Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

111–120 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#111

Post by qazwsxedchac »

krystofbe wrote: post #7

Looks like a DNSSEC issue, not a nameserver outage. Validating resolvers SERVFAIL on every .de name with EDE: RRSIG with malformed signature found for a0d5d1p51kijsevll74k523htmq406bk.de/nsec3 (keytag=33834) dig +cd amazon.de @8.8.8.8 works, dig amazon.de @a.nic.de works. Zone data is intact, DENIC just published an RRSIG over an NSEC3 record that doesn't validate against ZSK 33834. Every validating resolver therefor…

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat.

Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

Re: DNSSEC disruption affecting .de domains – Resolved

#112

Post by 9dev »

greyhound wrote: post #107
warpspin wrote: post #88

Earlier quoted context omitted.

It's night. Somebody has to fill a form to approve night work first.

And send it by post for approval, which will take 5-30 business days.

Oh come on, that’s not true. You could also fax it. That might come with an additional processing fee though.

Re: DNSSEC disruption affecting .de domains – Resolved

#113

Post by g4cg54g54 »

funfact: enabling DNS sec NOW will fix your domain instantly if dnssec was disabled before

-> no idea if that also "heals" anyone who had dnssec on before.

-> no idea if maybe they need to roll back something and then rebreak the new dnssec i made a minute later lol...

Re: DNSSEC disruption affecting .de domains – Resolved

#115

Post by niklasrde »

sunaookami wrote: post #109
kaltsturm wrote: post #57

even their own status page is not reachable: https://status.denic.de/ As fallback they should use their X account: https://x.com/denic_de

They did now! https://x.com/denic_de/status/2051779175908774148

And in English: https://x.com/denic_de/status/2051779740080521646

Re: DNSSEC disruption affecting .de domains – Resolved

#116

Post by tom1337 »

I have never used DNSSEC and never really bothered implementing it, but do I understand it correctly that we took the decentralized platform DNS was and added a single-point-of-failure certificate layer on top of it which now breaks because the central organisation managing this certificate has an outage taking basically all domains with them?

Re: DNSSEC disruption affecting .de domains – Resolved

#118

Post by 9dev »

ricardo81 wrote: post #60
notpushkin wrote: post #33

Earlier quoted context omitted.

{"data":{"error":"Imgur is temporarily over capacity. Please try again later."},"success":false,"status":403} There is some strange irony to this, I suppose.

I get "content not viewable in your region", from the UK. Not an ideal image sharing website nowadays.

Rather, not an ideal legislation nowadays…

Re: DNSSEC disruption affecting .de domains – Resolved

#119

Post by gpvos »

merb wrote: post #22

Well at least it’s night time which means it’s hopefully resolved in the morning. Looks like it failed after a maintenance: https://www.namecheap.com/status-updates/planned-denic-de-re... https://status.denic.de/

If so, it still worked for several hours after the maintenance was completed.
Post reply on HN