usfj.mil DNSSEC Outage: 2016-04-10 to 2016-04-11

Updated: April 11, 2016

Overview

This page gives some details on the usfj.mil DNSSEC outage from April 10 to April 11, 2016. It was the lucky 13th DNSSEC outage of the year for usfj.mil.

Note: usfj.mil had just had DNSSEC outages from April 7 to April 8, another on April 8, and yet another on April 9th. It was fixed for a while before this outage began. After a short period of uptime, the old, expired DNSKEY RRSIG from that outage was re-deployed, causing a new distinct DNSSEC outage. Crazy but true.

Timeline / DNSViz

• (2016-04-07 21:48:24 UTC) — RRSIGs expire. This old DNSKEY was put back into service, causing the outage
• 2016-04-10 00:16:55 UTC — first personally observed DNSSEC failure
• 2016-04-10 14:46:13 UTC — expired RRSIGs
• 2016-04-10 22:45:46 UTC — expired RRSIGs
• 2016-04-11 06:55:18 UTC — very short-lived uptime: some expired RRSIGs, but most "important" queries succeed
• 2016-04-11 14:46:22 UTC — expired RRSIGs
• 2016-04-11 18:18:43 UTC — last personally observed DNSSEC failure
• 2016-04-11 21:29:13 UTC — DNSSEC outage over