 UTC — DNS servers appear entirely down
• 2015-08-20 06:47:11 UTC — DNS servers appear entirely down
• 2015-08-20 14:47:27 UTC — DNS servers appear entirely down

Logfile examples

• [1440054552] unbound[5714:0] info: validation failure <usfj.mil. A IN>: signature expired from 215.1.46.29 for key usfj.mil. while building chain of trust
• [1440055062] unbound[5714:0] info: validation failure <usfj.mil. A IN>: signature expired from 199.211.150.66 for key usfj.mil. while building chain of trust
• [1440056515] unbound[5714:0] info: validation failure <usfj.mil. A IN>: signature expired from 215.1.46.29 for key usfj.mil. while building chain of trust