usfj.mil DNSSEC Outage: 2015-11-13 to 2015-11-16
Updated: November 16, 2015
Overview
This page gives some details on the usfj.mil DNSSEC outage from November 13 to November 16, 2015.
Timeline / DNSViz
- 2015-11-13 05:44:05 UTC: RRSIGs expire
- 2015-11-13 06:46:35 UTC: expired RRSIGs
- 2015-11-13 14:45:59 UTC: expired RRSIGs
- 2015-11-13 16:57:36 UTC: expired RRSIGs
- 2015-11-13 22:46:24 UTC: expired RRSIGs
- 2015-11-14 06:46:09 UTC: expired RRSIGs
- 2015-11-14 14:46:53 UTC: expired RRSIGs
- 2015-11-14 22:46:12 UTC: expired RRSIGs
- 2015-11-15 06:46:37 UTC: expired RRSIGs
- 2015-11-15 14:46:15 UTC: expired RRSIGs
- 2015-11-15 22:45:42 UTC: expired RRSIGs
- 2015-11-16 01:57:34 UTC: expired RRSIGs
- 2015-11-16 06:33:37 UTC: last personally observed DNSSEC failure
- 2015-11-16 08:13:26 UTC: DNSSEC outage over
OpenDNS & Google Public DNS
OpenDNS does not support DNSSEC, instead supporting DNSCurve. Google Public DNS currently supports only DNSSEC, and thus, Google's users saw SERVFAIL for queries under usfj.mil during this outage.
With OpenDNS, queries succeed:
$ dig www.usfj.mil. @resolver1.opendns.com.
; <<>> DiG 9.4.2-P2 <<>> www.usfj.mil. @resolver1.opendns.com.
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41841
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.usfj.mil. IN A
;; ANSWER SECTION:
www.usfj.mil. 2111 IN CNAME www.dodpw.defense.gov.edgesuite.net.
www.dodpw.defense.gov.edgesuite.net. 285 IN CNAME a1603.dscb.akamai.net.
a1603.dscb.akamai.net. 20 IN A 216.206.30.32
a1603.dscb.akamai.net. 20 IN A 216.206.30.43
;; Query time: 217 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Fri Nov 13 16:59:48 2015
;; MSG SIZE rcvd: 143
With Google Public DNS, with DNSSEC, queries fail:
$ dig www.usfj.mil. @8.8.8.8
; <<>> DiG 9.4.2-P2 <<>> www.usfj.mil. @8.8.8.8
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54936
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.usfj.mil. IN A
;; Query time: 337 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Nov 13 16:59:54 2015
;; MSG SIZE rcvd: 30
dnscheck
dnscheck.labs.nic.cz archived a DNSSEC outage at 2015-11-13 16:57:22 (requires javascript).
dnscheck.iis.se archived a DNSSEC outage at 2015-11-13 16:57:13 (requires javascript).
Zonemaster
Zonemaster archived this usfj.mil DNSSEC outage.